Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks

Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=763 The LZMA specification says the following about the memory usage of decompression: "The size of the probability model counter arrays is calculated with the...

Avira - Heap Underflow Parsing PE Section Headers

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=765 One of the things you might expect an Antivirus engine to do reliably is parse PE files. However, after some simple testing with Avira, I found a heap underflow that is, writin...

Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=763 The LZMA specification says the following about the memory usage of decompression: "The size of the probability model counter arrays is calculated with the following formula:...

Comodo Antivirus - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile, LoadLibrary, etc. The emulator itself is located ...

Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=763 The LZMA specification says the following about the memory usage of decompression: "The size of the probability model counter arrays is calculated with the following formula: sizeofprobarrays = 1846 + 768 1 r rax=00000000000004...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows and a very small buffer is allocated. The document FAT is then memcpy'd onto t...

Comodo - PackMan Unpacker Insufficient Parameter Validation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=764 Packman is an obscure opensource executable packer that Comodo Antivirus attempts to unpack during scanning. The code is available online here: http://packmanpacker.sourceforge.net/ If the compression method is set to algorithm...

UBUNTU-CVE-2016-0818

The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to...

More than 1 Million Websites Install Free SSL Certificate (and Counting...)

Let's Encrypt has achieved another big milestone by issuing 1 million free Transport Layer Security TLS SSL Certificates to webmasters who wish to secure the communications between their users and domains. Let's Encrypt – operated by the Internet Security Research Group ISRG – is an absolutely...

Fedora 23 : abrt-2.7.0-2.fc23 / libreport-2.6.3-1.fc23 (2015-cc585b503f)

Security fix for CVE-2015-5302 abrt-2.7.0-2.fc23 - Fix broken problem details in abrt-cli/gnome-abrt abrt-2.7.0-1.fc23 - cli-ng: initial - bodhi: introduce wrapper for 'reporter-bugzilla -h' and 'abrt-bodhi' - handle-event: remove obsolete workaround - remove 'not needed' code - doc: change...

Apple Files Motion to Vacate Court Order to Unlock iPhone

It took Apple nine words to make its point: “This is not a case about one isolated iPhone.” Apple on Thursday filed a motion to vacate a court order mandating it assist the FBI in unlocking an iPhone belonging to the San Bernardino shooter. Apple said the order violates its First Amendment...

USN-2913-1 ca-certificates update

The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 20160104 package, including the removal of the SPI CA and CA certificates with 1024-bit RSA keys...

CVE-2014-0292

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue requiring a CVE ID. Notes: none...

USN-2903-1 nss vulnerability

Hanno Böck discovered that NSS incorrectly handled certain division functions, possibly leading to cryptographic weaknesses. CVE-2016-1938 This update also refreshes the NSS package to version 3.21 which includes the latest CA certificate bundle, and removes the SPI CA...

CVE-2015-7408

The server in IBM Spectrum Protect aka Tivoli Storage Manager 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority...

Code injection

The server in IBM Spectrum Protect aka Tivoli Storage Manager 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority...

CVE-2015-7408

IBM Spectrum Protect (Tivoli Storage Manager) is affected by CVE-2015-7408. The server fails to properly restrict the ASNODENAME option, allowing a client session to proxy as another authorized session and read or write backup data. Affected server versions: 5.5, 6.x prior to 6.3.5.1, and 7.x pri...

CVE-2015-7408

The server in IBM Spectrum Protect aka Tivoli Storage Manager 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority...

Israeli Electric Authority Attacked, Potential Ransomware

Earlier this week Israel’s Electric Authority mitigated what officials there are calling a “severe cyber attack.” The Electric Authority is in charge of regulating and overseeing the distribution of electricity in Israel. The State of Israel’s National Infrastructure, Energy and Water Resources...