PHP str_transliterate()函数Unicode字符远程溢出漏洞

BUGTRAQ ID: 39185 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 远程攻击者可以通过向PHP的strtransliterate函数提交超长的Unicode字符串请求触发缓冲区溢出，导致执行任意代码。成功利用这个漏洞要求配置中打开了unicode.semantics。 PHP 6.0 dev 厂商补丁： PHP --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.php.net view sourceprint??php errorreporting0; PHP 6....

Jzip 1.3 - .zip Unicode Buffer Overflow (PoC)

Jzip 1.3 - .zip Unicode Buffer Overflow PoC ?php / Jzip v1.3 .zip Unicode buffer overflow 0day PoC Date: 6/4/2010 Author: mrme http://net-ninja.net/ Software Link: http://www.jzip.com/ Version: 1.3 Tested on: Windows XP SP3 En Advisory: http://www.corelan.be:8800/advisories.php?id=10-021 Greetz t...

Jzip 1.3 Unicode Buffer Overflow

?php / Jzip v1.3 .zip Unicode buffer overflow 0day PoC Date: 6/4/2010 Author: mrme http://net-ninja.net/ Software Link: http://www.jzip.com/ Version: 1.3 Tested on: Windows XP SP3 En Advisory: http://www.corelan.be:8800/advisories.php?id=10-021 Greetz to: Corelan Security Team...

PHP 6.0 Dev str_transliterate() Buffer Overflow

Exploit Title: PHP 6.0 Dev strtransliterate 0Day Buffer Overflow Exploit Date: 2010-04-04 Author: Pr0T3cT10n Software Link: http://downloads.sourceforge.net/project/wampserver/WampServer%202%20-%20Extensions/PHP/WampServer2-PHP6.0dev.exe?usemirror=garr Version: 6.0 Dev Tested on: WIN XP HEB SP3...

Jzip v1.3 (.zip) Unicode buffer overflow 0day PoC

Exploit for windows platform in category dos / poc ================================================= Jzip v1.3 .zip Unicode buffer overflow 0day PoC ================================================= ?php / Jzip v1.3 .zip Unicode buffer overflow 0day PoC Date: 6/4/2010 Author: mrme...

Jzip 1.3 - '.zip' Unicode Buffer Overflow (PoC)

?php / Jzip v1.3 .zip Unicode buffer overflow 0day PoC Date: 6/4/2010 Author: mrme http://net-ninja.net/ Software Link: http://www.jzip.com/ Version: 1.3 Tested on: Windows XP SP3 En Advisory: http://www.corelan.be:8800/advisories.php?id=10-021 Greetz to: Corelan Security Team...

PHP 6.0 Dev str_transliterate() 0Day Buffer Overflow Exploit

Exploit for windows platform in category remote exploits ============================================================ PHP 6.0 Dev strtransliterate 0Day Buffer Overflow Exploit ============================================================ Exploited by TheLeader, Debug SP. Thanks: HDM...

PHP 6.0 Dev - str_transliterate() Local Buffer Overflow

PHP 6.0 Dev - strtransliterate Local Buffer Overflow Exploited by TheLeader, Debug SP. Thanks: HDM http://www.nullbyte.org.il This code should exploits a buffer overflow in the strtransliterate function to call WinExec and execute CALC Take a look, 'unicode.semantics' has to be on! php.ini...

PHP 6.0 Dev - 'str_transliterate()' Local Buffer Overflow

Exploited by TheLeader, Debug SP. Thanks: HDM http://www.nullbyte.org.il This code should exploits a buffer overflow in the strtransliterate function to call WinExec and execute CALC Take a look, 'unicode.semantics' has to be on! php.ini unicode.semantics = on ifinigetbool'unicode.semantics' $buf...

Memory corruption

The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service memory corruption...

Design/Logic Flaw

Array index error in the hbotlayoutbuildglyphclasses function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service application crash via a crafted font file, related to building a synthetic Glyph Definition aka GDEF table by usin...

CVE-2010-0421

Array index error in the hbotlayoutbuildglyphclasses function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service application crash via a crafted font file, related to building a synthetic Glyph Definition aka GDEF table by usin...

CVE-2010-0421

Array index error in the hbotlayoutbuildglyphclasses function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service application crash via a crafted font file, related to building a synthetic Glyph Definition aka GDEF table by usin...

CVE-2010-0421

Array index error in the hbotlayoutbuildglyphclasses function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service application crash via a crafted font file, related to building a synthetic Glyph Definition aka GDEF table by usin...

CVE-2010-0421

Array index error in the hbotlayoutbuildglyphclasses function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service application crash via a crafted font file, related to building a synthetic Glyph Definition aka GDEF table by usin...

Firefox download filename spoofing with RTL override

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override aka RLO or U+202E Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displayin...

Moderate: Red Hat Security Advisory: pango security update

Updated pango and evolution28-pango packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pango is a library used for the layout and rendering of...

Plug horse code is space-separated solutions-vulnerability warning-the black bar safety net

Some time ago, the new cloud management system, dynamic network Forum get a WEBSHELL and this, today, we discuss this aspect of things, in fact, ASP database plug horse also is not what fresh stuff, believe you played this. Oh, and that you have not met insert the asp code is spaces apart case?...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6562)

This update brings the Mozilla Firefox 3.5 webbrowser to version 3.5.3, the Mozilla XULRunner 1.9.0 engine to the 1.9.0.14 stable release, and the Mozilla XULRunner 1.9.1 engine to the 1.9.1.3 stable release. It also fixes various security issues : - Mozilla developers and community members...

In ASP the database insert webshell small conference-vulnerability warning-the black bar safety net

Some time ago, the new cloud management system, dynamic network Forum get a WEBSHELL and this, today, we discuss this aspect of things, in fact, ASP database plug horse also is not what fresh stuff, believe you played this. Oh, and that you have not met insert the asp code is spaces apart case?...