zeek:zeek-modbus-fuzzer: Heap-buffer-overflow in binpac::ModbusTCP::ModbusTCP_Flow::deliver_DiagnosticsRequest

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=5284863614517248 Project: zeek Fuzzing Engine: libFuzzer Fuzz Target: zeek-modbus-fuzzer Job Type: libfuzzerasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x602000a42cd...

zeek:zeek-smb-fuzzer: Heap-buffer-overflow in binpac::SMB::SMB_Conn::proc_smb2_set_info_request_file_fscontrol

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=4869737828188160 Project: zeek Fuzzing Engine: honggfuzz Fuzz Target: zeek-smb-fuzzer Job Type: honggfuzzasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60700225cd78...

zeek:zeek-packet-fuzzer: Heap-buffer-overflow in zeek::String::String

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=5556559643541504 Project: zeek Fuzzing Engine: libFuzzer Fuzz Target: zeek-packet-fuzzer Job Type: libfuzzerasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x60200099f873...

FreeBSD : bro -- NULL pointer dereference and Signed integer overflow (f56669f5-d799-4ff5-9174-64a6d571c451)

Jon Siwek of Corelight reports : This is a security patch release to address potential Denial of Service vulnerabilities : - NULL pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. - Signed integer overflow in BinPAC-generat...

bro -- Null pointer dereference and Signed integer overflow

Jon Siwek of Corelight reports: This is a security patch release to address potential Denial of Service vulnerabilities: Null pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. Signed integer overflow in BinPAC-generated...

FreeBSD : bro -- Unsafe integer conversions can cause unintentional code paths to be executed (177fa455-48fc-4ded-ba1b-9975caa7f62a)

Jon Siwek of Corelight reports : The following Denial of Service vulnerabilities are addressed : - Integer type mismatches in BinPAC-generated parser code and Bro analyzer code may allow for crafted packet data to cause unintentional code paths in the analysis logic to be taken due to unsafe...

bro -- Unsafe integer conversions can cause unintentional code paths to be executed

Jon Siwek of Corelight reports: The following Denial of Service vulnerabilities are addressed: Integer type mismatches in BinPAC-generated parser code and Bro analyzer code may allow for crafted packet data to cause unintentional code paths in the analysis logic to be taken due to unsafe integer...

bro -- array bounds and potential DOS issues

Corelight reports: Bro 2.5.5 primarily addresses security issues: Fix array bounds checking in BinPAC: for arrays that are fields within a record, the bounds check was based on a pointer to the start of the record rather than the start of the array field, potentially resulting in a buffer...

FreeBSD : bro -- multiple memory allocation issues (2f4fd3aa-32f8-4116-92f2-68f05398348e)

Corelight reports : Bro 2.5.4 primarily fixes security issues Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a...

CVE-2014-9586

The root cause of these vulnerabilities is a lack of bounds checking in protocol parsing C++ code emitted by the binpac utility...