Stable Channel Update for Desktop

The stable channel has been updated to 81.0.4044.113 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

libspectre:spectre_read_fuzzer: Use-of-uninitialized-value in psscan

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5678076710354944 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzermsanlibspectre Platform Id: linux Crash Type:...

GitHub Security Lab: CPP: Out of order Linux permission dropping without checking return codes

This bug was reported directly to GitHub Security Lab...

The vulnerability of the apport operating system’s error registration service, related to deficiencies in access control, allows a malicious actor to create a publicly accessible report of the software bug for privileged processes.

The vulnerability of the apport system’s error reporting service in the Ubuntu operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to create a publicly accessible report of the software bug for privileged processes...

Internet Bug Bounty: Use of uninitialized value in ftp_getrc_msg method of mod_proxy_ftp.c

This is a Security Bug Report for modproxyftp. This bug is present in ftpgetrcmsg method of modules/proxy/modproxyftp.c file. This is the line which causes this bug. c ... mb = aprcpystrnmb, response + 4, me - mb; ... If ftp server returns a response like "\r\n", which has 3 characters with...

Internet Bug Bounty: mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full (CVE-2020-7065)

PHP bug report made public by the maintainers at the time of writing: https://bugs.php.net/bug.php?id=79371 Mitre CVE page: https://vulners.com/cve/CVE-2020-7065 Link to the release notes: https://www.php.net/ChangeLog-7.php7.4.4 Impact One of impacts is that the issue allows an attacker to...

suricata:fuzz_applayerparserparse: Heap-use-after-free in htp_chomp

Detailed Report: https://oss-fuzz.com/testcase?key=5651773898620928 Project: suricata Fuzzing Engine: honggfuzz Fuzz Target: fuzzapplayerparserparse Job Type: honggfuzzasansuricata Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x62a00000b4f9 Crash State: htpchomp...

ndpi:fuzz_ndpi_reader: Use-of-uninitialized-value in ndpi_strdup

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5112736746045440 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)

Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service PoC Exploit Title: Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service PoC Google Dork: N/A Date: 2020-02-21 Exploit Author: Cem Onat Karagun of Diesec GmBH Vendor Homepage: https://www.google.com/ Version:...

binutils:fuzz_disassemble: Use-of-uninitialized-value in loop_prim_n_bytes

Detailed Report: https://oss-fuzz.com/testcase?key=5652986874560512 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisassemble Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: loopprimnbytes decodes12z printinsns12...

c-ares:ares_parse_reply_fuzzer: Heap-double-free in ares_parse_soa_reply

Project: https://github.com/c-ares/c-ares.git Detailed Report: https://oss-fuzz.com/testcase?key=5637790584012800 Project: c-ares Fuzzing Engine: afl Fuzz Target: aresparsereplyfuzzer Job Type: aflasanc-ares Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x603000007f70 Crash State...

binutils:fuzz_bfd: Crash in setup_sections

Detailed Report: https://oss-fuzz.com/testcase?key=5698598596771840 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzbfd Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60703e3edcbe Crash State: setupsections somobjectp bfdcheckformatmatche...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in grk::BufferedStream::read

Detailed Report: https://oss-fuzz.com/testcase?key=5135412822802432 Project: grok Fuzzing Engine: honggfuzz Fuzz Target: grkdecompressfuzzer Job Type: honggfuzzasangrok Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x61a000006000 Crash State: grk::BufferedStream::read...

landkartenarchiv.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1112868 Security Researcher foulenzer Helped patch 132 vulnerabilities Received 3 Coordinated Disclosure badges Received 1 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting landkartenarchiv.de websit...

tout-macon.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1110405 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting tout-macon.fr website and...

connect.moip.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1107662 Security Researcher haxmov Helped patch 708 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting connect.moip.com.br website a...

plazza.ch Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1105636 Security Researcher geeknik Helped patch 8908 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting plazza.ch website and its...

libreoffice:xlsfuzzer: Heap-buffer-overflow in std::__1::unique_ptr<ScColumn, o3tl::default_delete<ScColumn> >::operator*

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5638823755382784 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: xlsfuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash...

Comtrend VR-3033 Command Injection

Timeline : Bug sent to vendor : 17-02-2020 No Response after 10 days Public disclosure: 27-02-020 The Comtrend VR-3033 is prone to Multiple Authenticated Command Injection vulnerability via ping and traceroute diagnostic page. Remote attackers are able to get full control and compromise the netwo...

radiologyinfo.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1101981 Security Researcher Gh05tPT Helped patch 6878 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting radiologyinfo.org websit...