CVSS: 8.8EPSS: 24%CPEs: 62EXPL: 2CVE-2016-5766 – gd: Integer overflow in _gd2GetHeader() resulting in heap overflow
https://notcve.org/view.php?id=CVE-2016-5766
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image. Desbordamiento de entero en la función _gd2GetHeader en gd_gd2.c en la GD Graphics Library (también conocido como libgd) en versiones anteriores a 2.2.3, como se utiliza en PHP en versiones anteriores a 5.5.37, 5.6.x en versiones anteriores a 5.6.23 y 7.x en versiones anteriores a 7.0.8, permite a atacantes remotos provocar una denegación de servicio (desbordamiento de búfer basado en memoria dinámica y caída de aplicación) o posiblemente tener otro impacto no especificado a través de dimensiones del pedazo en una imagen manipulada. An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image. • http://github.com/php/php-src/commit/7722455726bec8c53458a32851d2a87982cf0eac?w=1 http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://rhn.redhat.com/errata/RHSA-2016-2598.html http://rhn.redhat.com/errata/RHSA-2016-2750.html http://www.debian.org/securit • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 2CVE-2016-1887 – FreeBSD Kernel (FreeBSD 10.2 x64) - 'sendmsg' Kernel Heap Overflow (PoC)
https://notcve.org/view.php?id=CVE-2016-1887
Integer signedness error in the sockargs function in sys/kern/uipc_syscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to cause a denial of service (memory overwrite and kernel panic) or gain privileges via a negative buflen argument, which triggers a heap-based buffer overflow. Error de entero sin signo en la función sockargs en sys/kern/uipc_syscalls.c en FreeBSD 10.1 en versiones anteriores a p34, 10.2 en versiones anteriores a p17 y 10.3 en versiones anteriores a p3 permite a usuarios locales provocar una denegación de servicio (sobreescritura de memoria y kernel panic) u obtener privilegios a través de un argumento buflen negativo, lo que desencadena un desbordamiento de buffer basado en memoria dinámica. • https://www.exploit-db.com/exploits/44212 http://cturt.github.io/sendmsg.html http://www.securitytracker.com/id/1035906 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:19.sendmsg.asc • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 2CVE-2016-1886 – FreeBSD Kernel (FreeBSD 10.2 < 10.3 x64) - 'SETFKEY' (PoC)
https://notcve.org/view.php?id=CVE-2016-1886
Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and kernel crash), or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call, which triggers a "two way heap and stack overflow." Error de entero sin signo en la función genkbd_commonioctl en sys/dev/kbd/kbd.c en FreeBSD 9.3 en versiones anteriores a p42, 10.1 en versiones anteriores a p34, 10.2 en versiones anteriores a p17 y 10.3 en versiones anteriores a p3 permite a usuarios locales obtener información sensible de la memoria del kernel, causar una denegación de servicio (sobrescribir memoria y caída del kernel), u obtener privilegios a través de un valor negativo en el mimebro de estructura flen en el argumento arg en una llamada SETFKEY ioctl, lo que desencadena un "desbordamiento de pila y memoria dinámica en dos sentidos" • https://www.exploit-db.com/exploits/44211 http://cturt.github.io/SETFKEY.html http://www.securityfocus.com/bid/90734 http://www.securitytracker.com/id/1035905 https://security.FreeBSD.org/patches/SA-16:18/atkbd.patch https://www.freebsd.org/security/advisories/FreeBSD-SA-16:18.atkbd.asc • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 125EXPL: 0CVE-2016-2518 – ntp: out-of-bounds references on crafted packet
https://notcve.org/view.php?id=CVE-2016-2518
The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value. La función MATCH_ASSOC en NTP en versiones anteriores 4.2.8p9 y 4.3.x en versiones anteriores a 4.3.92 permite a atacantes remotos provocar una referencia fuera de los límites a través de una solicitud addpeer con un valor hmode grande. An out-of-bounds access flaw was found in the way ntpd processed certain packets. An authenticated attacker could use a crafted packet to create a peer association with hmode of 7 and larger, which could potentially (although highly unlikely) cause ntpd to crash. • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2016& • CWE-125: Out-of-bounds Read •
CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 2CVE-2016-1885 – FreeBSD 10.2 (x64) - 'amd64_set_ldt' Heap Overflow
https://notcve.org/view.php?id=CVE-2016-1885
Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.2 before p14 allows local users to cause a denial of service (kernel panic) via an i386_set_ldt system call, which triggers a heap-based buffer overflow. Error de entero sin signo en la función amd64_set_ldt en sys/amd64/amd64/sys_machdep.c en FreeBSD 9.3 en versiones anteriores a p39, 10.1 en versiones anteriores a p31 y 10.2 en versiones anteriores a p14 permite a usuarios locales provocar una denegación de servicio (pánico en el kernel) a través de una llamada i386_set_ldt system, lo que desencadena un desbordamiento de buffer basado en memoria dinámica. • https://www.exploit-db.com/exploits/39570 http://packetstormsecurity.com/files/136276/FreeBSD-Kernel-amd64_set_ldt-Heap-Overflow.html http://seclists.org/fulldisclosure/2016/Mar/56 http://seclists.org/fulldisclosure/2016/Mar/67 http://www.coresecurity.com/advisories/freebsd-kernel-amd64setldt-heap-overflow http://www.securityfocus.com/archive/1/537812/100/0/threaded http://www.securityfocus.com/archive/1/537813/100/0/threaded http://www.securitytracker.com/id/1035309 https://security.Free • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •