dos

IBM Notes 8.5.x/9.0.x – Denial of Service (2)

# Exploit Title: IBM Notes is affected by a denial of service vulnerability

Oracle Java JDK/JRE < 1.8.0.131 / Apache Xerces 2.11.0 - 'PDF/Docx' Server Side Denial of Service

## Vulnerabilities Summary

libgig 4.0.0 (LinuxSampler) – Multiple Vulnerabilities

================

Apple macOS Sierra 10.12.1 – ‘IOFireWireFamily’ FireWire Port Denial of Service

#include

NoviFlow NoviWare < NW400.2.6 - Multiple Vulnerabilities

NoviFlow NoviWare

MessengerScan 1.05 – Local Buffer Overflow (PoC)

#!/usr/bin/python

DSScan 1.0 – Local Buffer Overflow (PoC)

#!/usr/bin/python

MyDoomScanner 1.00 – Local Buffer Overflow (PoC)

#!/usr/bin/python

Microsoft Edge – Out-of-Bounds Access when Fetching Source

// The attached JavaScript file causes an out-of-bounds access of the source buffer when fetching the source for one ...

Adobe Flash – Invoke Accesses Trait Out-of-Bounds

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1320

Microsoft Edge 40.15063.0.0 Chakra – Incorrect JIT Optimization with TypedArray Setter #3

'use strict';

Microsoft Edge Chakra – ‘EmitNew’ Integer Overflow

let args = new Array(0x10000);

Microsoft Edge Chakra – Uninitialized Arguments (2)

function f() {

Microsoft Edge Chakra – Uninitialized Arguments (1)

function f() {

Microsoft Edge Chakra – ‘JavascriptFunction::EntryCall’ Fails to Handle ‘CallInfo’ Properly

function f() {

Microsoft Edge Chakra – ‘JavascriptArray::ConcatArgs’ Type Confusion

let a = [0];

Microsoft Edge Chakra – Incorrect JIT Optimization with TypedArray Setter #2

'use strict';

Microsoft Edge Chakra – ‘EmitAssignment’ uses the ‘this’ Register Without Initializing

class Parent {

Microsoft Edge Chakra – ‘TryUndeleteProperty’ Incorrect Usage (Denial of Service)

const kNumProperties = 100;

Microsoft Edge Chakra – ‘InterpreterStackFrame::ProcessLinkFailedAsmJsModule’ Incorrect Usage of ‘PushPopFrameHelper’ (Denial of Service)

function asmModule() {

Microsoft Edge Chakra – ‘InterpreterStackFrame::ProcessLinkFailedAsmJsModule’ Incorrectly Re-parses

class MyClass {

Microsoft Edge Chakra – Heap Buffer Overflow

POC

Microsoft Edge Chakra – NULL Pointer Dereference

POC

Microsoft Edge Chakra – Buffer Overflow

POC

Microsoft Edge Chakra – ‘chakra!Js::GlobalObject’ Integer overflow

POC

Microsoft Edge Chakra – ‘PreVisitCatch’ Missing Call

function trigger() {

Apple macOS Sierra 10.12.3 – ‘IOFireWireFamily-null-deref’ FireWire Port Denial of Service

#include

Microsoft Edge 38.14393.1066.0 – ‘CInputDateTimeScrollerElement::_SelectValueInternal’ Out-of-Bounds Read

Tomabo MP4 Converter 3.19.15 – Denial of Service

#!/usr/bin/python

Microsoft Edge 38.14393.1066.0 – ‘textarea.defaultValue’ Memory Disclosure

aaa

WildMIDI 0.4.2 – Multiple Vulnerabilities

wildmidi multiple vulnerabilities

Solarwinds Kiwi Syslog 9.6.1.6 – Denial of Service

# Exploit Title: Solarwinds Kiwi Syslog 9.6.1.6 - Remote Denial of Service (Type Mismatch)

libmad 0.15.1b – ‘mp3’ Memory Corruption

libmad memory corruption vulnerability

libao 1.2.0 – Denial of Service

libao memory corruption vulnerability

libvorbis 1.3.5 – Multiple Vulnerabilities

libvorbis multiple vulnerabilities

Sound eXchange (SoX) 14.4.2 – Multiple Vulnerabilities

Sound eXchange (SoX) multiple vulnerabilities

Vorbis Tools oggenc 1.4.0 – ‘.wav’ Denial of Service

vorbis-tools oggenc vulnerability

DivFix++ 0.34 – Denial of Service

DivFix++ denial of service vulnerability

libjpeg-turbo 1.5.1 – Denial of Service

libjpeg-turbo denial of service vulnerability

LAME 3.99.5 – Multiple Vulnerabilities

LAME multiple vulnerabilities

SoundTouch 1.9.2 – Multiple Vulnerabilities

SoundTouch multiple vulnerabilities

GNU libiberty – Buffer Overflow

Source: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687

WebKit JSC – ‘ObjectPatternNode::appendEntry’ Stack Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256

WebKit JSC – ‘ArgumentsEliminationPhase::transform’ Incorrect LoadVarargs Handling

const kArgsLength = 0x101;

WebKit JSC – ‘JSArray::appendMemcpy’ Uninitialized Memory Copy

function optNewArrayAndConcat() {

WebKit JSC – ‘arrayProtoFuncSplice’ Uninitialized Memory Reference

function gc() {

WebKit JSC – ‘DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)’ Incorrect Scope Register Handling

function f() {

WebKit – ‘WebCore::getCachedWrapper’ Use-After-Free

WebKit – ‘WebCore::Node::getFlag’ Use-After-Free

foo

WebKit – ‘WebCore::RenderObject’ with Accessibility Enabled Use-After-Free

1