Out of bounds memory write while processing Vorbis audio data — Mozilla

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms.Update: The 52.7.2 source release accidentally di...

UBUNTU-CVE-2018-5146

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox 59.0.1, Firefox ESR 52.7.2, and Thunderbird 52.7...

mozilla -- multiple vulnerabilities

The Mozilla Foundation reports: CVE-2018-5146: Out of bounds memory write in libvorbis An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. CVE-2018-5147: Out of bounds memory write in libtremor The libtremor library has the same flaw as...

Sharing research and discoveries at PWN2OWN

The annual PWN2OWN exploit contest at the CanSecWest conference in Vancouver, British Columbia, Canada, brings together some of the top security talent from across the globe in a friendly competition. For the participants, these events are a platform to demonstrate world-class skills and vie for...

A View of Upcoming Threat Coverage from Pwn2Own 2018

This blog will be updated throughout the competition so keep tracking for the latest updates on upcoming threat coverage! St. Patrick’s Day is coming up later this week, but the contestants at Pwn2Own 2018 will need more than luck on their side. They will need to dive into their expert hacking...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 26, 2018

Pwn2Own 2018 is coming up in a couple of weeks and I am excited to see what interesting vulnerabilities will pop up at the contest. I attempted to explain the contest to my mom, and in the simplest terms, I told her that Pwn2Own is a contest where contestants are rewarded for breaking something...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 22, 2018

Yesterday, the Zero Day Initiative ZDI announced the dates and contest rules for Pwn2Own 2018. Last year, we celebrated the 10th anniversary of the event and the 11th year is going to be bigger than ever! Pwn2Own will be returning to Vancouver, BC, at the CanSecWest Conference on March 14-16, 201...

January 26, 2018 – Morning Cyber Coffee Headlines – “Friday” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 26, 2018 - Headlines Carbon Black in the News: New infosec products of...

Mobile Pwn2Own: Hackers pwn iPhone, Huawei, Galaxy and Pixel Phone

By Waqas At the Mobile Pwn2Own competition 2017, white hat hackers managed This is a post from HackRead.com Read the original post: Mobile Pwn2Own: Hackers pwn iPhone, Huawei, Galaxy and Pixel Phone...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 30, 2017

Competition is inherent in our DNA. At a basic level, we compete for things like water and food. We also take it up a level and compete for wealth, fame and power. Some compete to be the best in sports, like my Houston Astros winning the 2017 World Series, and others compete to be the best in the...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Chain of 11 Bugs Takes Down Galaxy S8 at Mobile Pwn2Own

The mobile version of the annual Pwn2Own contest wrapped up today in Tokyo with an unprecedented attack chain leveling the Samsung Galaxy S8. Researchers from MWR Labs used 11 vulnerabilities across six different mobile applications to execute code on Samsung’s flagship device and exfiltrate data...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 23, 2017

Just like Bugs Bunny wears disguises to avert his enemies, there’s another “wascally” rabbit causing trouble in the form of ransomware. Bad Rabbit is the latest ransomware campaign hitting Eastern European countries with what looks like a variant of the Petya/NotPetya ransomware. Bad Rabbit sprea...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of August 28, 2017

The only topic I can bring up this week is the devastation in Texas caused by Hurricane Harvey. Many cities have been completely destroyed and to add insult to injury, Harvey moved back to the Gulf of Mexico and made landfall again in Louisiana. Catastrophic flooding has left tens of thousands...

Microsoft Patches Critical Windows Search Vulnerability

Microsoft patched more than two dozen remote code execution vulnerabilities today, many of them rated critical. One was a RCE bug that allowed an attacker to take complete control of a server or workstation via Windows Search. The fixes were part of Microsoft’s August Patch Tuesday update that...

Vmware virtual machine escape Vulnerability CVE-2017-4901）Exploit code analysis and use-vulnerability and early warning-the black bar safety net

0×01 event analysis 2017 7 on 19 unamer in its github released a for Vmware virtual machine escape exploit source code, using C++. The alleged impact of Vmware Workstation 12.5.5 the previous version, and gives a demonstration of the process, to achieve a from the virtual machine to the host...

Pwn2own vulnerabilities share the series: the use of the macOS kernel vulnerability to escape the Safari sandbox-vulnerability warning-the black bar safety net

In the Pwn2own 2017 game, Apple macOS Sierra and Safari 10 become is attack up one of the goals. In this competition process, although there are multi-branched clan successfully/semi-successfully completed on macOS + Safari target compromised, however 360 security team use exploits the minimum...

The use of the macOS kernel vulnerability to escape the Safari sandbox-vulnerability warning-the black bar safety net

In the Pwn2own 2017 game, Apple macOS Sierra and Safari 10 become is attack up one of the goals. In this competition process, although there are multi-branched clan successfully/semi-successfully completed on macOS + Safari target compromised, however 360 security team use exploits the minimum...

Apple Patches Pwn2Own Vulnerabilities in Safari, macOS, iOS

Apple fixed 66 vulnerabilities across seven product lines, including Safari, iTunes, macOS, and iOS, on Monday. Many of the fixes – especially in macOS and Safari – resolve vulnerabilities uncovered at Pwn2Own, the hacking contest held at CanSecWest each year. Contestants collectively earned...

(Pwn2Own) Apple macOS WindowServer _XGetConnectionPSN Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...