PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Heap Overflow in OpenBSD's slaacd via Router Advertisement

blog.quarkslab.com | research | #vulnerability | #ipv6 | #heap-overflow | #openbsd | #slaacd | #router-advertisement
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Analysis of a heap overflow in OpenBSD's slaacd: a malformed domain label in a Router Advertisement DNSSL option, patched in March 2022, with a proof-of-concept provided.
Published
Collected

Related coverage

advisory · blog.quarkslab.com
Bad Neighbor on FreeBSD: IPv6 Router Advertisement Vulnerabilities in rtsold (CVE-2020-25577)
Details of four vulnerabilities in FreeBSD's rtsold(8) IPv6 router solicitation daemon, the worst allowing remote code execution as root from the same link; fixed in FreeBSD-SA-20:32.rtsold.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
research · blog.quarkslab.com
PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack.
PixieFail: nine vulnerabilities in the IPv6 network stack of EDK II, TianoCore's open-source UEFI reference implementation, exploitable during network boot (PXE) on many enterprise machines.
research · swarm.ptsecurity.com
Hack the Elephant One Bite at a Time: JPEG-Related Memory-Safety Bugs in PHP
PT SWARM audited PHP's ext/standard C code and found memory-safety bugs: a heap memory disclosure in getimagesize() and a heap buffer overflow in iptcembed(), both reachable via crafted JPEGs.
research · depthfirst.com
NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
depthfirst's system found four remote memory-corruption bugs in NGINX, including a 2008-era heap overflow (CVE-2026-42945); a PoC shows RCE with ASLR off. rewrite/set users are at risk.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back