Linux Kernel 4.10.5 / < 4.14.3 (Ubuntu) - DCCP Socket Use-After-Free
This is an announcement for CVE-2017-8824 which is a use-after-free
dos
dos 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Microsoft Windows Defender – Controlled Folder Bypass Through UNC Path
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1418
Socusoft Photo 2 Video Converter 8.0.0 – Local Buffer Overflow
# Exploit Title: Socusoft Photo 2 Video Converter v8.0.0 Local Buffer Overflow (Free and Professional variants)
Abyss Web Server < 2.11.6 - Heap Memory Corruption
[+] Credits: John Page (aka HyP3rlinX)
Linux Kernel – ‘The Huge Dirty Cow’ Overwriting The Huge Zero Page (1)
// EDB Note: Source ~ https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0
QEMU – NBD Server Long Export Name Stack Buffer Overflow
Introduced in commit f37708f6b8 (2.10). The NBD spec says a client
ALLPlayer 7.5 – Denial of-Service (PoC)
#!/usr/bin/python
Exim 4.89 – ‘BDAT’ Denial of Service
While parsing BDAT data header, exim still scans for '.' and consider it the end of mail.
Microsoft Edge Chakra JIT – ‘GlobOpt::OptTagChecks’ Must Consider IsLoopPrePass Properly
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1365
Microsoft Edge Chakra JIT – Incorrect Function Declaration Scope
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1367
Microsoft Edge Chakra JIT – ‘Inline::InlineCallApplyTarget_Shared’ does not Return the return Instruction
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1366
Microsoft Edge Chakra JIT – ‘BailOutOnTaggedValue’ Bailouts Type Confusion
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1364
Linux Kernel – ‘mincore()’ Uninitialized Kernel Heap Page Disclosure
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
Winamp Pro 5.66.Build.3512 – Denial of Service
#!/usr/bin/perl
KMPlayer 4.2.2.4 – Denial of Service
#!/usr/bin/perl
WebKit – ‘WebCore::SVGPatternElement::collectPatternAttributes’ Out-of-Bounds Read
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1350
WebKit – ‘WebCore::SimpleLineLayout::RunResolver::runForPoint’ Out-of-Bounds Read
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1349
WebKit – ‘WebCore::RenderText::localCaretRect’ Out-of-Bounds Read
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1348
WebKit – ‘WebCore::AXObjectCache::performDeferredCacheUpdate’ Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1347
WebKit – ‘WebCore::PositionIterator::decrement’ Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1346
WebKit – ‘WebCore::InputType::element’ Use-After-Free (2)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1345
WebKit – ‘WebCore::TreeScope::documentScope’ Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1344
Microsoft Windows 10 – ‘nt!NtQueryDirectoryFile (luafv!LuafvCopyDirectoryEntry)’ Pool Memory Disclosure
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1361
Vonage VDV-23 – Denial of Service
Overview
iOS < 11.1 / tvOS < 11.1 / watchOS < 4.1 - Denial of Service
# Exploit Title: TpwnT - iOS Denail of Service POC
Microsoft Edge Chakra: JIT – ‘OP_Memset’ Type Confusion
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1357
Microsoft Edge Chakra: JIT – ‘Lowerer::LowerBoundCheck’ Incorrect Integer Overflow Check
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1343
Microsoft Edge Chakra JIT – Type Confusion with switch Statements
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1341&desc=3
D-Link DIR-605L < 2.08 - Denial of Service
# Exploit Title: D-Link DIR605L
PSFTPd Windows FTP Server 10.0.4 Build 729 – Log Injection / Use-After-Free
X41 D-Sec GmbH Security Advisory: X41-2017-006
PHP 7.1.8 – Heap Buffer Overflow
Description:
Xlight FTP Server 3.8.8.5 – Buffer Overflow (PoC)
#!/usr/bin/python
SMPlayer 17.11.0 – ‘.m3u’ Buffer Overflow (PoC)
#!/usr/bin/python
Avaya IP Office (IPO) < 10.1 - ActiveX Buffer Overflow
[+] Credits: John Page (aka hyp3rlinx)
Jnes 1.0.2 – Stack Buffer Overflow
#!/usr/bin/env python
Ipswitch WS_FTP Professional < 12.6.0.3 - Local Buffer Overflow (SEH)
#!/usr/bin/python
GraphicsMagick – Memory Disclosure / Heap Overflow
'''Vulnerabilities summary
Debut Embedded HTTPd 1.20 – Denial of Service
# Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers
WhatsApp 2.17.52 – Memory Corruption
#!/usr/bin/env python
Tizen Studio 1.3 Smart Development Bridge < 2.3.2 - Buffer Overflow (PoC)
# Exploit Title: Smart Development Bridge
Sync Breeze Enterprise 10.0.28 – Remote Buffer Overflow (PoC)
Sync Breeze Enterprise BOF - Ivan Ivanovic Ivanov Иван-дурак
Watchdog Development Anti-Malware / Online Security Pro – NULL Pointer Dereference
Exploit Title - Watchdog Development Anti-Malware/Online Security Pro Null Pointer Dereference