CVE-2017-7186

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service segmentation violation for read access, and application crash by triggering an invalid Unicode property lookup...

Microsoft Color Management Module icm32.dll - icm32!LHCalc3toX_Di16_Do16_Lut8_G32 Out-of-Bounds Read

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1054 We have encountered a crash in the Windows Color Management library icm32.dll, in the icm32!LHCalc3toXDi16Do16Lut8G32 function, while trying to translate colors based on a...

Microsoft Windows - Uniscribe Font Processing Heap-Based Buffer Overflow in USP10!ttoGetTableData (M

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1027 We have encountered a crash in the Windows Uniscribe user-mode library, in an unnamed function called by USP10!ttoGetTableData, while trying to display text using a corrupted...

Microsoft Windows - Uniscribe Font Processing Buffer Overflow in USP10!FillAlternatesList (MS17-011)

Microsoft Windows - Uniscribe Font Processing Buffer Overflow in USP10!FillAlternatesList MS17-011 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1030 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!FillAlternatesList function, while trying ...

Microsoft Windows - Uniscribe Font Processing Heap-Based Out-of-Bounds Write in USP10!UpdateGlyphFla

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1028 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!UpdateGlyphFlags function, while trying to display text using a corrupted font file: ---...

Microsoft Color Management Module icm32.dll - icm32!Fill_ushort_ELUTs_from_lut16Tag Out-of-Bounds Re

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1052 We have encountered a crash in the Windows Color Management library icm32.dll, in the icm32!FillushortELUTsfromlut16Tag function, while trying to display a TIFF image with a...

Microsoft Windows - Uniscribe Font Processing Heap Memory Corruption in 'USP10!otlCacheManager::GlyphsSubstituted' (MS17-011)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1025 We have encountered a crash in the Windows Uniscribe user-mode library, in the memset function called by USP10!otlCacheManager::GlyphsSubstituted, while trying to display text using a corrupted font file: --- 449c.6338: Access...

CVE-2017-7186

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service segmentation violation for read access, and application crash by triggering an invalid Unicode property lookup...

Mozilla: Cross-origin reading of video captions in violation of CORS (MFSA 2017-06)

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox 52, Firefox ESR 45.8, Thunderbird 52, and Thunderbird 45.8...

UBUNTU-CVE-2017-0532

An information disclosure vulnerability in the MediaTek video codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A...

INTELLITAMPER . map code execution vulnerability, CVE-2008-5755-a vulnerability warning-the black bar safety net

Author: k0shl reprint please indicate the source: http://whereisk0shl.top Vulnerability description Software download: https://www.exploit-db.com/apps/91891f4b53d5e61e66061454ab87ccc7-intellitamperv2.07.exe PoC: import sys maptheader = "\x23\x23\x23\x20\x53\x49\x54\x45\x4D"...

Microsoft Edge / Internet Explorer HandleColumnBreakOnColumnSpanningElement Type Confusion Exploit

Microsoft Edge and Internet Explorer suffer from a type confusion in HandleColumnBreakOnColumnSpanningElement. Microsoft Edge and IE: Type confusion in HandleColumnBreakOnColumnSpanningElement CVE-2017-0037 PoC: .class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table...

Microsoft Edge Internet Explorer - HandleColumnBreakOnColumnSpanningElement Type Confusion

Microsoft Edge Internet Explorer - HandleColumnBreakOnColumnSpanningElement Type Confusion .class1 float: left; column-count: 5; .class2 column-span: all; columns: 1px; table border-spacing: 0px; function boom document.styleSheets0.media.mediaText = "aaaaaaaaaaaaaaaaaaaa"; th1.align = "right"; !-...

Axessh 4.2 - Denial Of Service

Axessh是一款windows下的ssh工具，使用后会开启ssh 22端口，并开启wsshed.exe服务，当wsshed.exe在接收字符串时，会调用BIGNUM相关函数进行处理，但对于BIGNUM的结构体没有进行赋初值，导致空指针引用引发拒绝服务漏洞，下面对此漏洞进行详细分析。 这里要提的一点是，Exploit-db给的PoC可以触发漏洞，但实际上，只要连接22端口，都会引发这个漏洞的发生，哪怕只发送一字节的内容。 附加wsshed.exe，执行PoC，引发中断，这边捕获到漏洞触发位置。 0:000 g f74.a68: Access violation - code c00000...

PHP 7.1.x < 7.1.2 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.2. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in mysqli.c due to a memory leak. An unauthenticated, remote attacker can exploit this to...

Microsoft Office PowerPoint 2010 GDI - GDI32!ConvertDxArray Insufficient Bounds Check Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=951 Platform: GDI on Windows 7 x86 reachable from Microsoft Office 2010 Class: Out of bounds memory access The following crash was observed in Microsoft Office 2010 running under...

Microsoft Office PowerPoint 2010 - GDI GDI32!ConvertDxArray Insufficient Bounds Check

Microsoft Office PowerPoint 2010 - GDI GDI32!ConvertDxArray Insufficient Bounds Check Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=951 Platform: GDI on Windows 7 x86 reachable from Microsoft Office 2010 Class: Out of bounds memory access The following crash was observed in...

Microsoft Office PowerPoint 2010 - MSO!Ordinal5429 Missing Length Check Heap Corruption

Microsoft Office PowerPoint 2010 - MSO!Ordinal5429 Missing Length Check Heap Corruption Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=949 Platform: Microsoft Office 2010 on Windows 7 x86 Class: heap memory corruption The following crash was observed in Microsoft Office 2010...

Microsoft Office PowerPoint 2010 - MSOOART Heap Out-of-Bounds Access

Microsoft Office PowerPoint 2010 - MSOOART Heap Out-of-Bounds Access Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=950 Platform: Microsoft Office 2010 on Windows 7 x86 Class: Time of check time of use leading to memory corruption The following crash was observed in Microsoft...

Microsoft Office PowerPoint 2010 - GDI 'GDI32!ConvertDxArray' Insufficient Bounds Check

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=951 Platform: GDI on Windows 7 x86 reachable from Microsoft Office 2010 Class: Out of bounds memory access The following crash was observed in Microsoft Office 2010 running under Windows 7 x86 with Application Verifier enabled...