cras:rclient_message: Heap-buffer-overflow in surround51_to_stereo_downmix_mtx

Detailed Report: https://oss-fuzz.com/testcase?key=5731428137697280 Project: cras Fuzzing Engine: honggfuzz Fuzz Target: rclientmessage Job Type: honggfuzzasancras Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x6030000414bc Crash State: surround51tostereodownmixmtx...

CVE-2020-8034

Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting XSS vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webma...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in s_exD_process

Detailed Report: https://oss-fuzz.com/testcase?key=5769684738899968 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sexDprocess sreadbuf...

Linux 5.6 IORING_OP_MADVISE Race Condition

Linux 5.6 has an issue with IORINGOPMADVISE racing with coredumping. Linux 5.6: IORINGOPMADVISE races with coredumping Last year, I noticed that core dumping iterates over current-mm's VMA list without proper locking, under the assumption that the VMA list can not be modified externally. This...

pcapplusplus:FuzzTarget: Heap-buffer-overflow in pcpp::IPv6Extension::getExtensionLen

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5685520970809344 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerasanpcapplusplus Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

ghostscript:gstoraster_fuzzer: Crash in mem_mapped4_fill_rectangle

Detailed Report: https://oss-fuzz.com/testcase?key=5702235993669632 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000526dcdc Crash State: memmapped4fillrectangle...

libavif:avif_decode_fuzzer: Heap-buffer-overflow in dav1dFeedData

Project: https://github.com/AOMediaCodec/libavif.git Detailed Report: https://oss-fuzz.com/testcase?key=5631949457850368 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: avifdecodefuzzer Job Type: libfuzzerasanlibavif Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

sindikatvatrogasaca.org.rs Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1146762 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting sindikatvatrogasaca.org.rs...

newbee.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1146656 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting newbee.com.br website and...

Stable Channel Update for Desktop

The stable channel has been updated to 81.0.4044.113 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

libspectre:spectre_read_fuzzer: Use-of-uninitialized-value in psscan

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5678076710354944 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzermsanlibspectre Platform Id: linux Crash Type:...

GitHub Security Lab: CPP: Out of order Linux permission dropping without checking return codes

This bug was reported directly to GitHub Security Lab...

The vulnerability of the apport operating system’s error registration service, related to deficiencies in access control, allows a malicious actor to create a publicly accessible report of the software bug for privileged processes.

The vulnerability of the apport system’s error reporting service in the Ubuntu operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to create a publicly accessible report of the software bug for privileged processes...

Internet Bug Bounty: Use of uninitialized value in ftp_getrc_msg method of mod_proxy_ftp.c

This is a Security Bug Report for modproxyftp. This bug is present in ftpgetrcmsg method of modules/proxy/modproxyftp.c file. This is the line which causes this bug. c ... mb = aprcpystrnmb, response + 4, me - mb; ... If ftp server returns a response like "\r\n", which has 3 characters with...

Internet Bug Bounty: mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full (CVE-2020-7065)

PHP bug report made public by the maintainers at the time of writing: https://bugs.php.net/bug.php?id=79371 Mitre CVE page: https://vulners.com/cve/CVE-2020-7065 Link to the release notes: https://www.php.net/ChangeLog-7.php7.4.4 Impact One of impacts is that the issue allows an attacker to...

suricata:fuzz_applayerparserparse: Heap-use-after-free in htp_chomp

Detailed Report: https://oss-fuzz.com/testcase?key=5651773898620928 Project: suricata Fuzzing Engine: honggfuzz Fuzz Target: fuzzapplayerparserparse Job Type: honggfuzzasansuricata Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x62a00000b4f9 Crash State: htpchomp...

ndpi:fuzz_ndpi_reader: Use-of-uninitialized-value in ndpi_strdup

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5112736746045440 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)

Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service PoC Exploit Title: Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service PoC Google Dork: N/A Date: 2020-02-21 Exploit Author: Cem Onat Karagun of Diesec GmBH Vendor Homepage: https://www.google.com/ Version:...

binutils:fuzz_disassemble: Use-of-uninitialized-value in loop_prim_n_bytes

Detailed Report: https://oss-fuzz.com/testcase?key=5652986874560512 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisassemble Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: loopprimnbytes decodes12z printinsns12...

c-ares:ares_parse_reply_fuzzer: Heap-double-free in ares_parse_soa_reply

Project: https://github.com/c-ares/c-ares.git Detailed Report: https://oss-fuzz.com/testcase?key=5637790584012800 Project: c-ares Fuzzing Engine: afl Fuzz Target: aresparsereplyfuzzer Job Type: aflasanc-ares Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x603000007f70 Crash State...