AntennaHouse DMC HTMLFilter PPT DHFSummary Code Execution Vulnerability(CVE-2017-2794)

Summary An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a stack corruption resulting in arbitrary code execution. An attacker can send/provide maliciou...

Null Pointer Reference Vulnerability in WPS Demo kso Module

WPS Office is an office software suite developed independently by Kingsoft Corporation. A null pointer reference vulnerability exists in the kso module of WPS presentation wpp.exe in WPS when parsing a specific ppt file, which can be exploited by an attacker to cause a denial of service or lead t...

WPS Presentation Null Pointer Reference Vulnerability

WPS Office is an office software suite developed independently by Kingsoft Corporation. WPS Presentation wpp.exe in WPS has a null pointer reference vulnerability when parsing a specific ppt file, which can be exploited by an attacker to cause a denial of service...

AntennaHouse DMC HTMLFilter PPT ParseEnvironment Code Execution Vulnerability(CVE-2017-2797)

Summary An exploitable heap overflow vulnerability exists in the ParseEnvironment functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide malicious PPT fil...

MarkLogic MarkLogic Antenna House DMC HTMLFilter Stack Buffer Overflow Vulnerability

MarkLogic MarkLogic is a database software from MarkLogic Corporation, USA. The software is characterized by hierarchical storage, dual-temporal and scalability.Antenna House DMC HTMLFilter is one of the HTML generic generator libraries developed by Antenna House, Inc. in the United States. A sta...

Stack overflow

An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a stack corruption resulting in arbitrary code execution. An attacker can send/provide malicious PPT fi...

CVE-2017-2794

An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a stack corruption resulting in arbitrary code execution. An attacker can send/provide malicious PPT fi...

CVE-2017-2794

An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a stack corruption resulting in arbitrary code execution. An attacker can send/provide malicious PPT fi...

CVE-2017-2794

Summary of CVE-2017-2794 (connected details present): The vulnerability exists in the DHFSummary function of AntennaHouse DMC HTMLFilter (used by MarkLogic 8.0-6). A specially crafted PPT can trigger a stack-based buffer overflow via an overflowSize value read from Summary Information, then copie...

CVE-2017-2794

An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a stack corruption resulting in arbitrary code execution. An attacker can send/provide malicious PPT fi...

AntennaHouse DMC HTMLFilter PPT ParseEnvironment Code Execution Vulnerability

Summary An exploitable heap overflow vulnerability exists in the ParseEnvironment functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide malicious PPT fil...

AntennaHouse DMC HTMLFilter PPT DHFSummary Code Execution Vulnerability

Summary An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a stack corruption resulting in arbitrary code execution. An attacker can send/provide maliciou...

Microsoft Office Memory Corruption (MS16-133: CVE-2016-7230)

A remote code execution vulnerability exists in Microsoft PowerPoint. The vulnerability is due to a use-after-free error in Microsoft PowerPoint while handling a specially crafted PPT file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted PPT...

Apache OpenOffice -- multiple vulnerabilities

The Apache Openofffice project reports: CVE-2017-3157: Arbitrary file disclosure in Calc and Writer By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacke...

WPS Office 2016 - .ppt Heap Memory Corruption

WPS Office 2016 - .ppt Heap Memory Corruption Application: WPS Office Platforms: Windows Versions: Version before 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WPS Office an acrony...

WPS Office < 2016 - '.ppt' Heap Memory Corruption

Application: WPS Office Platforms: Windows Versions: Version before 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WPS Office an acronym for Writer, Presentation and Spreadsheets,2...

WPS Office < 2016 - '.ppt' drawingContainer Memory Corruption

Application: WPS Office Platforms: Windows Versions: Version 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WPS Office an acronym for Writer, Presentation and Spreadsheets,2...

WPS Office < 2016 - '.ppt' Heap Memory Corruption

Exploit for windows platform in category dos / poc Application: WPS Office Platforms: Windows Versions: Version before 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WPS Office an...

PHP process_nested_data 函数释放后重用漏洞

A while ago the function "processnesteddata" was changed to better handle object properties. Before it was possible to create numeric object properties which would cause trouble down the road. So the following code was added: if !objprops ... else / object properties should include no integers /...

MGASA-2015-0087 Updated apache-poi packages fix CVE-2014-9527

Updated apache-poi packages fixes security vulnerability: A denial of service flaw was found in the way the HSLFSlideShow class implementation in Apache POI handled certain PPT files. A remote attacker could submit a specially crafted PPT file that would cause Apache POI to hang indefinitely...