Apple macOS < 10.12.2 / iOS < 10.2 Kernel - ipc_port_t Reference Count Leak Due to Incorrect externalMethod Overrides Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=926 mach ports are really struct ipcportt's in the kernel; this is a reference-counted object, ipreference and iprelease atomically increment and decrement the 32 bit ioreferences field. Unlike OSObjects, ipreference will allow the...

AppArmor securityfs 4.8 - aa_fs_seq_hash_show Reference Count Leak

AppArmor securityfs 4.8 - aafsseqhashshow Reference Count Leak / There's a reference count leak in aafsseqhashshow that can be used to overflow the reference counter and trigger a kernel use-after-free static int aafsseqhashshowstruct seqfile seq, void v struct aareplacedby r = seq-private; struc...

AppArmor securityfs < 4.8 - 'aa_fs_seq_hash_show' Reference Count Leak

/ There's a reference count leak in aafsseqhashshow that can be used to overflow the reference counter and trigger a kernel use-after-free static int aafsseqhashshowstruct seqfile seq, void v struct aareplacedby r = seq-private; struct aaprofile profile = aagetprofilercu&r-profile; // hash for i ...

DEBIAN-CVE-2016-4558

The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service use-after-free or possibly have unspecified other impact via a crafted application on 1 a system with more than 32 Gb of memory, related to the program reference...

Linux Kernel (Ubuntu 16.04) - Reference Count Overflow Using BPF Maps

Exploit for linux platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=809 Most things in the kernel use 32-bit reference counters, relying on the fact that the memory constraints of real computers make it impossible to create enough references to...

Linux Kernel (Ubuntu 16.04) - Reference Count Overflow Using BPF Maps

Linux Kernel Ubuntu 16.04 - Reference Count Overflow Using BPF Maps Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=809 Most things in the kernel use 32-bit reference counters, relying on the fact that the memory constraints of real computers make it impossible to create enough...

The Linux kernel mention the right vulnerability analysis and the use of CVE-2 0 1 6-0 7 2 8-a vulnerability warning-the black bar safety net

Security research team Perception Point found a Linux system the kernel exists in a high-risk level of the local privilege escalation 0day vulnerabilities, numbered CVE-2 0 1 6-0 7 2 8 in. There are currently more than 6 6% of Android phones and 1 0 0 0 million Linux PCS and servers are affected ...

[slackware-security] cups

New cups packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/cups-1.5.4-i486-4slack14.1.txz: Rebuilt. This release fixes a security issue: CWE-911: Improper Update of...

Medium: cups

Issue Overview: A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in...

SOL16794 - CUPS vulnerabilities CVE-2015-1158 / CVE-2015-1159

CVE-2015-1158 A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded, which in...

CUPS 2.0.3 - Multiple Vulnerabilities

CUPS 2.0.3 - Multiple Vulnerabilities Source: http://googleprojectzero.blogspot.se/2015/06/owning-internet-printing-case-study-in.html Abstract Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs...

CentOS Update for cups CESA-2015:1123 centos6

Check the version of cups SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882202";...

CentOS 6 / 7 : cups (CESA-2015:1123)

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

RedHat Update for cups RHSA-2015:1123-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : cups on SL6.x, SL7.x i386/x86_64 (20150617)

A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement configuration file to be uploaded which in turn allows the...

SUSE-SU-2015:1044-2 Security update for cups154

The following issues are fixed by this update: CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server bsc924208. CVE-2015-1158: Improper Update of Reference Count CVE-2015-1159: Cross-Site Scripting...

Debian DLA-239-1 : cups security update

Two critical vulnerabilities have been found in the CUPS printing system : CVE-2015-1158 - Improper Update of Reference Count Cupsd uses reference-counted strings with global scope. When parsing a print job request, cupsd over-decrements the reference count for a string from the request. As a...

[SECURITY] [DLA 239-1] cups security update

Package : cups Version : 1.4.4-7+squeeze8 CVE ID : CVE-2015-1158 CVE-2015-1159 Two critical vulnerabilities have been found in the CUPS printing system: CVE-2015-1158 - Improper Update of Reference Count Cupsd uses reference-counted strings with global scope. When parsing a print job request, cup...

DLA-239-1 cups - security update

Bulletin has no description...

SUSE SLES10 Security Update : ofed (SUSE-SU-2012:1708-1)

This update of ofed fixed multiple issues including security related flaws : - sdp: move histogram allocation from stack to heap bnc706175 - cma: Fix crash in request handlers bnc678795, CVE-2011-0695 - rds: set correct msgnamelen bnc773383, CVE-2012-3430 - cm: Bump reference count on cmid before...