cryptofuzz/cryptofuzz-openssl: Heap-buffer-overflow in aria_set_encrypt_key

Project: https://github.com/guidovranken/cryptofuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5654646873391104 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-openssl Fuzz target binary: cryptofuzz-openssl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type:...

Rockwell Automation Arena Simulation Software (Update B)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Low skill level to exploit Vendor: Rockwell Automation Equipment: Arena Simulation Software --------- Begin Update B Part 1 of 2 --------- Vulnerabilities: Use After Free, Information Exposure, Type Confusion, Insufficient UI Warning of Dangerous...

BSA-2019-840

Security Advisory ID : BSA-2019-840 Component : VxWorks Revision : 1.0: Initial The Armis research team, Armis Labs, have discovered 11 zero day vulnerabilities in VxWorks®. VxWorks is used by over 2 billion devices including critical industrial, medical and enterprise devices. Dubbed “URGENT/11,...

Critical Flaws Found in VxWorks RTOS That Powers Over 2 Billion Devices

Security researchers have discovered almost a dozen zero-day vulnerabilities in VxWorks, one of the most widely used real-time operating systems RTOS for embedded devices that powers over 2 billion devices across aerospace, defense, industrial, medical, automotive, consumer electronics, networkin...

Critical Flaws Found in VxWorks RTOS That Powers Over 2 Billion Devices

Security researchers have discovered almost a dozen zero-day vulnerabilities in VxWorks, one of the most widely used real-time operating systems RTOS for embedded devices that powers over 2 billion devices across aerospace, defense, industrial, medical, automotive, consumer electronics, networkin...

Microsoft Announces Top Contributing Partners in the Microsoft Active Protections Program (MAPP)

Today we announce the top organizational candidates for Vulnerability Top Contributors, Threat Indicator Top Submitters, and Zero-Day Top Reporting for the period of July 1, 2018 – June 30, 2019. The Microsoft Active Protections Program provides security and protection to customers through...

Amazon Prime Day is Now a Major Holiday, Driving up Traffic by More Than 14% in the U.S.

For the just-completed Amazon Prime Day a full 48 hours this year, published reports indicate that it was the largest shopping event in Amazon's history, exceeding their own 2018 sales for both Black Friday and Cyber Monday combined. And this year, there were more than 250 other retailers that...

Microsoft Announces Top Contributing Partners in the Microsoft Active Protections Program (MAPP)

Today we announce the top organizational candidates for Vulnerability Top Contributors, Threat Indicator Top Submitters, and Zero-Day Top Reporting for the period of July 1, 2018 – June 30, 2019. The Microsoft Active Protections Program provides security and protection to customers through...

Microsoft Announces Top Contributing Partners in the Microsoft Active Protections Program (MAPP)

Today we announce the top organizational candidates for Vulnerability Top Contributors, Threat Indicator Top Submitters, and Zero-Day Top Reporting for the period of July 1, 2018 – June 30, 2019. The Microsoft Active Protections Program provides security and protection to customers through...

New 3-Second DDoS Mitigation SLA is 3x Faster and the Industry’s Best

Back in 2018, we made waves with a groundbreaking DDoS Mitigation SLA service level agreement for our DDoS Protection service that guaranteed to mitigate DDoS attacks in under 10 seconds. Now, we’ve upped the ante to ensure DDoS attack mitigation with a new, industry-best three seconds-or-less...

qpdf/dct_fuzzer: Use-of-uninitialized-value in ycck_cmyk_convert

Project: https://github.com/qpdf/qpdf.git Detailed report: https://oss-fuzz.com/testcase?key=5632990870241280 Project: qpdf Fuzzer: libFuzzerqpdfdctfuzzer Fuzz target binary: dctfuzzer Job Type: libfuzzermsanqpdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...

openthread/ncp-uart-received-fuzzer: Stack-buffer-overflow in ot::NetworkData::Leader::IsStableUpdated

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5630599882080256 Project: openthread Fuzzer: libFuzzeropenthreadncp-uart-received-fuzzer Fuzz target binary: ncp-uart-received-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash...

imagemagick/encoder_eps_fuzzer: Stack-buffer-overflow in ConstantString

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5726208135790592 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderepsfuzzer Fuzz target binary: encoderepsfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

Meet IRpair & Phantom; powerful anti-facial recognition glasses

By Uzair Amir IRpair and Phantom are the first-ever collections of anti-facial recognition glasses and sunglasses designed to block facial recognition, eye tracking & infrared radiation including 3D IR surveillance cameras during both day and night. Facial recognition technology is the single...

imagemagick/encoder_bmp_fuzzer: Use-of-uninitialized-value in cmsMLUgetASCII

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5742789528125440 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderbmpfuzzer Fuzz target binary: encoderbmpfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

libsass/data_context_fuzzer: Heap-buffer-overflow in std::__1::vector<std::__1::vector<Sass::SharedImpl<Sass::ComplexSelector>, std::

Project: https://github.com/sass/libsass.git Detailed report: https://oss-fuzz.com/testcase?key=5161915090731008 Project: libsass Fuzzer: libFuzzerlibsassdatacontextfuzzer Fuzz target binary: datacontextfuzzer Job Type: libfuzzerasanlibsass Platform Id: linux Crash Type: Heap-buffer-overflow READ...

freeimage/load_from_memory_fuzzer: Heap-buffer-overflow in _MemoryReadProc

Detailed report: https://oss-fuzz.com/testcase?key=5088386304442368 Project: freeimage Fuzzer: aflfreeimageloadfrommemoryfuzzer Fuzz target binary: loadfrommemoryfuzzer Job Type: aflasanfreeimage Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 6 Crash Address: 0x6140000001f8 Crash State...

jsonnet/convert_jsonnet_fuzzer: Crash in Interpreter::evaluate

Project: https://github.com/google/jsonnet.git Detailed report: https://oss-fuzz.com/testcase?key=5706027058593792 Project: jsonnet Fuzzer: libFuzzerjsonnetconvertjsonnetfuzzer Fuzz target binary: convertjsonnetfuzzer Job Type: libfuzzerubsanjsonnet Platform Id: linux Crash Type: UNKNOWN READ Cra...

A week in security (July 8 – 14)

Last week on Malwarebytes Labs, we looked at ways to send your sensitive information in a secure fashion, examined some tactics in incident response land, and explored federal data privacy law. We also looked at how security tools can turn against you, and took a deep dive into the rather fiendis...

imagemagick/ping_epi_fuzzer: Heap-buffer-overflow in ReadPSInfo

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5753467974451200 Project: imagemagick Fuzzer: libFuzzerimagemagickpingepifuzzer Fuzz target binary: pingepifuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...