json: Use-of-uninitialized-value in __gxx_personality_v0

Project: https://github.com/nlohmann/json.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5830738947604480 Project: json Fuzzer: libFuzzerjsonparseaflfuzzer Fuzz target binary: parseaflfuzzer Job Type: libfuzzermsanjson Platform Id: linux Crash Type:...

ffmpeg: Stack-buffer-overflow in decode_zbuf

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4529672557690880 Project: ffmpeg Fuzzer: libFuzzerffmpegVIDEOAVCODECIDPNGfuzzer Fuzz target binary: ffmpegVIDEOAVCODECIDPNGfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Cras...

file: Attempting free in apprentice_map

Project: https://github.com/file/file.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5095269284708352 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Attempting free Crash Address...

libreoffice: Heap-buffer-overflow in MetaTextArrayAction::MetaTextArrayAction

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5024791991943168 Project: libreoffice Fuzzer: libFuzzerlibreofficesvmfuzzer Fuzz target binary: svmfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

CVE-2016-9273

tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via a crafted file, related to changing tdnstrips in TIFFSTRIPCHOP mode...

Internet Bug Bounty: Type Confusion in Object Deserialization

The bug report at: https://bugs.php.net/bug.php?id=72731...

Internet Bug Bounty: Use After Free in unserialize()

The bug report at: https://bugs.php.net/bug.php?id=69425...

shopify-scripts: SIGSEGV - mrb_vm_exec - vm.c in line:1272

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1272.rb: a,a,a,a=0,def e end a Sandbox: ------------------- x@x:/Desktop/research/mruby-engine/bin$ ./sandbox testmrbvmexec1272.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000018 ruby 2.2.6p396 2016-11-...

Internet Bug Bounty: Use of uninitialized memory in unserialize()

The following is a copy of the bug report at https://bugs.php.net/bug.php?id=73832 Description There was found a bug showing that PHP uses uninitialized memory during calls to unserialize. As the following report shows, the payload supplied to unserialize may control this uninitialized memory...

libreoffice: Heap-buffer-overflow in tools::Polygon::Insert

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6633131901714432 Project: libreoffice Fuzzer: libFuzzerlibreofficewmffuzzer Fuzz target binary: wmffuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

Internet Bug Bounty: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow

bug report at: https://bugs.php.net/bug.php?id=73331 fix commit at: https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00d...

Internet Bug Bounty: crash in get_icu_value_internal function

https://bugs.php.net/bug.php?id=73378...

Internet Bug Bounty: Use-after-free in unserialize()

The bug report at: https://bugs.php.net/bug.php?id=73147 The fix commit at: https://github.com/php/php-src/commit/0e6fe3a4c96be2d3e88389a5776f878021b4c59f...

Internet Bug Bounty: heap overflow in php_ereg_replace function

https://bugs.php.net/bug.php?id=73284...

CVE-2016-6494

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files...

Internet Bug Bounty: Missing type check when unserializing SplArray

https://bugs.php.net/bug.php?id=73029 Please feel free to ask for more technical details if necessary. Thank you for your consideration...

Internet Bug Bounty: Memory Corruption in During Deserialized-object Destruction

The bug report at: https://bugs.php.net/bug.php?id=73052 The fix commit at: https://github.com/php/php-src/commit/6a7cc8ff85827fa9ac715b3a83c2d9147f33cd43...

Internet Bug Bounty: integer overflow in fgets cause heap corruption

Please check: https://bugs.php.net/bug.php?id=73011...

LastPass Patches Ormandy Remote Compromise Flaw

LastPass has patched a vulnerability in its Firefox add-on found by Google Project Zero researcher Tavis Ormandy that allows attackers complete remote compromise of the password manager, . The divisive Ormandy submitted a bug report on Tuesday to LastPass after a series of tweets hinting at serio...

Gratipay: prevent null bytes in email field

Hi, Zawad here. Description I recently visited gratipay.com and logged in. I found that invalid characters eg. null bytes were accepted in email field, which is obviously not an expected behavior. Steps to Reproduce 1. Go to https://gratipay.com/username/emails/ 2. Enter [email protected]\0 or...