Samsung OTP OTP_GET_CRYPTO_DERIVED_KEY Buffer Overflow Vulnerability

Stack buffer overflow and information disclosure vulnerabilities exist in the Samsung OTP TrustZone trustlet via OTPGETCRYPTODERIVEDKEY. Stack buffer overflow and information disclosure in OTP TrustZone trustlet via OTPGETCRYPTODERIVEDKEY As a part of the KNOX extensions available on Samsung...

Kaspersky Local CA Root Protected Incorrectly Exploit

Kaspersky fails to adequately protect its local CA root. Kaspersky: Local CA root is incorrectly protected When Kaspersky generate a private key for the local root, they store the private key in %ProgramData%. Obviously this file cannot be shared, because it's the private key for a trusted local...

llvm_libcxxabi: Stack-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, __cxxabiv1::malloc_all

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5776265793503232 Project: llvmlibcxxabi Fuzzer: libFuzzerllvmlibcxxabicxademanglefuzzer Fuzz target binary: cxademanglefuzzer Job Type: libfuzzerasanllvmlibcxxabi Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Cra...

freetype2: Heap-use-after-free in cff_parse_num

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4766135438278656 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type:...

libreoffice: Global-buffer-overflow in ImplDBCSToUnicode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5695345388421120 Project: libreoffice Fuzzer: libFuzzerlibreofficewmffuzzer Fuzz target binary: wmffuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

json: Heap-buffer-overflow in nlohmann::basic_json<std::__1::map, std::__1::vector, std::__1::basic_string<cha

Project: https://github.com/nlohmann/json.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6744749780238336 Project: json Fuzzer: libFuzzerjsonfuzzer-parsemsgpack Fuzz target binary: fuzzer-parsemsgpack Job Type: libfuzzerasanjson Platform Id: linux Crash Type:...

Google Project Zero Vulnerability Disclosure Grace Period

Google’s unwavering vulnerability disclosure deadlines are the latest chapter in a decades-long debate about how to best inform affected users that there’s a security problem with their software. Since the start of the year, Google’s 90-day clock has most notably ticked down to zero on a trio of...