Microsoft Windows GDI+库GPFont::SetData()函数单字节溢出漏洞

BUGTRAQ ID: 34250 CVECAN ID: CVE-2009-1217 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的GDI+函数库（gdiplus.dll）的GPFont::SetData函数中存在单字节溢出漏洞。如果用户受骗打开了 EmfPlusFontObject记录中设置有特制字体长度值的EMF图形的话，就可以触发这个溢出，导致使用该库的应用程序崩溃。以下是 Windows XP中的有漏洞代码段： define FamilyNameMax 32 ... WCHAR familyNameFamilyNameMax;...

CVE-2009-1217

Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service stack corruption and application termination via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka t...

Integer overflow

Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service stack corruption and application termination via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka t...

CVE-2009-1217

The CVE-2009-1217 issue affects Microsoft GDI+ (gdiplus.dll) on Windows XP, where the GPFont::SetData function can overflow when parsing an EMF file, leading to a denial of service via stack corruption. All sources consistently describe an off-by-one/integer overflow condition triggered by specia...

CVE-2009-1217

Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service stack corruption and application termination via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka t...

IBM Access Support ActiveX GetXMLValue buffer overflow

Added: 04/01/2009 CVE: CVE-2009-0215 BID: 34228 OSVDB: 52958 Background The IBM Access Support ActiveX control is used to collect system information. It comes with certain IBM and Lenovo computer systems. Problem A buffer overflow vulnerability allows command execution when a user loads a page...

IBM Access Support ActiveX GetXMLValue buffer overflow

Added: 04/01/2009 CVE: CVE-2009-0215 BID: 34228 OSVDB: 52958 Background The IBM Access Support ActiveX control is used to collect system information. It comes with certain IBM and Lenovo computer systems. Problem A buffer overflow vulnerability allows command execution when a user loads a page...

IBM Access Support ActiveX GetXMLValue buffer overflow

Added: 04/01/2009 CVE: CVE-2009-0215 BID: 34228 OSVDB: 52958 Background The IBM Access Support ActiveX control is used to collect system information. It comes with certain IBM and Lenovo computer systems. Problem A buffer overflow vulnerability allows command execution when a user loads a page...

IBM Access Support ActiveX GetXMLValue buffer overflow

Added: 04/01/2009 CVE: CVE-2009-0215 BID: 34228 OSVDB: 52958 Background The IBM Access Support ActiveX control is used to collect system information. It comes with certain IBM and Lenovo computer systems. Problem A buffer overflow vulnerability allows command execution when a user loads a page...

Amaya 11.1 - W3C Editor/Browser 'defer' Remote Stack Overflow

exploit.py Amaya 11.1 W3C Editor/Browser defer Stack Overflow Exploit By: Encrypt3d.M!nd Origninal Advisory: http://www.milw0rm.com/exploits/8314 Fully Based on Rob Carter's Exploit http://www.milw0rm.com/exploits/7988 Note:you need to upload Devilinside.html to a remote host Works with windows x...

Amaya 11.1 W3C Editor/Browser (defer) Stack Overflow Exploit

Exploit for windows platform in category remote exploits ============================================================ Amaya 11.1 W3C Editor/Browser defer Stack Overflow Exploit ============================================================ exploit.py Amaya 11.1 W3C Editor/Browser defer Stack Overfl...

Adobe Acrobat JavaScript getIcon method buffer overflow

Added: 03/27/2009 CVE: CVE-2009-0927 BID: 34169 Background Adobe Acrobat is software for creating PDF documents. Adobe Reader is free software for viewing PDF documents. Problem A buffer overflow vulnerability allows command execution when a user opens a PDF file which calls the JavaScript getIco...

Adobe Acrobat JavaScript getIcon method buffer overflow

Added: 03/27/2009 CVE: CVE-2009-0927 BID: 34169 Background Adobe Acrobat is software for creating PDF documents. Adobe Reader is free software for viewing PDF documents. Problem A buffer overflow vulnerability allows command execution when a user opens a PDF file which calls the JavaScript getIco...

Adobe Acrobat JavaScript getIcon method buffer overflow

Added: 03/27/2009 CVE: CVE-2009-0927 BID: 34169 Background Adobe Acrobat is software for creating PDF documents. Adobe Reader is free software for viewing PDF documents. Problem A buffer overflow vulnerability allows command execution when a user opens a PDF file which calls the JavaScript getIco...

Adobe Acrobat JavaScript getIcon method buffer overflow

Added: 03/27/2009 CVE: CVE-2009-0927 BID: 34169 Background Adobe Acrobat is software for creating PDF documents. Adobe Reader is free software for viewing PDF documents. Problem A buffer overflow vulnerability allows command execution when a user opens a PDF file which calls the JavaScript getIco...

POP Pepper 3.4.0.0 .html File Overwrite

POP Peeper 3.4.0.0 .html file Universal SEH Overwrite Exploit Exploit By Stack Mountassif Moad How to use : file Open message or Ctrl + O Select The .html file ...... Connect With 5555 Port C:\ncnc -v 127.0.0.1 5555 DNS fwd/rev mismatch: localhost != stack-a4eeb2267 localhost 127.0.0.1 5555 ? ope...

Zinf Audio Player 2.2.1 Overwrite Exploit

usage: exploit.py print "" print " Zinf Audio Player 2.2.1 .pls Universal Seh Overwrite Exploit\n" print " Founder: Hakxer" print " Exploited by : His0k4" print " Tested on: Windows XP Pro SP2 Fr\n" print " Greetings to:" print " All friends & muslims HaCkersdz, www.secdz.com\n" print "" win32exe...

Zinf Audio Player 2.2.1 (.pls) Universal Seh Overwrite Exploit

No description provided by source. usage: exploit.py print "" print " Zinf Audio Player 2.2.1 .pls Universal Seh Overwrite Exploit\n" print " Founder: Hakxer" print " Exploited by : His0k4" print " Tested on: Windows XP Pro SP2 Fr\n" print " Greetings to:" print " All friends &...

POP Peeper 3.4.0.0 .html file Universal SEH Overwrite Exploit

No description provided by source. POP Peeper 3.4.0.0 .html file Universal SEH Overwrite Exploit Exploit By Stack Mountassif Moad How to use : file Open message or Ctrl + O Select The .html file ...... Connect With 5555 Port C:\ncnc -v 127.0.0.1 5555 DNS fwd/rev mismatch: localhost !=...

IBM Access Support ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in IBM Access Support. When sending an overly long string to the GetXMLValue method of IbmEgath.dll 3.20.284.0 an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/ibmegath/getxmlvalue msf undefinedgetxmlval...