Zero Day Initiative Bug Hunters Rake in $1.5M in 2019

Zero Day Initiative ZDI awarded more than $1.5 million in cash and prizes to bug-hunters throughout 2019, it said, resulting in 1,035 security vulnerability advisories for the year. Most of those advisories 88 percent were published in conjunction with a patch from the vendor, Zero Day Initiative...

qt:setMarkdown: Heap-use-after-free in QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::operator->

Project: git://code.qt.io/qt/qt5.git Detailed Report: https://oss-fuzz.com/testcase?key=5728348359884800 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: setMarkdown Job Type: libfuzzerasanqt Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6020000006d8 Crash State:...

Sprint Exposed Customer Support Site to Web

Fresh on the heels of a disclosure that Microsoft Corp. leaked internal customer support data to the Internet, mobile provider Sprint has addressed a mix-up in which posts to a private customer support community were exposed to the Web. KrebsOnSecurity recently contacted Sprint to let the company...

How to Clear Data Facebook Collects About You from Other Sites and Apps

Facebook is one of the world's biggest advertising platforms, and that's because it knows a lot about you, me, and everyone. Facebook uses many tools to track people across the Internet, whether they have an account with the social networking site or not, and most of them rely on the online...

Data privacy is about more than compliance—it’s about being a good world citizen

Happy Data Privacy Day! Begun in 2007 in the European Union E.U. and adopted by the U.S. in 2008, Data Privacy Day is an international effort to encourage better protection of data and respect for privacy. It’s a timely topic given the recent enactment of the California Consumer Privacy Act CCPA...

Embracing Data Privacy Day

January 28 is Data Privacy Day, commemorating the Council of Europe Treaty known as Convention 108, the first legally binding international treaty on data protection signed on January 28, 1981. This "holiday" was originally celebrated in Europe where it is known as Data Protection day. But in 200...

mysql-server:fuzz_real_query: Crash in net_field_length_size

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=5639359625953280 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzrealquery Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

graphicsmagick:coder_WPG_fuzzer: Heap-buffer-overflow in InsertRow

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5718137723158528 Project: graphicsmagick Fuzzing Engine: afl Fuzz Target: coderWPGfuzzer Job Type: aflasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Addres...

Online Holiday Shopping followed the Hot Topics of 2019: Mobile & Security

Here's what I learned this past holiday season: I'm not alone shopping on my mobile device on Christmas Day and Boxing Day. And while Hollywood actors may take the holidays off, threat actors certainly do not. Let's have a look at some of the numbers. Akamai has a lot of data, but let's look at...

Pwn2Own Miami Contestants Haul in $180K for Hacking ICS Equipment

The very first Pwn2Own hacking competition that exclusively focuses on the industrial control systems ICS has kicked off in Miami. So far, a total of $180,000 has been awarded for pwning five different products. The contest hosts at Trend Micro’s Zero Day initiative ZDI have allocated more than...

php:php-fuzz-mbstring: Heap-use-after-free in optimize_nodes

Detailed Report: https://oss-fuzz.com/testcase?key=5688240959127552 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzerasani386php Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0xf52376a0 Crash State: optimizenodes optimizenodes...

Saudi Prince Allegedly Hacked World's Richest Man Jeff Bezos Using WhatsApp

The iPhone of Amazon founder Jeff Bezos, the world's richest man, was reportedly hacked in May 2018 after receiving a WhatsApp message from the personal account of Saudi crown prince Mohammed bin Salman, the Guardian newspaper revealed today. Citing unnamed sources familiar with digital forensic...

php:php-fuzz-mbstring: Use-of-uninitialized-value in node_min_byte_len

Detailed Report: https://oss-fuzz.com/testcase?key=4822305188610048 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: nodeminbytelen nodeminbytelen optimizenodes...

Microsoft Zero-Day Actively Exploited, Patch Forthcoming

An unpatched remote code-execution vulnerability in Internet Explorer is being actively exploited in the wild, Microsoft has announced. It’s working on a patch. In the meantime, workarounds are available. The bug CVE-2020-0674 which is listed as critical in severity for IE 11, and moderate for IE...

BitDam Study Exposes High Miss Rates of Leading Email Security Systems

Imagine receiving an email from US VP Mike Pence's official email account asking for help because he has been stranded in the Philippines. Actually, you don't have to. This actually happened. Pence's email was hacked when he was still the governor of Indiana, and his account was used to attempt t...

unicorn:fuzz_emu_arm_thumb: Crash in helper_wfe_arm

Detailed Report: https://oss-fuzz.com/testcase?key=5139312127770624 Project: unicorn Fuzzing Engine: libFuzzer Fuzz Target: fuzzemuarmthumb Job Type: libfuzzermsanunicorn Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00000000e080 Crash State: helperwfearm Sanitizer: memory MSAN...

Imperva Mitigates Exploits of Citrix Vulnerability – Right Out of the Box

On December 17, Citrix issued a Security Bulletin on an unauthenticated remote code execution vulnerability CVE-2019-19781 affecting its Citrix Application Delivery Controller ADC - formerly known as NetScaler ADC - and its Citrix Gateway - formerly known as NetScaler Gateway. At the time of the...

Microsoft Warns of Unpatched IE Browser Zero-Day That's Under Active Attacks

Internet Explorer is dead, but not the mess it left behind. Microsoft earlier today issued an emergency security advisory warning millions of Windows users of a new zero-day vulnerability in Internet Explorer IE browser that attackers are actively exploiting in the wild — and there is no patch ye...

Microsoft Warns of Unpatched IE Browser Zero-Day That's Under Active Attacks

Internet Explorer is dead, but not the mess it left behind. Microsoft earlier today issued an emergency security advisory warning millions of Windows users of a new zero-day vulnerability in Internet Explorer IE browser that attackers are actively exploiting in the wild — and there is no patch ye...

poppler:pdf_fuzzer: Use-of-uninitialized-value in BaseCryptStream::BaseCryptStream

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=5735911623229440 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...