what you don't know can hurt you
Showing 101 - 125 of 1,404 RSS Feed

Files from Google Security Research

First Active2000-02-18
Last Active2019-09-16
Oracle Java Runtime Environment GlyphIterator::setCurrGlyphID Heap Corruption
Posted Apr 17, 2019
Authored by Google Security Research, mjurczyk

A heap corruption was observed in Oracle Java Runtime Environment version 8u202 (latest at the time of this writing) while fuzz-testing the processing of TrueType fonts.

tags | exploit, java
advisories | CVE-2019-2698
MD5 | 074ca17f20fc3585508db683bc708cad
Oracle Java Runtime Environment sc_FindExtrema4 Heap Corruption
Posted Apr 17, 2019
Authored by Google Security Research, mjurczyk

A heap corruption was observed in Oracle Java Runtime Environment version 8u202 (latest at the time of this writing) while fuzz-testing the processing of TrueType, implemented in a proprietary t2k library.

tags | exploit, java
advisories | CVE-2019-2697
MD5 | 74f5b83ac15a386d0e98eb59705c2a66
Microsoft Windows LUAFV PostLuafvPostReadWrite SECTION_OBJECT_POINTERS Race Condition
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver has a race condition in the LuafvPostReadWrite callback if delay virtualization has occurred during a read leading to the SECTION_OBJECT_POINTERS value being reset to the underlying file resulting in elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0836
MD5 | 6d02ec8a84f62a9cf2ee150b26a8f78a
Microsoft Windows LUAFV Delayed Virtualization Cache Manager Poisoning Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver can confuse the cache and memory manager to replace the contents of privileged file leading to elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0805
MD5 | 77b361493b8c0d502d033818bd814a0b
Microsoft Windows LUAFV NtSetCachedSigningLevel Device Guard Bypass
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the NtSetCachedSigningLevel system call can be tricked by the operation of LUAFV to apply a cached signature to an arbitrary file leading to a bypass of code signing enforcement under UMCI with Device Guard.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2019-0732
MD5 | c842665e8c982e999825c50d9c78df7a
Microsoft Windows LUAFV LuafvCopyShortName Arbitrary Short Name Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver bypasses security checks to copy short names during file virtualization which can be tricked into writing an arbitrary short name leading to elevation of privilege.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2019-0796
MD5 | dd49da95f51474f4c5e19bc2d1015952
Microsoft Windows LUAFV Delayed Virtualization Cross Process Handle Duplication Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver doesn't take into account a virtualized handle being duplicated to a more privileged process resulting in elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0731
MD5 | a1fec4a7c7f902a8a18eb1e16515b938
Microsoft Windows LUAFV Delayed Virtualization MAXIMUM_ACCESS DesiredAccess Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver reuses the file's create request DesiredAccess parameter, which can include MAXIMUM_ACCESS, when virtualizing a file resulting in elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0730
MD5 | 3cb71794adeb390f66e06400fdb22445
Microsoft Windows CSRSS SxSSrv Cached Manifest Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the SxS manifest cache in CSRSS uses a weak key allowing an attacker to fill a cache entry for a system binary leading to elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0735
MD5 | 9f3bf345b40d34f07347582eafa1a2c3
Chrome FileChooserImpl Use-After-Free
Posted Apr 10, 2019
Authored by Google Security Research, Mark Brand

Chrome suffers from a use-after-free vulnerability in FileChooserImpl.

tags | exploit
MD5 | 9482cae8e5970a7f1be1609209542324
JavaScriptCore Out-Of-Bounds Access
Posted Apr 2, 2019
Authored by saelo, Google Security Research

JavaScriptCore suffer from an out-of-bounds access vulnerability in FTL JIT due to LICM moving array access before the bounds check.

tags | advisory
advisories | CVE-2019-8518
MD5 | 666ca0b0b1f37dcfd1113b475c267cad
Chrome ReadableStream Internal Object Leak
Posted Apr 2, 2019
Authored by Google Security Research, Glazvunov

Chrome suffers from an internal object leak vulnerability in ReadableStream.

tags | exploit
MD5 | 6a97d2f992936446497e3bbc759c1cfb
Chrome JSPromise::TriggerPromiseReactions Type Confusion
Posted Apr 2, 2019
Authored by Google Security Research, Glazvunov

Chrome suffers from a type confusion vulnerability in JSPromise::TriggerPromiseReactions.

tags | exploit
MD5 | 1da1ae35b490e46af58d5192967700dd
JavaScriptCore CodeBlock Use-After-Free
Posted Apr 2, 2019
Authored by saelo, Google Security Research

JavaScriptCore suffers from CodeBlock use-after-free vulnerabilities due to dangling Watchpoints.

tags | advisory, vulnerability
advisories | CVE-2019-8558
MD5 | 44941500a9bd200e3ded8e6050b94b65
Chrome V8TrustedTypePolicyOptions::ToImpl Type Confusion
Posted Apr 1, 2019
Authored by Google Security Research, Glazvunov

Chrome suffers from a type confusion vulnerability in V8TrustedTypePolicyOptions::ToImpl.

tags | exploit
MD5 | 98c38647d36157a9c19284e8e46c2d46
WebKitGTK+ ThreadedCompositor Race Condition
Posted Apr 1, 2019
Authored by Google Security Research, Glazvunov

The compositor thread in WebKitGTK+ might alter a FilterOperation object's reference count variable at the same time as the main thread. Then the reference count corruption might lead to a use-after-free condition.

tags | exploit
MD5 | 7cf03baad452fd88cc65c2145f359558
XNU Unsafe Pidversion Increment During Execve
Posted Apr 1, 2019
Authored by saelo, Google Security Research

XNU has an issue where pidversion increment during execve is unsafe.

tags | exploit
advisories | CVE-2019-8514
MD5 | 98cad986f696210bc1f2b23ff3589ba7
JavaScriptCore createRegExpMatchesArray Fails To Respect Inferred Types
Posted Apr 1, 2019
Authored by saelo, Google Security Research

JavaScriptCore has an issue where createRegExpMatchesArray does not respect inferred types.

tags | exploit
advisories | CVE-2019-8506
MD5 | 890d106035374c388ef370b205c1ca00
SpiderMonkey IonMonkey Type Confusion
Posted Mar 29, 2019
Authored by saelo, Google Security Research

A bug in IonMonkey leaves type inference information inconsistent, which in turn allows the compilation of JITed functions that cause type confusions between arbitrary objects.

tags | exploit, arbitrary
advisories | CVE-2019-9813
MD5 | cdcb535655303de5282b8e9ce3804be5
SpiderMonkey IonMonkey Type Confusion
Posted Mar 27, 2019
Authored by saelo, Google Security Research

A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replacement (OSR) allows the compilation of JITed functions that cause type confusions between arbitrary objects.

tags | exploit, arbitrary
advisories | CVE-2019-9791
MD5 | 2d9234f04f13771cc4ba74f08b736649
GnuTLS verify_crt() Use-After-Free
Posted Mar 27, 2019
Authored by Tavis Ormandy, Google Security Research

This is a critical memory corruption vulnerability in any API backed by verify_crt(), including gnutls_x509_trust_list_verify_crt() and related routines in GnuTLS.

tags | exploit
MD5 | ccebe291a8ca3ffea320b528513b5f23
VMware Host VMX Process COM Class Hijack Privilege Escalation
Posted Mar 25, 2019
Authored by James Forshaw, Google Security Research

The VMX process (vmware-vmx.exe) process configures and hosts an instance of VM. As is common with desktop virtualization platforms the VM host usually has privileged access into the OS such as mapping physical memory which represents a security risk. To mitigate this the VMX process is created with an elevated integrity level by the authentication daemon (vmware-authd.exe) which runs at SYSTEM. This prevents a non-administrator user opening the process and abusing its elevated access. Unfortunately the process is created as the desktop user which results in the elevated process sharing resources such as COM registrations with the normal user who can modify the registry to force an arbitrary DLL to be loaded into the VMX process. Affects VMware Workstation Windows version 14.1.5 (on Windows 10). Also tested on VMware Player version 15.

tags | exploit, arbitrary, registry
systems | windows
advisories | CVE-2019-5512
MD5 | 89f47ed75e40cece6cb2c49cd4ca6364
VMware Host VMX Process Impersonation Hijack Privilege Escalation
Posted Mar 25, 2019
Authored by James Forshaw, Google Security Research

The VMX process (vmware-vmx.exe) process configures and hosts an instance of VM. As is common with desktop virtualization platforms the VM host usually has privileged access into the OS such as mapping physical memory which represents a security risk. To mitigate this the VMX process is created with an elevated integrity level by the authentication daemon (vmware-authd.exe) which runs at SYSTEM. This prevents a non-administrator user opening the process and abusing its elevated access. Unfortunately the process is created as the desktop user and follows the common pattern of impersonating the user while calling CreateProcessAsUser. This is an issue as the user has the ability to replace any drive letter for themselves, which allows a non-admin user to hijack the path to the VMX executable, allowing the user to get arbitrary code running as a trusted VMX process. Affects VMware Workstation Windows version 14.1.5 (on Windows 10). Also tested on VMware Player version 15.0.2.

tags | exploit
systems | windows
advisories | CVE-2018-5511
MD5 | c70a9a606361322046a94717d41168b1
snap seccomp TIOCSTI Blacklist Circumvention
Posted Mar 22, 2019
Authored by Google Security Research

snap uses a seccomp filter with a blacklist for TIOCSTI can be circumvented.

tags | exploit
advisories | CVE-2019-7303
MD5 | d115b8657c274c5957091d315ab7e604
NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash
Posted Mar 21, 2019
Authored by Tavis Ormandy, Google Security Research

NSS suffers from a NULL dereference issue when parsing Netscape Certificate Sequences in CERT_DecodeCertPackage().

tags | exploit
MD5 | 35138609aae47bba66dfd5eb881a1aa8
Page 5 of 57
Back34567Next

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    10 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close