win32k Clipboard Bitmap - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=533 This PoC triggers a crash on Windows 7 32-bit with Special Pool enabled on win32k.sys. The kernel crashes due to a use-after-free condition with bitmaps in the clipboard. --- Note that multiple PoC executions and...

win32k Clipboard Bitmap - Use-After-Free

win32k Clipboard Bitmap - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=533 This PoC triggers a crash on Windows 7 32-bit with Special Pool enabled on win32k.sys. The kernel crashes due to a use-after-free condition with bitmaps in the clipboard. ---...

win32k Clipboard Bitmap - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=533 This PoC triggers a crash on Windows 7 32-bit with Special Pool enabled on win32k.sys. The kernel crashes due to a use-after-free condition with bitmaps in the...

win32k Desktop and Clipboard - Null Pointer Dereference

win32k Desktop and Clipboard - Null Pointer Dereference Source: https://code.google.com/p/google-security-research/issues/detail?id=534 The attached PoC triggers a null pointer condition on Windows 7 32-bit, which can potentially be exploited on versions of Windows that allow mapping the null pag...

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage...

win32k Desktop and Clipboard - Null Pointer Dereference

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=534 The attached PoC triggers a null pointer condition on Windows 7 32-bit, which can potentially be exploited on versions of Windows that allow mapping the null page e.g...

win32k Desktop and Clipboard - Null Pointer Dereference

Source: https://code.google.com/p/google-security-research/issues/detail?id=534 The attached PoC triggers a null pointer condition on Windows 7 32-bit, which can potentially be exploited on versions of Windows that allow mapping the null page e.g. Windows 7 32-bit. --- Note that multiple PoC...

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - '_FXCLI_GetConfFileChunk' Stack Buffer Overflow (PoC)

!/usr/bin/python Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 FXCLIGetConfFileChunk Stack Buffer Overflow Vulnerability Date: 14 December 2015 Author: Gianni Gnesa gnix Vendor Homepage: http://www.ibm.com/ Software Name: IBM Tivoli Storage Manager FastBack Software Version: 5.5.4.2 x...

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - _FXCLI_GetConfFileChunk Stack Buffer Overflow E

Exploit for windows platform in category dos / poc !/usr/bin/python Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 FXCLIGetConfFileChunk Stack Buffer Overflow Vulnerability Date: 14 December 2015 Author: Gianni Gnesa gnix Vendor Homepage: http://www.ibm.com/ Software Name: IBM Tivoli...

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference

IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference !/usr/bin/python Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 Invalid Pointer Dereference Date: 14 December 2015 Author: Gianni Gnesa gnix Vendor Homepage: http://www.ibm.com/ Software Name: IBM Tivoli...

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll (MS15-132)

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll MS15-132 Source: https://code.google.com/p/google-security-research/issues/detail?id=556 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially...

Microsoft Internet Explorer 11 - MSHTML!CObjectElement Use-After-Free (MS15-124)

small -ms-block-progression: lr; -ms-filter: "vv"; function trigger document.execCommand"JustifyLeft"; bl...

Internet Explorer 11 MSHTML!CObjectElement Use-After-Free Exploit

Microsoft Internet Explorer 11 suffers from a MSHTML!CObjectElement use-after-free vulnerability. Vendor: Microsoft, http://www.microsoft.com Affected Products: Internet Explorer Affected Version: IE 11 Vulnerability: MSHTML!CObjectElement Use-After-Free Vulnerability CVE ID: CVE-2015-6152 I...

Microsoft IE 11 MSHTML!CObjectElement Use-After-Free

Blue Frost Security GmbH https://www.bluefrostsecurity.de/ researchatbluefrostsecurity.de BFS-SA-2015-003 10-December-2015 Vendor: Microsoft, http://www.microsoft.com Affected Products: Internet Explorer Affected Version: IE 11 Vulnerability: MSHTML!CObjectElement Use-After-Free Vulnerability CVE...

CVE-2015-6130

Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code via a crafted font, aka "Windows Integer Underflow Vulnerability."...

Memory corruption

The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10 Gold and 1511, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010...

Race condition

Race condition in the Pragmatic General Multicast PGM protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gai...

Design/Logic Flaw

Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted .mcl file, aka "Media Center Library Parsing RCE Vulnerability."...

Integer overflow

Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code via a crafted font, aka "Windows Integer Underflow Vulnerability."...

CVE-2015-6107

CVE-2015-6107 concerns a remote-code-execution vulnerability in the Windows font library. The issue arises when parsing specially crafted embedded fonts, enabling arbitrary code execution on affected systems. Public references indicate this affects a broad set of Windows versions (Vista through W...