Staying Safe in the Era of Browser-based Cryptocurrency Mining

Qualys Malware Research Labs is announcing the release of Qualys BrowserCheck CoinBlocker Chrome extension to detect and block browser-based cryptocurrency mining, aka cryptojacking. Cryptojacking Cryptojacking attacks leverage the victim system’s resources via malicious JavaScript to mine certai...

bloaty/fuzz_target: Global-buffer-overflow in bloaty::wasm::Section::Read

Project: https://github.com/google/bloaty.git Detailed report: https://oss-fuzz.com/testcase?key=5887976193130496 Project: bloaty Fuzzer: aflbloatyfuzztarget Fuzz target binary: fuzztarget Job Type: aflasanbloaty Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address:...

WebAssembly Changes Could Ruin Meltdown/Spectre Browser Patches

Upcoming changes to the WebAssembly Wasm format may defang the browser patches for infamous side-channel attacks Meltdown and Spectre. Wasm was invented to improve execution speed for porting desktop applications to web-based environments; programs are compiled in Wasm and then can easily be run ...

CVE-2018-11378

The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file...

CVE-2018-11378

The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file...

Design/Logic Flaw

The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file...

CVE-2018-11378

The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file...

UBUNTU-CVE-2018-11378

The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file...

CVE-2018-11378

The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file...

CVE-2018-11378

The wasmdis function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file...

CVE-2018-11378

RADARE2 before version 2.6.0-1 is affected by CVE-2018-11378 due to a stack-buffer overflow in wasm_dis() in libr/asm/arch/wasm/wasm.c, which may lead to denial-of-service or other unspecified impact via a crafted WASM file. The Arch Linux advisory ASA-201806-2 documents this alongside other CVEs...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Safari

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR L...

spidermonkey: Heap-buffer-overflow in js::wasm::Table::set

Detailed report: https://oss-fuzz.com/testcase?key=6489859028942848 Project: spidermonkey Fuzzer: jsfuzzer Job Type: asanspidermonkey Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6110001d0fc8 Crash State: js::wasm::Table::set js::WasmTableObject::setImpl...

llvm/llvm-dwarfdump-fuzzer: Crash in llvm::object::WasmObjectFile::parseDataSection

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=4546851673997312 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: UNKNOWN READ Crash...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

Stack overflow

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15368

CVE-2017-15368 affects radare2 2.0.0: the wasm_dis function (libr/asm/arch/wasm/wasm.c) is exploitable via a crafted WASM file and can cause a stack-based buffer over-read, leading to a denial of service (application crash) and potentially other impact due to an incorrect r_hex_bin2str call. Reme...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...