dos

Linux Kernel – TCP Related Read Use-After-Free

// Source: https://marcograss.github.io/security/linux/2016/08/18/cve-2016-6828-linux-kernel-tcp-uaf.html

Microsoft Windows – GDI+ EMR_EXTTEXTOUTA / EMR_POLYTEXTOUTA Heap Buffer Overflow (MS16-097)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=828

Microsoft Windows – GDI+ ValidateBitmapInfo Invalid Pointer Arithmetic Out-of-Bounds Reads (MS16-097)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=826

Microsoft Windows – GDI+ DecodeCompressedRLEBitmap Invalid Pointer Arithmetic Out-of-Bounds Write (MS16-097)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=824

Microsoft Internet Explorer – MSHTML!CMultiReadStreamLifetimeManager::ReleaseThreadStateInternal Read AV

iiThS9l_J8

Microsoft Word 2013/2016 – sprmSdyaTop Denial of Service (MS16-099)

#####################################################################################

SAP SAPCAR – Multiple Vulnerabilities

1. Advisory Information

Kodi Web Server 16.1 – Denial of Service

# Exploit Title: Kodi 16.1 Web Server Remote DoS

Wireshark 1.12.0 < 1.12.12 / 2.0.0 < 2.0.4 - RLC Dissector Denial of Service

Sample PCAP

Wireshark 1.12.0 < 1.12.12 / 2.0.0 < 2.0.4 - WSP Dissector Denial of Service

Sample generated with AFL

Wireshark 1.12.0 < 1.12.12 / 2.0.0 < 2.0.4 - PacketBB Dissector Denial of Service

Sample generated by AFL

Wireshark 2.0.0 < 2.0.4 - CORBA IDL Dissectors Denial of Service

GIOP capture

Wireshark 2.0.0 < 2.0.4 - MMSE / WAP / WBXML / WSP Dissectors Denial of Service

Build Information:

Wireshark 1.12.0 < 1.12.12 - NDS Dissector Denial of Service

Sample generated with AFL

Halliburton LogView Pro 9.7.5 – ‘.cgm’ / ‘.tif’ / ‘.tiff’ / ‘.tifh’ Crash (PoC)

# Exploit Title: [Haliburton LogView Pro v9.7.5]

WebKit – TypedArray.copyWithin Memory Corruption

WebKit – TypedArray.fill Memory Corruption

Linux Kernel (ARM/ARM64) – ‘perf_event_open()’ Arbitrary Memory Read

perf_event_open() offers to collect various pieces of information when an event occurs, including a user stack backtr...

AppArmor securityfs < 4.8 - 'aa_fs_seq_hash_show' Reference Count Leak

There's a reference count leak in aa_fs_seq_hash_show that can be used to overflow the reference counter and trigger ...

PHP 5.5.37/5.6.23/7.0.8 – ‘bzread()’ Out-of-Bounds Write

'''

Adobe Flash Player 22.0.0.192 – TAG Memory Corruption

#####################################################################################

Adobe Flash Player 22.0.0.192 – SceneAndFrameData Memory Corruption

#####################################################################################

Adobe Flash Player 22.0.0.192 – DefineSprite Memory Corruption

#####################################################################################

Adobe Flash Player 22.0.0.192 – DefineBitsJPEG2 Memory Corruption

#####################################################################################

Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (7)

#####################################################################################

Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (6)

#####################################################################################

Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (5)

#####################################################################################

Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (4)

#####################################################################################

Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (3)

#####################################################################################

Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (2)

#####################################################################################

Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (1)

#####################################################################################

Adobe Flash – ATF Image Packing Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=793

Adobe Flash – LMZA Property Decoding Heap Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=790

Adobe Flash – JXR Processing Double-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=788

Adobe Flash – ATF Processing Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=786

Microsoft WinDbg – ‘logviewer.exe’ Crash (PoC)

[+] Credits: HYP3RLINX

Microsoft Process Kill Utility (kill.exe) 6.3.9600.17298 – Crash (PoC)

'''

Core FTP LE 2.2 – Path Field Local Buffer Overflow (PoC)

'''

Symantec AntiVirus – PowerPoint Misaligned Stream-cache Remote Stack Buffer Overflow (PoC)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=823

Symantec AntiVirus – Missing Bounds Checks in dec2zip ALPkOldFormatDecompressor::UnShrink

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=821

Symantec AntiVirus – TNEF Decoder Integer Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=819

Symantec AntiVirus – Heap Overflow Modifying MIME Messages

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=818

Symantec AntiVirus – ‘dec2lha Library’ Remote Stack Buffer Overflow (PoC)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=814

Symantec AntiVirus – Unpacking RAR Multiple Remote Memory Corruptions

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=810

Magnet Networks Tesley CPVA 642 Router – Weak WPA-PSK Passphrase Algorithm

# Exploit Title: Magnet Networks – Weak WPA-PSK passphrases used in Tesley CPVA 642 Router

Microsoft Internet Explorer 11 – Garbage Collector Attribute Type Confusion (MS16-063)

Microsoft Windows – Custom Font Disable Policy Bypass

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=779

Microsoft Windows Kernel – ‘ATMFD.dll’ NamedEscape 0x250C Pool Corruption (MS16-074)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=785

Microsoft Windows – ‘gdi32.dll’ Multiple DIB-Related EMF Record Handlers Heap Out-of-Bounds Reads/Memory Disclosure (MS16-074)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=757

Banshee 2.6.2 – ‘.mp3’ Crash (PoC)

'''