go-dns:fuzz_msg_unpack: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5674594752266240 Project: go-dns Fuzzing Engine: libFuzzer Fuzz Target: fuzzmsgunpack Job Type: libfuzzerasango-dns Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000003ee72 Crash State: NULL Sanitizer: address ASAN Recommended...

matio:matio_fuzzer: Crash in H5O_dtype_decode_helper

Detailed Report: https://oss-fuzz.com/testcase?key=5198181276319744 Project: matio Fuzzing Engine: afl Fuzz Target: matiofuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x618000010fb0 Crash State: H5Odtypedecodehelper H5Odtypeshareddecode H5Oattrshareddeco...

leptonica:pageseg_fuzzer: Heap-buffer-overflow in rasteropGeneralLow

Detailed Report: https://oss-fuzz.com/testcase?key=4707963964227584 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: pagesegfuzzer Job Type: libfuzzerasanleptonica Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x602000000478 Crash State: rasteropGeneralLow...

libzmq:socket_connect_fuzzer: Heap-buffer-overflow in zmq::tcp_read

Detailed Report: https://oss-fuzz.com/testcase?key=5414863269789696 Project: libzmq Fuzzing Engine: afl Fuzz Target: socketconnectfuzzer Job Type: aflasanlibzmq Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x625000013900 Crash State: zmq::tcpread...

Secure Your Global Remote Workforce

Update June 9, 2020: Qualys adds Malware Detection to Free 60-Day Remote Endpoint Protection offering. This post has been updated to reflect this new Malware Detection capability. IT organizations around the world are responding to the challenge posed by COVID-19 by ensuring that employees are ab...

Microsoft June Patch Tuesday Fixes 129 Flaws in Largest-Ever Update

Microsoft has released patches for 129 vulnerabilities as part of its June Patch Tuesday updates – the highest number of CVEs ever released by Microsoft in a single month. Within the blockbuster security update, 11 critical remote code-execution flaws were patched in Windows, SharePoint server,...

Microsoft Releases June 2020 Security Patches For 129 Vulnerabilities

Microsoft today released its June 2020 batch of software security updates that patches a total of 129 newly discovered vulnerabilities affecting various versions of Windows operating systems and related products. This is the third Patch Tuesday update since the beginning of the global Covid-19...

quickjs:fuzz_compile: Heap-buffer-overflow in js_parse_postfix_expr

Detailed Report: https://oss-fuzz.com/testcase?key=6261593842384896 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzcompile Job Type: libfuzzerasanquickjs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62c00003fd82 Crash State: jsparsepostfixexpr...

mysql-server:fuzz_initfile: Heap-use-after-free in Segment::write

Detailed Report: https://oss-fuzz.com/testcase?key=5758208359792640 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzinitfile Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x6080000134a8 Crash State: Segment::write...

China and Iran Tried to Hack the Biden and Trump Campaigns

Plus: An iOS zero day, surveillance planes, and more of the week's top security news...

leptonica:enhance_fuzzer: Use-of-uninitialized-value in convertRGBToHSV

Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=6235963591491584 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: enhancefuzzer Job Type: libfuzzermsanleptonica Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

poppler:pdf_fuzzer: Use-of-uninitialized-value in Splash::pipeRunSimpleXBGR8

Detailed Report: https://oss-fuzz.com/testcase?key=5659855921872896 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: Splash::pipeRunSimpleXBGR8 Splash::blitImage...

graphicsmagick:coder_WPG_fuzzer: Heap-buffer-overflow in InsertRow

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6005768108376064 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderWPGfuzzer Job Type: libfuzzerasani386graphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow WRIT...

njs:njs_process_script_fuzzer: Use-of-uninitialized-value in njs_vsprintf

Detailed Report: https://oss-fuzz.com/testcase?key=5124165974884352 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: njsvsprintf njserrorfmtnew...

Cycldek: Bridging the (air) gap

Key findings While investigating attacks related to a group named Cycldek post 2018, we were able to uncover various pieces of information on its activities that were not known thus far. In this blog post we aim to bridge the knowledge gap on this group and provide a more thorough insight into it...

pcapplusplus:FuzzTarget: Crash in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=4818312294039552 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

Apple Jailbreak Zero-Day Gets a Patch

Apple quietly pushed out a small but important update for operating systems across all of its devices, including a patch for a zero-day exploit used in an iPhone jailbreak tool released last week. In its notes for the release, Apple says very little else about the patches overall that it pushed o...

Windowsrcer IE/Edge Cross-URL vulnerabilities

Cross-Origin bugs in IE and Edge allow bypassing SOP in both browsers. 0-days released by James Lee @Windowsrcer Recent assessments: busterb at August 21, 2019 4:31pm UTC reported: A SOP bug requires the attacker to inject a resource into one domain, and be listening on another. Such a...

samba:fuzz_ndr_nbt_TYPE_STRUCT: Heap-buffer-overflow in ndr_push_bytes

Detailed Report: https://oss-fuzz.com/testcase?key=5631148570181632 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzzndrnbtTYPESTRUCT Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x608000000180 Crash State: ndrpushbytes...

Apple Pays $100K Bounty for Critical 'Sign in With Apple' Flaw

A researcher recently found a critical Apple vulnerability that, if exploited, could enable remote attackers to abuse the “Sign in with Apple” feature to take over victims’ third-party application accounts. The security researcher, Bhavuk Jain, reported the flaw to Apple via its bug bounty progra...