CVE-2006-3649: Undefined Security Weakness

Buffer overflow in Microsoft Visual Basic for Applications VBA SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute...

CVE-2006-3440: Undefined Security Weakness

Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka "Winsock Hostname Vulnerability."...

[Full-disclosure] 0-day XP SP2 wmf exploit (some details)

There is some details for wannabees : 1. 'Bad' wmf record: 07 00 00 00 length of record in words FC 02 type CreateBrushIndirect 08 00 00 00 00 00 00 80 'packed' good old Win16 days LOGBRUSH data: 08 00 - 'packed' lpStyle may be BSDIBPATTERNPT 6 or BSDIBPATTERN8X8 8 00 00 00 00 - COLORREF any 00 8...

[Full-disclosure] 0-day XP SP2 wmf exploit

Description: yet another 'windows meta file' WMF denial of service exploit. System affected: + Windows XP SP2, + Windows 2003 SP1, + Windows XP SP1, + Windows XP + Windows 2003 Tech info: page fault in gdi32!CreateBrushIndirect because invalid pointer access. Incorrect short to void sign extensio...

gdiplus.pl.txt

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

Gdiplus.dll division by 0

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

CVE-2006-3945

The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service crash by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption...

CVE-2006-3944

Microsoft Internet Explorer 6 on Windows XP SP2 is affected by CVE-2006-3944. The vulnerability concerns the Forms.ListBox.1 object, where the ListWidth property set to 0x7fffffff can trigger an integer overflow, and set to 0x7ffffffe can cause a null dereference, leading to a denial of service (...

CVE-2006-3944: Undefined Security Weakness

Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service crash via a 1 Forms.ListBox.1 or 2 Forms.ListBox.1 object with the ListWidth property set to a 0x7fffffff, which triggers an integer overflow exception, or to b 0x7ffffffe, which triggers a null...

CVE-2006-3943: Undefined Security Weakness

Stack-based buffer overflow in NDFXArtEffects in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service crash via long 1 RGBExtraColor, 2 RGBForeColor, and 3 RGBBackColor properties...

CVE-2006-3945: Out-of-bounds Write

The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service crash by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption...

Microsoft PowerPoint 2003 SP2 Local Code Execution Exploit (french)

No description provided by source. / 30.07.2006 NSRocket presents Microsoft PowerPoint 2003 SP2 updated french version exploit tested on WinXP SP2 Microsoft PowerPoint is prone to a remote code execution issue which may be triggered when a malformed PPT file is closed. Code execution is possib...

Microsoft PowerPoint 2003 SP2 (French) - Local Code Execution

/ 30.07.2006 NSRocket presents Microsoft PowerPoint 2003 SP2 updated french version exploit tested on WinXP SP2 Microsoft PowerPoint is prone to a remote code execution issue which may be triggered when a malformed PPT file is closed. Code execution is possible only if these conditions are...

CVE-2006-3910: Undefined Security Weakness

Internet Explorer 6 on Windows XP SP2, when Outlook is installed, allows remote attackers to cause a denial of service crash by calling the NewDefaultItem function of an OVCtl OVCtl.OVCtl.1 ActiveX object, which triggers a null dereference...

CVE-2006-3915

CVE-2006-3915 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows a remote actor to crash the browser by iterating over a native function (demonstrated with window.alert), triggering a null dereference and resulting in a denial of service. The provided sources docume...

CVE-2006-3915: Undefined Security Weakness

Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service crash by iterating over any native function, as demonstrated with the window.alert function, which triggers a null dereference...

trionPWN.pl.txt

greetz... !/usr/bin/perl p0c Tested on Windows XP SP2 with triton 1.0.4 c0rrupt -at- f34r -dot- us This exploits the sipxtapi vuln in triton which was patched.. sometime ago.. The exploit sends a specially crafted udp packet to the triton client which leads to command execution through a buffer...

CVE-2006-3910

Summary: CVE-2006-3910 affects Internet Explorer 6 on Windows XP SP2 when Outlook is installed. The issue arises from calling the NewDefaultItem function of an OVCtl (OVCtl.OVCtl.1) ActiveX object, causing a null dereference and a remote denial of service (crash). Details provided by sources: The...

CVE-2006-3898

Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service application crash by calling the Click method of the Internet.HHCtrl.1 ActiveX object before initializing the URL, which triggers a null dereference...

CVE-2006-3898: Undefined Security Weakness

Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service application crash by calling the Click method of the Internet.HHCtrl.1 ActiveX object before initializing the URL, which triggers a null dereference...