golang-protobuf:textfuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4719499044192256 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: textfuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000055da Crash State: NULL Sanitizer: address ASAN...

golang-protobuf:textfuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5636435612008448 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: textfuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000004c00 Crash State: NULL Sanitizer: address ASAN...

Valve: Signedness issue in ClassInfo message handler leads to RCE on CS:GO client

Title: Signedness issue in ClassInfo message handler leads to RCE on CS:GO client Scope: csgo.exe Weakness: Array Index Underflow Severity: Critical 9.6 Link: https://hackerone.com/reports/876719 Date: 2020-05-17 20:31:35 +0000 By: @chaynik Details: Vulnerability ------------- CSVCMsgClassInfo...

golang-protobuf:wirefuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5652073511387136 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000059044a4 Crash State: NULL Sanitizer: address ASAN...

protobuf-compiler (1.0.20) potentially affected by CVE-2020-6802 via bleach (2.1.0)

bleach PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - protobuf-compiler 1.0.20 Source cves: CVE-2020-6802 Source advisory: OSV:GHSA-Q65M-PV3F-WR5R...

com.googlecode.protobuf-rpc-pro:protobuf-rpc-pro-demo (>=3.0.1, <=3.0.2), com.googlecode.protobuf-rpc-pro:protobuf-rpc-pro-duplex (>=3.0.1, <=3.0.2) +1 more potentially affected by CVE-2019-20445 via io.netty:netty (3.6.0.final)

io.netty:netty MAVEN version 3.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - com.googlecode.protobuf-rpc-pro:protobuf-rpc-pro-demo =3.0.1, =3.0.1, =3.0.2 - tv.cntt:xitrum2.10 1.13 Source cves:...

com.googlecode.protobuf-rpc-pro:protobuf-rpc-pro-duplex (>=1.2.2, <=1.2.3), com.googlecode.protobuf-rpc-pro:protobuf-streamer-pro (>=1.2.2, <=1.2.3) +39 more potentially affected by CVE-2019-20445 via io.netty:netty (3.4.6.final)

io.netty:netty MAVEN version 3.4.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - com.googlecode.protobuf-rpc-pro:protobuf-rpc-pro-duplex =1.2.2, =1.2.2, =1.2.3 - net.databinder:unfiltered-netty-server2.8.1...

golang-protobuf:jsonfuzz: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5153923757506560 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: jsonfuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: addre...

actix-protobuf (>=0.4.0, <=0.4.1), arc-cli (0.1.0) +106 more potentially affected by CVE-2020-35858 via prost (>=0.1.0, <=0.5.0)

prost CARGO version =0.1.0, =0.4.0, =0.8.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0-alpha, =0.1.0, =0.1.0, =0.8.0, =0.1.0-alpha.1, =0.1.0-alpha.2 and more Source cves: CVE-2020-35858 Source advisory: OSV:RUSTSEC-2020-0002...

SockPuppet: A Walkthrough of a Kernel Exploit for iOS 12.4

Posted by Ned Williamson, 20% on Project Zero Introduction I have a somewhat unique opportunity in this writeup to highlight my experience as an iOS research newcomer. Many high quality iOS kernel exploitation writeups have been published, but those often feature weaker initial primitives combine...

CVE-2019-15544

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

Design/Logic Flaw

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

CVE-2019-15544

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

CVE-2019-15544

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

CVE-2019-15544

The CVE-2019-15544 issue affects the protobuf crate for Rust (pre-2.6.0). The vulnerability arises from Vec::reserve being fed by user-supplied input, enabling memory exhaustion. Documented impact: Out-of-Memory conditions, potentially affecting affected Rust crates that rely on this protobuf imp...

CVE-2019-15544: Allocation of Resources Without Limits or Throttling

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

azure-functions (>=0.1.1, <=0.2.1), azure-functions-shared (0.2.2) +17 more potentially affected by CVE-2019-15544 via protobuf (>=2.0.2, <=2.5.0)

protobuf CARGO version =2.0.2, =0.1.1, =0.3.0, =0.4.0, =0.1.0, =0.3.0, =0.3.0, =0.3.0, =2.0.2, =2.0.2, =0.2.0, =2.0.2, =2.5.0 - protoc-rust-no-elision 2.0.4 and more Source cves: CVE-2019-15544 Source advisory: OSV:RUSTSEC-2019-0003...

auth (0.1.0), dat-network-protocol (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2019-15544 via protobuf (>=1.0.24, <=1.7.4)

protobuf CARGO version =1.0.24, =0.1.3, =0.3.1, =0.3.1, =1.7.2, =0.3.1, =0.0.1, =0.1.0, =0.1.2, =0.1.4 and more Source cves: CVE-2019-15544 Source advisory: OSV:RUSTSEC-2019-0003...

PT-2019-14260

Name of the Vulnerable Software and Affected Versions protobuf crate versions prior to 2.6.0 Description An issue in the protobuf crate allows attackers to exhaust all memory via Vec::reserve calls. This occurs because affected versions of the crate called Vec::reserve on user-supplied input,...

WhatsApp Flaw Lets Users Modify Group Chats to Spread Fake News

WhatsApp, the most popular messaging application in the world, has been found vulnerable to multiple security vulnerabilities that could allow malicious users to intercept and modify the content of messages sent in both private as well as group conversations. Discovered by security researchers at...