This Metasploit module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.
2dc9b201150ea12e09390643b437b269Sony IPELA Network Camera SNC-DH120T version 1.82.01 suffers from a remote stack buffer overflow vulnerability. The vulnerability is caused due to a boundary error in the processing of received FTP traffic through the FTP client functionality (ftpclient.cgi), which can be exploited to cause a stack-based buffer overflow when a user issues a POST request to connect to a malicious FTP server. Successful exploitation could allow execution of arbitrary code on the affected device or cause denial of service scenario.
f3c26902b184bef531fb09e991e41a65Red Hat Security Advisory 2020-4114-01 - ovirt-ansible-repositories is an Ansible role used to set up the repositories required for oVirt engine or host installation. The openvswitch package contains components for enabling Open vSwitch; a software-based Ethernet virtual switch. It also includes OVN components for supporting virtual network abstraction. The Red Hat Virtualization Python SDK is a program that simplifies access to the Red Hat Virtualization API by providing an object-oriented view to developers. Issues addressed include an integer overflow vulnerability.
be470a728dbcd6ced68ac7de77140c48Red Hat Security Advisory 2020-4082-01 - Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Issues addressed include HTTP request smuggling, buffer overflow, denial of service, and information leakage vulnerabilities.
bfb99e0a2e42bf28a8f75ac63e6b9645Red Hat Security Advisory 2020-4080-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.3.0 ESR. Issues addressed include bypass, cross site scripting, integer overflow, spoofing, and use-after-free vulnerabilities.
5cf92efbf972bf62c60047d9360f48daGentoo Linux Security Advisory 202009-14 - A buffer overflow in Xen might allow remote attacker(s) to execute arbitrary code. Versions less than 4.13.1-r3 are affected.
f6307d01d31fc5f6f0ff146802b5e143Red Hat Security Advisory 2020-3949-01 - The librabbitmq packages provide an Advanced Message Queuing Protocol client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Issues addressed include buffer overflow and integer overflow vulnerabilities.
9f5e0061849e69a2c209b1919c8ec698Red Hat Security Advisory 2020-3877-01 - The Audio File library is an implementation of the Audio File Library from SGI, which provides an API for accessing audio file formats like AIFF/AIFF-C, WAVE, and NeXT/Sun .snd/.au files. Issues addressed include buffer overflow, denial of service, and null pointer vulnerabilities.
7ff9d9dd5296e5f52070c228e3effec6Red Hat Security Advisory 2020-4031-01 - FreeRDP is a free implementation of the Remote Desktop Protocol, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Issues addressed include double free, integer overflow, and out of bounds read vulnerabilities.
fd9502af378c565405568238ce5b8924Red Hat Security Advisory 2020-4060-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include buffer overflow, bypass, denial of service, information leakage, memory leak, null pointer, out of bounds read, out of bounds write, privilege escalation, and use-after-free vulnerabilities.
5ee43a3512140e0c0667a6b47642db45Red Hat Security Advisory 2020-3916-01 - The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Issues addressed include a buffer overflow vulnerability.
8cf0583e1f165e51dcdbe265aef468aaRed Hat Security Advisory 2020-3902-01 - The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Issues addressed include buffer overflow and integer overflow vulnerabilities.
18056c3c68663fbd955ff7858af62d45Red Hat Security Advisory 2020-3915-01 - The libssh2 packages provide a library that implements the SSH2 protocol. Issues addressed include an integer overflow vulnerability.
8681e54ea841ae46c559d43332692005Red Hat Security Advisory 2020-3848-01 - The libmspack packages contain a library providing compression and extraction of the Cabinet file format used by Microsoft. Issues addressed include a buffer overflow vulnerability.
dbf5c65347b4fb5e572ab3076ba1f998Red Hat Security Advisory 2020-3873-01 - The libsrtp package provides an implementation of the Secure Real-time Transport Protocol, the Universal Security Transform, and a supporting cryptographic kernel. Issues addressed include a buffer overflow vulnerability.
be76ed04c985cc2d9d4ff4ffcdaf75a1Red Hat Security Advisory 2020-3864-01 - The Common UNIX Printing System provides a portable printing layer for Linux, UNIX, and similar operating systems. Issues addressed include a buffer overflow vulnerability.
d79c1fe53163143381c635e918f448d7Red Hat Security Advisory 2020-3868-01 - Simple DirectMedia Layer is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device. Issues addressed include buffer over-read and buffer overflow vulnerabilities.
006d2770c621d2759e28c096c7e378a6Red Hat Security Advisory 2020-3875-01 - Virtual Network Computing is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Issues addressed include a buffer overflow vulnerability.
ffcb051a09b24c7b09877aae6cd0bc0fRed Hat Security Advisory 2020-4062-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include buffer overflow, bypass, denial of service, information leakage, memory leak, null pointer, out of bounds read, out of bounds write, privilege escalation, and use-after-free vulnerabilities.
9420ee15ec4acbfd94c6e5e63b95ce42BearShare Lite version 5.2.5 buffer overflow proof of concept exploit.
ef59d7558465e84317871b9e0eac4917Gentoo Linux Security Advisory 202009-15 - A buffer overflow in libuv might allow remote attacker(s) to execute arbitrary code. Versions less than 1.39.0 are affected.
9d7b688027e9ca3bfc06f9fe9e48a179CloudMe version 1.11.2 exploit that uses MSVCRT.System to create a new user (boku:0v3R9000!) and add the new user to the Administrators group. A requirement of successful exploitation is the CloudMe.exe process must be running as administrator.
ee00ae19cbee8ea397dcd21d71b0c0f1Ubuntu Security Notice 4541-1 - Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars discovered that Gnuplot did not properly validate string sizes in the df_generate_ascii_array_entry function. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in a denial of service attack or arbitrary code execution. Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars discovered that Gnuplot did not properly validate string sizes in the PS_options function when the Gnuplot postscript terminal is used as a backend. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service attack or arbitrary code execution. Various other issues were also addressed.
a2d584e45b3bcb0222cfcf7ec75368abUbuntu Security Notice 4529-1 - It was discovered that FreeImage incorrectly handled certain memory operations. If a user were tricked into opening a crafted TIFF file, a remote attacker could use this issue to cause a heap buffer overflow, resulting in a denial of service attack. It was discovered that FreeImage incorrectly processed images under certain circumstances. If a user were tricked into opening a crafted TIFF file, a remote attacker could possibly use this issue to cause a stack exhaustion condition, resulting in a denial of service attack. Various other issues were also addressed.
e4d795e868523f46e11bced7d75ce497Gentoo Linux Security Advisory 202009-4 - Qt GUI has a buffer overflow with unspecified impact. Versions less than 5.14.2-r1 are affected.
9762d5965efcf7ac805f222ffd1f05d1
© 2020 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed