CVE-2016-6526

The SpamCall Activity component in Telecom application on Samsung Note device L5.0/5.1 and M6.0 allows attackers to cause a denial of service crash and reboot or possibly gain privileges via a malformed serializable object...

CVE-2016-6527

The SmartCall Activity component in Telecom application on Samsung Note device L5.0/5.1 and M6.0 allows attackers to cause a denial of service crash and reboot or possibly gain privileges via a malformed serializable object...

CVE-2016-6526

The SpamCall Activity component in Telecom application on Samsung Note device L5.0/5.1 and M6.0 allows attackers to cause a denial of service crash and reboot or possibly gain privileges via a malformed serializable object...

CVE-2016-6527

The SmartCall Activity component in Telecom application on Samsung Note device L5.0/5.1 and M6.0 allows attackers to cause a denial of service crash and reboot or possibly gain privileges via a malformed serializable object...

CVE-2016-6526

The SpamCall Activity component in Telecom application on Samsung Note device L5.0/5.1 and M6.0 allows attackers to cause a denial of service crash and reboot or possibly gain privileges via a malformed serializable object...

PT-2017-1210

Name of the Vulnerable Software and Affected Versions Samsung Mobile Telecom application affected versions not specified Samsung Note device versions 5.0/5.1 and 6.0 Description The issue is related to insufficient access control in the SpamCall Activity component of the Telecom application. It c...

CVE-2016-6526: Undefined Security Weakness

The SpamCall Activity component in Telecom application on Samsung Note device L5.0/5.1 and M6.0 allows attackers to cause a denial of service crash and reboot or possibly gain privileges via a malformed serializable object...

CVE-2016-6527: Undefined Security Weakness

The SmartCall Activity component in Telecom application on Samsung Note device L5.0/5.1 and M6.0 allows attackers to cause a denial of service crash and reboot or possibly gain privileges via a malformed serializable object...

PT-2017-1209

Name of the Vulnerable Software and Affected Versions Samsung Mobile Telecom application affected versions not specified Samsung Note device versions 5.0/5.1 through 6.0 Description The issue is related to insufficient access control in the SmartCall Activity component of the Telecom application...

Jndi injection and Spring RCE vulnerability analysis-vulnerability warning-the black bar safety net

Foreword Because before has been traveling, and haven't done the research, eleven during the re-focus of the 2 0 1 6 BlackHat the above subject, wherein jndi injection caught my attention, this paper mainly divided into the following 3 sections, the understanding of jndi, analysis jndi injection...

PT-2016-3244 · Apache +2 · Apache Xml-Rpc Library +2

Name of the Vulnerable Software and Affected Versions: Apache XML-RPC library version 3.1.3 Description: The issue allows remote attackers to execute arbitrary code via a crafted serialized Java object in an element. This is due to the library's failure to properly verify data from external...

PHP interpreter vulnerabilities that allow attackers to execute arbitrary code

Multiple vulnerabilities in the PHP interpreter are related to the use of memory after it is freed. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code by interacting with the Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class...

Design/Logic Flaw

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to 1 the Serializable interface, 2 the SplObjectStorage class, and 3 the SplDoublyLinkedList class, which are mishandled...

CVE-2015-6834

Summary: CVE-2015-6834 (and related CVEs 2015-6835, 2015-6836, 2015-6837/6838) are PHP unserialize-related use-after-free and type-confusion vulnerabilities. They affect PHP priors to 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, enabling remote code execution via crafted serialized data ...

CVE-2015-6834: Undefined Security Weakness

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to 1 the Serializable interface, 2 the SplObjectStorage class, and 3 the SplDoublyLinkedList class, which are mishandled...

JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 6.0.16.25, 6 R1 before SR8 FP25 6.1.8.25, 7 before SR9 FP40 7.0.9.40, 7 R1 before SR3 FP40 7.1.3.40, and 8 before SR3 8.0.3.0 does not properly deserialize classes in an AccessController...

PHP unserialize() Use-After-Free Vulnerabilities

Exploit for php platform in category dos / poc Use After Free Vulnerabilities in unserialize Taoguang Chen Write Date: 2015.7.31 Release Date: 2015.9.4 Multiple use-after-free vulnerabilities were discovered in unserialize with Serializable class that can be abused for leaking arbitrary memory...

PHP 5.45.55.6 - Unserialize() Use-After-Free

PHP 5.45.55.6 - Unserialize Use-After-Free Use After Free Vulnerabilities in unserialize Taoguang Chen Write Date: 2015.7.31 Release Date: 2015.9.4 Multiple use-after-free vulnerabilities were discovered in unserialize with Serializable class that can be abused for leaking arbitrary memory blocks...

PHP 5.4/5.5/5.6 - 'Unserialize()' Use-After-Free

Use After Free Vulnerabilities in unserialize Taoguang Chen Write Date: 2015.7.31 Release Date: 2015.9.4 Multiple use-after-free vulnerabilities were discovered in unserialize with Serializable class that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely. Affect...

UBUNTU-CVE-2015-6834

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to 1 the Serializable interface, 2 the SplObjectStorage class, and 3 the SplDoublyLinkedList class, which are mishandled...