Android - libutils UTF16 to UTF8 Conversion Heap Buffer Overflow

Exploit for Android platform in category remote exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=840 There's an inconsistency between the way that the two functions in libutils/Unicode.cpp handle invalid surrogate pairs in UTF16, resulting in a mismatch between the size...

Google Android - libutils UTF16 to UTF8 Conversion Heap Buffer Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=840 There's an inconsistency between the way that the two functions in libutils/Unicode.cpp handle invalid surrogate pairs in UTF16, resulting in a mismatch between the size calculated by utf16toutf8length and the number of bytes...

ALPINE-CVE-2016-6263

The stringpreputf8nfkcnormalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via crafted UTF-8 data...

Return to libstagefright: exploiting libutils on Android

Posted by Mark Brand, Invalidator of Unic�o�d�e I’ve been investigating different fuzzing approaches on some Android devices recently, and this turned up the following rather interesting bug CVE 2016-3861 fixed in the most recent Android Security Bulletin, deep in the bowels of the usermode Andro...

Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write

Exploit Title: Gnome Eye of Gnome Out-of-bounds-write Exploit Author: Kaslov Dmitri Vendor Homepage: https://wiki.gnome.org/Apps/EyeOfGnome Version: 3.10.2 Tested on: Ubuntu 14.04 LTS CVE: CVE-2016-6855 Proof of Concept:...

F5 Networks BIG-IP : glibc vulnerability (SOL09408132)

Integer overflow in posix/fnmatch.c in the GNU C Library aka glibc or libc6 2.13 and earlier allows context-dependent attackers to cause a denial of service application crash via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than...

PT-2016-5883 · Cjson +2 · Cjson +2

Name of the Vulnerable Software and Affected Versions: cJSON library affected versions not specified Description: The issue is related to the mishandling of UTF8/16 strings by the parse string function in the cJSON library. This allows remote attackers to cause a denial of service crash or execut...

The vulnerability of the PHP interpreter, which allows attackers to trigger a service failure or exert other effects.

The vulnerability of the xmlutf8encode function ext/xml/xml.c in the PHP interpreter is related to buffer overflows in dynamic memory, caused by integer overflows. Exploiting this vulnerability could allow an attacker to cause a service failure or potentially have other effects through a long...

dom.hastin.gs XSS vulnerability

Vulnerable URL: http://dom.hastin.gs/files/utf8/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check dom.hastin.gs SSL connection:...

file security, bug fix, and enhancement update

5.04-30 - fix CVE-2014-3538 unrestricted regular expression matching 5.04-29 - fix 1284826 - try to read ELF header to detect corrupted one 5.04-28 - fix 1263987 - fix bugs found by coverity in the patch 5.04-27 - fix CVE-2014-3587 incomplete fix for CVE-2012-1571 - fix CVE-2014-3710 out-of-bound...

74CMS (V 3.5.2 - 20150423) utf8_to_gbk() 不安全性造成的SQL注入

No description provided by source...

UBUNTU-CVE-2015-5380

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a deni...

Critical DoS Bug in Node.js, io.js Patched

Developers at Node.js over the weekend released a critical update to the open source runtime environment that addresses a bug that could be used to cause denial of service attacks. The JavaScript framework is used in one way or another by a handful of companies, including Netflix, PayPal, the New...

CakePHP 2.6.6 and 3.0.6 Released

CakePHP 2.6.6 and 3.0.6 Released The CakePHP core team is ready to announce the immediate availability of CakePHP 2.6.6 and 3.0.6. These are maintenance releases that contain important security fixes. Security Fixes Earlier this week we were notified that RequestHandlerComponent had a vulnerabili...

Wordpress is continuously explosion two stored XSS, the impact of the latest version-bug warning-the black bar safety net

! /Article/UploadPic/2015-4/201542811437550.jpg The official Wordpress in 4 on 2 1, released new version 4. 1. 2, wherein the mentioned fixes a serious memory typexssvulnerabilities. Soon someone shows vulnerability details. Thisxssstill appear in the wordpress comments, but the problem is caused...

Wordpress < 4.1.2 storage type XSS analysis and stability of the POC-vulnerability warning-the black bar safety net

Wordpress thisXSSis actually very easy to use, anonymous users can post and trigger, this gives a simple analysis of the stability of the trigger of the POC. In fact, the vulnerability of the author in the articlexss-vulnerability-4-1-2/"...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the mutt-utf8 package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

F5 Networks BIG-IP : GNU C Library vulnerability (SOL15885)

The GNU C Library aka glibc or libc6 before 2.12.2 and Embedded GLIBC EGLIBC allow context-dependent attackers to execute arbitrary code or cause a denial of service memory consumption via a long UTF8 string that is used in an fnmatch call, aka a 'stack extension attack,' a related issue to...

易思ESPCMS sql注入（demo成功）

简要描述： rt V6.0.14.07.07 UTF8 详细说明： 看了大牛们提交的 WooYun: ESPCMS最新 V5.8.14.03.03 UTF8 正式版暴力注入 下了最新版来看看，发现 加密函数 还是老样子啊- - 不过 ，查询换成 了 id 而不是 username了， 但是 id 是 intval的。 function membercookieview$keyword = false $retrunstr = array; $retrunstr'username' = $this-fun-eccode$this-fun-accept'ecispmemberusername...

Ecmall V2.3.0-UTF8 正式版暴力注入（爆破）

简要描述： RT，打了最新补丁 详细说明： 存在两个问题，最新版未修补： 1.后台可被爆破，导致暴力注入；（很多SQL注入点最终是为了进后台，那么这里直接暴力点） 2.模板编辑下可得shell。 漏洞证明： 暴力注入： 1.在后台登录页，点击登录后抓包： 2.设置爆破字段为password： 3.不要看burp返回，直接再次刷新页面，登录成功！ 拿shell的方法： 1.看下图，点击编辑（这一列的都可以编辑）： 2.写入shell： 3.访问这个地址： http:/...