[SECURITY] [DSA 3537-1] imlib2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3537-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 31, 2016 https://www.debian.org/security/faq -...

PHP 5.5.33 Invalid Memory Write

Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- cat test.php ------------------- ';...

DSA-3537-1 imlib2 - security update

Bulletin has no description...

Libxml2 Denial of Service Vulnerability (CNVD-2016-01804)

Libxml2 is the GNOME project team developed a C-based language used to parse XML documents library , which supports a variety of encoding formats , Xpath parsing , Well-formed and valid validation and so on. A security vulnerability exists in Libxml2. This vulnerability can be exploited to cause ...

Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)

Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 1296080 Qemu: i386: NULL pointer dereference in vapicwrite CVE-2016-1922 1292767 qemu: Stack-based buffer overflow in megasasctrlgetinfo CVE-2015-8613 1293305 qemu-kvm: Infinite loop and out-of-bounds transfer start i...

Mageia: Security Advisory (MGASA-2016-0088)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : xerces-c3 -- Parser Crashes on Malformed Input (a7f2e9c6-de20-11e5-8458-6cc21735f730)

The Apache Software Foundation reports : The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bug...

CyberCop Scanner Smbgrind 5.5 - Buffer Overflow (PoC)

CyberCop Scanner Smbgrind 5.5 - Buffer Overflow PoC + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SMBGRIND-BUFFER-OVERFLOW.txt Vendor: ======================= Network Associates Inc. Product: =========================================...

NTPd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow (PoC)

NTPd ntp-4.2.6p5 - ctlputdata Buffer Overflow PoC / Ntpd Based on: ntpq client from ntp package Provided for legal security research and testing purposes ONLY PoC DoS Denial of Service PoC. Will crash NTPd. You will need to know the KEY ID and MD5 password, for example put this in you ntp.conf...

PT-2016-3513

Name of the Vulnerable Software and Affected Versions imlib2 versions prior to 1.4.7 Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, by using a crafted GIF file. Recommendations For versions prior to 1.4.7, update to version 1.4.7 or...

PT-2016-3511

Name of the Vulnerable Software and Affected Versions imlib2 versions prior to 1.4.7 Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, by using a GIF image without a colormap. Recommendations For versions prior to 1.4.7, update to versi...

yTree 1.94-1.1 - Local Buffer Overflow (PoC)

Exploit Author: Juan Sacco - http://www.exploitpack.com [email protected] Program affected: yTree - File manager for terminals v1.94-1.1 Description: yTree is prone to a stack-based overflow, an attacker could exploit this issue to execute arbitrary code in the context of the application...

Network Time Protocol Private Mode 'reslist' Stack Memory Exhaustion Vulnerability

CERT VU357792 Summary An unauthenticated ntpdc reslist command can cause a segmentation fault in ntpd by exhausting the call stack. The following conditions must be met: 1. Mode 7 must be enabled. By default, mode 7 is disabled. 2. A large enough number of entries must be in the restrict lists to...

Network Time Protocol Private Mode 'reslist' NULL Pointer Dereference Vulnerability

Summary An unauthenticated ntpdc reslist command can cause a segmentation fault in ntpd by causing a NULL pointer dereference. The following conditions must be met: 1. Mode 7 must be enabled. By default, mode 7 is disabled. 2. A large enough number of entries must exist in the restrict list to...

Mageia: Security Advisory (MGASA-2016-0023)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RTMPDump rtmpsrv PlayPath Null Pointer Dereference

Talos Vulnerability Report TALOS-2016-0068 RTMPDump rtmpsrv PlayPath Null Pointer Dereference January 7, 2016 CVE Number CVE-2015-8272 Description A vulnerability exists in rtmpsrv in which an attacker can entice a user to utilize rtmpsrv to save an RTMP media stream that is missing a playpath...

PHP 7.0.0 - Format String

Overview -------------------------------------------- A fun little format string vulnerability exists in PHP 7.0.0 due to how non-existent class names are handled. From my limited research I believe this issue is likely exploitable for full code execution see test script below. This issue does no...

Scientific Linux Security Update : squid on SL7.x x86_64 (20151119)

It was found that Squid configured with client-first SSL-bump did not correctly validate X.509 server certificate host name fields. A man-in- the-middle attacker could use this flaw to spoof a Squid server using a specially crafted X.509 certificate. CVE-2015-3455 This update fixes the following...

Scientific Linux Security Update : openldap on SL7.x x86_64 (20151119)

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. CVE-2015-3276 The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one...

Libnsgif 0.1.2 Stack Overflow / Out-Of-Bounds Read Exploit

Libnsgif version 0.1.2 suffers from stack overflow and out-of-bounds read vulnerabilities. Overview ======== Libnsgif1 is a decoding library for GIF images. It is primarily developed and used as part of the NetSurf project. As of version 0.1.2, libnsgif is vulnerable to a stack overflow...