Joshua J. Drake

Um subfluxo de número inteiro (wrap ou wraparound) nas Core Libraries pode levar a leituras excessivas de buffer (buffer overreads). Um subfluxo de número inteiro ocorre quando uma operação aritmética resulta em um valor menor do que o valor mínimo que a variável pode conter, fazendo com que ela retorne para um número positivo muito grande.

Um problema de leitura fora dos limites (out-of-bounds read) nas Core Libraries permite a sobreleitura de buffers, o que ocorre quando o software lê dados além do final do buffer pretendido.

Um problema de leitura fora dos limites (out-of-bounds read) existe nas Core Libraries que permite a sobreleitura de buffers. Uma leitura fora dos limites ocorre quando um programa lê dados de um endereço de memória fora dos limites do buffer pretendido.

The issue is related to a buffer overflow in memory, allowing remote attackers to execute arbitrary code by opening a specially crafted file. This can affect the system. The vulnerability is associated with the RTF parser and can be triggered with a table of fonts containing an excessive number of entries. It has been reported that a proof-of-concept exploit is available, which can be chained with other vulnerabilities to achieve remote code execution.

The issue is related to an untrusted search path vulnerability in the OSA Scripts component of Apple OS X. This vulnerability allows attackers to load arbitrary script libraries via a quarantined application, potentially enabling remote attackers to exploit the system.

The issue is related to the syslog component in the affected operating systems, caused by a buffer overflow. This can be exploited by a local attacker to gain privileges or cause a denial of service, resulting in memory corruption.

The issue is related to a buffer overflow in the dynamic memory of the libstagefright library, caused by an integer overflow. This can be exploited by a remote attacker using a specially crafted MP4 file, potentially allowing the execution of arbitrary code or causing a denial of service.

The issue is related to the MPEG4Extractor::parse3GPPMetaData function in the libstagefright library, which does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM). This allows remote attackers to cause a denial of service, including integer underflow, buffer over-read, and mediaserver process crash, via crafted 3GPP metadata. The vulnerability is also associated with an integer overflow.

The issue is related to an off-by-one error in the `MPEG4Extractor::parseChunk` function, which can lead to an integer overflow and memory corruption. This can be exploited by remote attackers using crafted MPEG-4 covr atoms with a size equal to `SIZE MAX`. The exploitation may result in the execution of arbitrary code or a denial of service. The vulnerability is associated with an integer overflow in the `libstagefright` library of the Android operating system.

The issue is related to the MPEG4Extractor::parse3GPPMetaData function in the libstagefright library, which does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM). This allows remote attackers to execute arbitrary code or cause a denial of service via crafted 3GPP metadata, resulting in integer underflow and memory corruption. The vulnerability can be exploited to remotely execute code in affected devices.

The issue is related to an integer underflow in the `MPEG4Extractor::parseChunk` function of the libstagefright library in Android. This can be exploited by a remote attacker using specially crafted MPEG-4 data, potentially allowing the execution of arbitrary code or causing a denial of service due to memory corruption. The vulnerability can be triggered via crafted MPEG-4 covr atoms.

The issue is related to the MPEG4Extractor::parseChunk function in the libstagefright library, which does not properly restrict size addition. This allows remote attackers to execute arbitrary code or cause a denial of service due to integer overflow and memory corruption via a crafted MPEG-4 tx3g atom. The vulnerability can be exploited by sending specially crafted data in the MPEG-4 format, potentially leading to remote code execution or a denial of service.

The issue is related to multiple integer underflows in the ESDS::parseESDescriptor function of the libstagefright library in the Android operating system. This can be exploited by a remote attacker to execute arbitrary code using specially crafted ESDS data. The vulnerability allows for the execution of code via crafted ESDS atoms.

The issue is related to an integer overflow in the `SampleTable::setSampleToChunkParams` function in `libstagefright` in Android. This allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication. The vulnerability can be exploited to remotely execute code in affected devices.

The issue is related to multiple integer overflows in the libstagefright library, which can be exploited by remote attackers to execute arbitrary code. This can be achieved through crafted sample metadata in an MPEG-4 video file.

A security feature bypass issue exists due to the improper loading of structured exception handling tables by the kernel. This allows attackers to bypass the SafeSEH security feature, potentially facilitating the exploitation of other vulnerabilities.

The issue is related to the LDAP service in Active Directory, which does not properly free memory for LDAP and LDAPS requests. This allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released. The problem is associated with a "DN AttributeValue" and is probably a memory leak.

The issue arises from improper validation of data in the VBA Performance Cache when processing an Office document with an embedded object. This allows remote attackers to execute arbitrary code via a crafted Excel file, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption. A remote code execution vulnerability exists in the way Excel processes a VBA Performance Cache, which could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file.

The issue allows local users to create arbitrary files via unspecified vectors, including scenarios where an attacker's umask is honored. Additionally, it involves the `/etc/ld.so.preload` file, certain cron data file locations, and possibly the `OSSEMEMDBG` or `TRC LOG FILE` environment variables in `db2licd` (`db2licm`).

The issue is related to improper termination of certain input strings, which can lead to a heap-based buffer overflow. This allows local users to execute arbitrary code via unspecified environment variables.