Kaspersky: Mo Unpackers, Mo Problems.

Posted by the notorious Tavis Ormandy. We’ve talked before about how we use Google scale to amplify our fuzzing efforts. I’ve recently been working on applying some of these techniques to Antivirus, a vast and highly privileged attack surface. Among the products I’m working on is Kaspersky...

Wfuzz - The Web Application Bruteforcer

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked directories, servlets, scripts, etc, bruteforce GET and POST parameters for checking different kind of injections SQL, XSS, LDAP,etc, bruteforce Forms parameters User/Password, Fuzzing,etc...

A buffer overflow vulnerability in the easy tutorial-vulnerability warning-the black bar safety net

This article is similar to the“dummies series use a buffer overflow”. In such vulnerability, our approach is the use of the network, the program Controller, input, etc., send large data buffer to the program, overwriting the program memory of the important part. In these buffer overwrite program...

DLA-308-1 bind9 - security update

Bulletin has no description...

chromium: multiple issues

CVE-2015-1291, CVE-2015-1293: Cross-origin bypass in DOM. - CVE-2015-1292: Cross-origin bypass in ServiceWorker. - CVE-2015-1294: Use-after-free in Skia. - CVE-2015-1295: Use-after-free in Printing. - CVE-2015-1296: Character spoofing in omnibox. - CVE-2015-1297: Permission scoping error in...

Flash - PCRE Regex Compilation Zero-Length Assertion Arbitrary Bytecode Execution

Flash - PCRE Regex Compilation Zero-Length Assertion Arbitrary Bytecode Execution Source: https://code.google.com/p/google-security-research/issues/detail?id=224&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There’s an error in the PCRE engine version used in Flash that...

Adobe Flash - Pointer Crash in Drawing and Bitmap Handling

Adobe Flash - Pointer Crash in Drawing and Bitmap Handling Source: https://code.google.com/p/google-security-research/issues/detail?id=396&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id A nasty looking crash is manifesting in various different ways under fuzzing, apparentl...

Adobe Flash - Out-of-Bounds Read in UTF Conversion

Adobe Flash - Out-of-Bounds Read in UTF Conversion Source: https://code.google.com/p/google-security-research/issues/detail?id=378&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id We've hit the same bug from two different avenues: 1 A report to the Chromium bug tracker:...

SUSE-SU-2015:1420-1 Security update for tiff

tiff was updated to fix six security issues found by fuzzing initiatives. These security issues were fixed: - CVE-2014-8127: Out-of-bounds write bnc914890. - CVE-2014-8128: Out-of-bounds write bnc914890. - CVE-2014-8129: Out-of-bounds write bnc914890. - CVE-2014-8130: Out-of-bounds write bnc91489...

Pupils with EasyFuzzer 1.0 mining software vulnerabilities-vulnerability warning-the black bar safety net

EasyFuzzer is a new fuzzing tool. Currently only supports the file format of the fuzzy test. Features: easy, streamlined, efficient, and intelligent. Easy: very easy to use, does not need any configuration. With his elementary students can also dig vulnerability, don't worry there is no 0day...

Android Stagefright Flaws Put 950 Million Devices at Risk

Vulnerabilities discovered in the Stagefright media playback engine that is native to Android devices could be the mobile world’s equivalent to Heartbleed. Almost all Android devices contain the security and implementation issues in question; unpatched devices are at risk to straightforward attac...

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives

Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee)

Google Chrome Releases reports : 43 security fixes in this release, including : - 446032 High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer. - 459215 High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft. - 461858 High CVE-2015-1274: Settings allowed...

Google Chrome < 44.0.2403.89 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities as referenced in the 201507stable-channel-update21 advisory. - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore ...

Python for Security Professionals: Free IT Security Training

Python is an excellent programming language that has rapidly become popular among Hackers, Reverse engineers, software testers, Forensic analyst and Penetration testers. Python is a simple object-oriented and minimalistic language that is easy to learn for novice programmers as well as experience...

General Purpose Fuzzing: Honggfuzz

Honggfuzz is a general-purpose fuzzing tool. Given a starting corpus of test files, Hongfuzz supplies and modifies input to a test program and utilize the ptrace API / POSIX signal interface to detect and log crashes. Features Easy setup : No complicated configuration files or setup necessary —...

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives.

Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

kppw 最新版注入(有点奇葩)

简要描述： 人生第一发代码审计 详细说明： 首先给厂商说句抱歉，测试demo的时候把demo搞挂了 漏洞文件:control/ajax/balance.php 看代码 $arrSellerInfo = dbfactory::getonesprintf'select from %s a left join %s b on a.uid = b.uid where a.uid =%s',TABLEPRE.'witkeyspace',TABLEPRE.'witkeyshop',intval$id; if$arrSellerInfo'shopbackstyle' $arrBackgroudStyl...

Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 42.0.2311.135 fixes security issues: a use-after-free in DOM CVE-2015-1243, and various fixes from internal audits, fuzzing and other initiatives CVE-2015-1250...

MGASA-2015-0182 Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 42.0.2311.135 fixes security issues: a use-after-free in DOM CVE-2015-1243, and various fixes from internal audits, fuzzing and other initiatives CVE-2015-1250...