shopify-scripts: Segmentation fault due to bad memory access in kh_get_mt

Crash file is: values=0,0,0,0 unusedbutneeded= Hash= values.each do values.each do values & values.each do values.each do % 0=nil end end end end $ ./dev/bin/mruby crash.rb Segmentation fault: 11 $ lldb ./dev/bin/mruby crash.rb lldb target create "./dev/bin/mruby" Current executable set to...

SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:2971-1)

This update for pcre to version 8.39 bsc972127 fixes several issues. If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version. This version fixes a number of vulnerabilities that affect pcre and...

shopify-scripts: Null pointer dereference due to bug in codegen with negation of floats

Similar to bug 187536 but with floats, not ints. Crash is: p case when nil -0.0 nil end $ ./dev/bin/mruby crash.rb crash.rb:1:3: '' interpreted as argument prefix Segmentation fault: 11 $ lldb ./dev/bin/mruby crash.rb lldb target create "./dev/bin/mruby" Current executable set to './dev/bin/mruby...

PT-2018-9338

Name of the Vulnerable Software and Affected Versions nghttp2 versions 1.10.0 through 1.31.0 Description The issue is related to improper input validation in ALTSVC frame handling, which can cause a segmentation fault and lead to denial of service. This can be exploited via a network client...

FreeBSD : libwww -- multiple vulnerabilities (18449f92-ab39-11e6-8011-005056925db4)

Mitre reports : The HTBoundaryputblock function in HTBound.c for W3C libwww w3c-libwww allows remote servers to cause a denial of service segmentation fault via a crafted multipart/byteranges MIME message that triggers an out-of-bounds read. The big2toUtf8 function in lib/xmltok.c in libexpat in...

CVE-2016-9628

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service segmentation fault and crash via a crafted HTML page...

CVE-2016-9629

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service segmentation fault and crash via a crafted HTML page...

CVE-2016-9623

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service segmentation fault and crash via a crafted HTML page...

CVE-2016-9624

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service segmentation fault and crash via a crafted HTML page...

CVE-2016-9438

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service segmentation fault and crash via a crafted HTML page...

CVE-2016-9622

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service segmentation fault and crash via a crafted HTML page...

shopify-scripts: Crash: A call to Symbol.new leads to a crash when inspecting the resulting object

Calling Symbol.new leads to a when inspect is called on that method probably even more methods. From my point of view the root cause is related to 185794 the underlying boxing model. Trying the same with Ruby 2.3 will lead to a NoMethodError: undefined method 'new' for Symbol:Class, which is...

shopify-scripts: Invalid memory write caused by incorrect upper bound in array_copy

Ok, here is a weird one! It only crashes in mruby, and can't be made to crash in mruby-engine as max memory possible to extend to is 256M which this requires more. The file is: values = 3,5,8 test = 1,6 results,= 1.2 values.each do |value| case value when test results 0x10000222d : movq %rdx, %ra...

shopify-scripts: Crash: mrb_any_to_s can't handle NilClass, Symbol and Fixnum

When using boxingword.h haven't tested other boxing methods yet, mrbanytos is unable to handle NilClass, Symbol and Fixnum. This can be achieved by just deleting :tos from the class and let mrbanytos crash. I tried to come up with a fix but I'm not 100% sure where this should be fixed. The boxing...

shopify-scripts: Null pointer dereference in mrb_str_concat

Hi, The following file causes a segmentation fault due to a null pointer in mrbstrconcat which calls mrbstrmodify then checkfrozen which tries to dereference it. "O=0" $ ./dev/bin/mruby --version mruby 1.2.0 2015-11-17 $ ./dev/bin/mruby crash.rb Segmentation fault: 11 $ lldb ./dev/bin/mruby...

PT-2017-1733

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.6-4 Description The issue is related to the MSL interpreter in ImageMagick, which allows remote attackers to cause a denial of service, resulting in a segmentation fault and application crash, via a crafted XM...

shopify-scripts: Crash: calling Proc::initialize_copy with a Proc instance where initialize never ran leads to a crash

Using the same trick from 184661 with Proc leads to another crash, this time in Proc related functions. Again, haven't looked into it besides validity testing and an initial code lookup more detailed investigation + possible patches when there's more time on my side. Again, to give you guys the...

shopify-scripts: Denial of service due to invalid memory access in mrb_ary_concat

Hi, The following file causes a segmentation fault in mruby, which also causes a segmentation fault in mruby-engine. I've minimized this file down to the bare bones what crashes it, then renamed variables and tidied so you can see what is needed and what isn't. case "" when 0 end x case when true...

shopify-scripts: Invalid memory access while freeing memory, caused by invalid type passed to mrb_ary_unshift

Hi, Phew, this was a tricky one as the cause wasn't next door to where the dereference happened! The file causing this is: a case when nil redo end $ ./dev/bin/mruby --version mruby 1.2.0 2015-11-17 $ ./dev/bin/mruby crash.rb crash.rb:1:3: '' interpreted as argument prefix trace: 0 crash.rb:3...

shopify-scripts: Null pointer dereference in ary_concat

Hi, The following file causes a segmentation fault in mruby, which also causes a segmentation fault in mruby-engine. I've minimized this file down to the bare bones what crashes it, then renamed variables and tidied so you can see what is needed and what isn't. a=0 b=nil a.each do |a| a = case a...