iMessage – Memory Corruption when Decoding NSKnownKeysDictionary1
There is a memory corruption vulnerability when decoding an object of class NSKnownKeysDictionary1. This class decod...
dos
dos 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
iMessage – NSArray Deserialization can Invoke Subclass that does not Retain References
When deserializing a class with initWithCoder, subclasses of that class can also be deserialized so long as they do n...
macOS / iOS JavaScriptCore – JSValue Use-After-Free in ValueProfiles
While fuzzing JSC, I encountered the following JS program which crashes JSC from current HEAD and release (/System/Li...
macOS / iOS JavaScriptCore – Loop-Invariant Code Motion (LICM) Leaves Object Property Access Unguarded
While fuzzing JavaScriptCore, I encountered the following (modified and commented) JavaScript program which crashes j...
macOS / iOS NSKeyedUnarchiver – Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances
When deserializing NSObjects with the NSArchiver API [1], one can supply a whitelist of classes that are allowed to b...
pdfresurrect 0.15 – Buffer Overflow
# Exploit Title: pdfresurrect 0.15 Buffer Overflow
Apple iMessage – DigitalTouch tap Message Processing Out-of-Bounds Read
The digital touch iMessage extension can read out of bounds if a malformed Tap message contains a color array that is...
BACnet Stack 0.8.6 – Denial of Service
# Exploit Title: BACnet Stack 0.8.6 - Denial of Service
WinMPG iPod Convert 3.0 – ‘Register’ Denial of Service
# Exploit Title: WinMPG iPod Convert 3.0 - 'Register' Denial of Service
Microsoft Compiled HTML Help / Uncompiled .chm File – XML External Entity Injection
[+] Credits: John Page (aka hyp3rlinx)
Microsoft Windows Remote Desktop – ‘BlueKeep’ Denial of Service (Metasploit)
# Exploit Title: Bluekeep Denial of Service (metasploit module)
Android 7 – 9 VideoPlayer – ‘ihevcd_parse_pps’ Out-of-Bounds Write
CVE-2019-2107 - looks scary. Still remember Stagefright and PNG bugs vulns .... With CVE-2019-2107 the decoder/codec ...
Microsoft Font Subsetting – DLL Heap Corruption in ComputeFormat4CmapData
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Heap-Based Out-of-Bounds Read/Write in OpenType Font Handling Due to Empty ROS Strings
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – NULL Pointer Dereferences in OpenType Font Handling While Accessing Empty dynarrays
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Multiple Bugs in OpenType Font Handling Related to the “post” Table
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Out-of-Bounds Read in OpenType Font Handling Due to Undefined FontName Index
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Heap-Based Buffer Overflow in OpenType Font Handling in readStrings
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Heap-Based Out-of-Bounds Read/Write in OpenType Font Handling Due to Unbounded iFD
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Heap-Based Buffer Overflow Due to Integer Overflow in readTTCDirectory
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Heap-Based Buffer Overflow in OpenType Font Handling in readCharset
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Heap-Based Buffer Overflow in OpenType Font Handling in readFDSelect
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Heap-Based Buffer Overflow in OpenType Font Handling in readEncoding
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling Due to Incorrect Handling of blendArray
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Interpreter Stack Underflow in OpenType Font Handling Due to Missing CHKUFLOW
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Use of Uninitialized Memory While Freeing Resources in var_loadavar
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack-Based Buffer Overflow in do_set_weight_vector_cube for Large nAxes
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling Due to Negative nAxes
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling Due to Negative cubeStackDepth
-----=====[ Background ]=====-----
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling due to Out-of-Bounds cubeStackDepth
----=====[ Background ]=====-----
Mozilla Spidermonkey – Unboxed Objects Uninitialized Memory Access
For constructors, Spidermonkey implements a "definite property analysis" [1] to compute which properties will definit...
Microsoft Windows – Font Subsetting DLL Heap-Based Out-of-Bounds Read in MergeFonts
-----=====[ Background ]=====-----
Firefox 67.0.4 – Denial of Service
Loading please wait
Mozilla Spidermonkey – IonMonkey ‘Array.prototype.pop’ Type Confusion
The following program (found through fuzzing and manually modified) crashes Spidermonkey built from the current beta ...
Microsoft Windows Font Cache Service – Insecure Sections Privilege Escalation
Windows: Windows Font Cache Service Insecure Sections EoP
Microsoft Windows – ‘CmpAddRemoveContainerToCLFSLog’ Arbitrary File/Directory Creation
Windows: CmpAddRemoveContainerToCLFSLog Arbitrary File/Directory Creation EoP
GSearch 1.0.1.0 – Denial of Service (PoC)
# Exploit Title: GSearch v1.0.1.0 - Denial of Service (PoC)
Linux – Use-After-Free via race Between modify_ldt() and #BR Exception
When a #BR exception is raised because of an MPX bounds violation, Linux parses
Thunderbird ESR < 60.7.XXX - 'icalrecur_add_bydayrules' Stack-Based Buffer Overflow
X41 D-Sec GmbH Security Advisory: X41-2019-003
Thunderbird ESR < 60.7.XXX - 'parser_get_next_char' Heap-Based Buffer Overflow
X41 D-Sec GmbH Security Advisory: X41-2019-002
Thunderbird ESR < 60.7.XXX - 'icalmemorystrdupanddequote' Heap-Based Buffer Overflow
X41 D-Sec GmbH Security Advisory: X41-2019-001
Thunderbird ESR < 60.7.XXX - Type Confusion
-----BEGIN PGP SIGNED MESSAGE-----
Netperf 2.6.0 – Stack-Based Buffer Overflow
# Exploit Author: Juan Sacco - http://exploitpack.com
HC10 HC.Server Service 10.14 – Remote Invalid Pointer Write
[+] Credits: John Page (aka hyp3rlinx)
Microsoft Windows Remote Desktop – ‘BlueKeep’ Denial of Service
import socket, sys, struct
Qualcomm Android – Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL
The following issue exists in the android-msm-wahoo-4.4-pie branch of
Spidermonkey – IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation
While fuzzing Spidermonkey, I encountered the following (commented and modified) JavaScript program which crashes deb...