postgis: Heap-buffer-overflow in ptarray_from_wkb_state

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed report: https://oss-fuzz.com/testcase?key=6439724333924352 Project: postgis Fuzzer: libFuzzerpostgiswkbimportfuzzer Fuzz target binary: wkbimportfuzzer Job Type: libfuzzerasanpostgis Platform Id: linux Crash Type:...

Network OSINT Gathering Tool: XRay

XRay is a tool for network OSINT gathering, its goal is to make some of the initial tasks of information gathering and network mapping automatic. How Does it Work? XRay is a very simple tool, it works this way: 1. It’ll bruteforce subdomains using a wordlist and DNS requests. 2. For every...

gnutls: Use-of-uninitialized-value in nettle_pkcs1_encrypt

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=6091382018015232 Project: gnutls Fuzzer: libFuzzergnutlsclientfuzzer Fuzz target binary: gnutlsclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

dlplibs: Container-overflow in libvisio::VSDContentCollector::_generateBezierSegmentsFromNURBS

Detailed report: https://oss-fuzz.com/testcase?key=6337251178971136 Project: dlplibs Fuzzer: libFuzzerdlplibsvsdfuzzer Fuzz target binary: vsdfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Container-overflow READ 8 Crash Address: 0x606000000590 Crash State:...

Legislation to Strengthen IoT Marketplace Transparency

Senator Ed Markey D-MA is poised to introduce legislation to develop a voluntary cybersecurity standards program for the Internet of Things IoT. The legislation, called the Cyber Shield Act, would enable IoT products that comply with the standards to display a label indicating a strong level of...

gdal: Heap-buffer-overflow in NTFFileReader::ProcessAttRec

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4504076375031808 Project: gdal Fuzzer: aflgdalogrfilesystemfuzzer Fuzz target binary: ogrfilesystemfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

ffmpeg: Stack-use-after-return in put_h264_qpel8_hv_lowpass_9

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=4870171724349440 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDH264fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Stack-use-after-return READ 2 Crash Address: 0x7f3acd5b01a0 Crash...

pcre2: Global-buffer-overflow in compare_opcodes

Project: svn://vcs.exim.org/pcre2/code/trunk https://github.com/PCRE2Project/pcre2.git Detailed report: https://oss-fuzz.com/testcase?key=6674380245434368 Project: pcre2 Fuzzer: libFuzzerpcre2fuzzer Fuzz target binary: pcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type:...

FTC Releases Announcement on Identity Theft

The Federal Trade Commission FTC recommends that consumers who are affected by identity theft file a report at IdentityTheft.gov—a one-stop resource to help you report and recover from identity theft. Information provided there includes checklists, sample letters, and links to other resources...

Fedora 24 : fedmsg (2017-a73bc7ac5d)

Fix validation logic in the base consumer The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the validatesignatures switch. There was a bug here where the default value provided in the base class made it appear as ...

Fedora 25 : fedmsg (2017-fff6e1af37)

Fix validation logic in the base consumer The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the validatesignatures switch. There was a bug here where the default value provided in the base class made it appear as ...

FCC takes initiative to Speed Up Mobile Security Updates

In Brief The Smartphone users are fed up with slow security updates, so two United States federal agencies have launched an official inquiry to know how manufacturers and carriers deal with mobile phone security updates and what they are doing to roll out patches as quickly as possible. The...

Samsung Get Sued for Failing to Update its Smartphones

One of the world's largest smartphone makers is being sued by the Dutch Consumers' Association DCA for its lack in providing timely software updates to its Android smartphones. This doesn't surprise me, though. The majority of manufacturers fail to deliver software updates for old devices for...

IC3 Releases Alert on Microchip-Enabled Credit Cards

The Internet Crime Complaint Center IC3 has issued an alert to consumers and merchants about the security risks involved with EMV Cards. An EMV card is a credit or debit card with a microchip that helps protect cardholder data. However, EMV cards may still be vulnerable to exploitation. US-CERT...

Government Asks for Security Community's Help on Technical Issues

LAS VEGAS–Washington is looking for a few good hackers. Politicians and policymakers in the United States generally are not thought of as being the most technically savvy lot. It’s a reputation that’s well-earned in some cases, with some politicians boasting about their inability to use email and...

[SECURITY] [DSA 3100-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3100-1 [email protected] http://www.debian.org/security/ Sebastien Delafond December 12, 2014 http://www.debian.org/security/faq -...

FTC Hires Privacy Researcher Ashkan Soltani as Chief Technologist

The FTC has hired Ashkan Soltani, a highly regarded and respected technologist and privacy researcher, as its chief technologist. The move is the latest in a string of interesting hires by the Federal Trade Commission. In 2009 the agency hired Chris Soghoian, a privacy and security researcher, as...

PayPal Service Manager Script Insertion

Document Title: =============== PayPal Inc Bug Bounty 71 PPM - Persistent Filter Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=870 PayPal Security UID: Roc83bl Release Date: ============= 2014-09-24 Vulnerability Laboratory ID VL-ID:...

Heartbleed Aftershocks: Community Health Systems Breach, 4.5 Million Records Lost

The news this week that hackers from China compromised 4.5 million customer records held by Community Health Systems is just the latest indication that companies are not adequately protecting the information of the consumers they serve...

Carberp Source Code Leaked

The source code for the Carberp Trojan, which typically sells for $40,000 on the underground, has been leaked and is now available to anyone who wants it. The leak has echoes of the release of the Zeus crimeware source code a couple of years ago and has security researchers concerned that it may...