CVE-2018-12270

Affected product: Valve Steam (1528829181 BETA). The vulnerability is a homograph/homoglyph attack that allows creating fake URLs in the Steam client, potentially fooling users into visiting unintended websites. Root cause details are not provided in the documents. Impact is described as user con...

CVE-2018-12270

In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting unintended web sites...

Valve: Arbitrary File Write as SYSTEM from unprivileged user

Note: This report was reviewed and updated after a correction to program scope. Vulnerability ======== The Steam Client installs a "Steam Client Service" that runs as SYSTEM to update the steam application. This service executes from C:\Program Files x86\Common\Steam where permissions are properl...

CVE-2018-20817

SVSteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern...

PT-2019-10255

Name of the Vulnerable Software and Affected Versions: Call of Duty: Modern Warfare 2 versions prior to 2015-08-11 Call of Duty: Modern Warfare 3 versions prior to 2015-08-11 Call of Duty: Ghosts versions prior to 2015-08-11 Call of Duty: Advanced Warfare versions prior to 2015-08-11 Call of Duty...

Valve: Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe

Summary In the parsing routines of NAV files which contain the navigation mesh used by the AI for survivor bots, zombies, and the AI director spawning system a buffer overflow exists which can be used to control the EIP register and takeover code execution. Proof-of-Concept 1. Download the attach...

Through the Server Info in a buffer overflow to achieve the Steam client RCE-vulnerability warning-the black bar safety net

In Steam and other V social game such as CSGO, Half-Life, TF2, built-in a looking for a server browser server browser, and a game server. In order to obtain information about these server information, the server browser using a method called server query server queries a specific UDP communicatio...

Counter-Strike 1.6 game client 0-day exploited to spread Belonard trojan

By Waqas Dr. Web’s cybersecurity researchers have identified an attacker is trying to exploit zero-day vulnerabilities in Counter-Strike 1.6 game specifically to distribute Belonard Trojan. Reportedly, about 39% of all the active servers of the game on Steam have been manipulated and compromised ...

Zero-Day Flaws in Counter-Strike 1.6 Let Malicious Servers Hack Gamers' PCs

If you are a Counter-Strike gamer, then beware, because 39% of all existing Counter-Strike 1.6 game servers available online are malicious that have been set-up to remotely hack gamers' computers. A team of cybersecurity researchers at Dr. Web has disclosed that an attacker has been using malicio...

Valve: RCE on Steam Client via buffer overflow in Server Info

Introduction In Steam and other valve games CSGO, Half-Life, TF2 there is a functionality to find game servers called the server browser. In order to retrieve the information about these servers the server browser communicates with a specific UDP protocol called server queries. The protocol is we...

Hacker Who DDoSed Sony, EA and Steam Gaming Servers Pleads Guilty

A 23-year-old hacker from Utah pleaded guilty this week to launching a series of denial-of-service DoS attacks against multiple online services, websites, and online gaming companies between 2013 and 2014. According to a Justice Department DoJ press release, Austin Thompson , a.k.a. "DerpTroll,"...

CVE-2018-18226

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...

CVE-2018-18226

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...

DEBIAN-CVE-2018-18226

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...

CVE-2018-18226

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...

CVE-2018-18226

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...

Design/Logic Flaw

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...

UBUNTU-CVE-2018-18226

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...

CVE-2018-18226

CVE-2018-18226 affects Wireshark 2.6.0–2.6.3, where the Steam IHS Discovery dissector could leak memory due to a memory-management issue in epan/dissectors/packet-steam-ihs-discovery.c, enabling memory exhaustion and potential DoS. Mitigation: upgrade to Wireshark 2.6.4 or newer (upstream fix). P...

CVE-2018-18226

In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed in epan/dissectors/packet-steam-ihs-discovery.c by changing the memory-management approach...