php:php-fuzz-mbstring: Heap-use-after-free in optimize_nodes

Detailed Report: https://oss-fuzz.com/testcase?key=5688240959127552 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzerasani386php Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0xf52376a0 Crash State: optimizenodes optimizenodes...

Saudi Prince Allegedly Hacked World's Richest Man Jeff Bezos Using WhatsApp

The iPhone of Amazon founder Jeff Bezos, the world's richest man, was reportedly hacked in May 2018 after receiving a WhatsApp message from the personal account of Saudi crown prince Mohammed bin Salman, the Guardian newspaper revealed today. Citing unnamed sources familiar with digital forensic...

php:php-fuzz-mbstring: Use-of-uninitialized-value in node_min_byte_len

Detailed Report: https://oss-fuzz.com/testcase?key=4822305188610048 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: nodeminbytelen nodeminbytelen optimizenodes...

Microsoft Zero-Day Actively Exploited, Patch Forthcoming

An unpatched remote code-execution vulnerability in Internet Explorer is being actively exploited in the wild, Microsoft has announced. It’s working on a patch. In the meantime, workarounds are available. The bug CVE-2020-0674 which is listed as critical in severity for IE 11, and moderate for IE...

BitDam Study Exposes High Miss Rates of Leading Email Security Systems

Imagine receiving an email from US VP Mike Pence's official email account asking for help because he has been stranded in the Philippines. Actually, you don't have to. This actually happened. Pence's email was hacked when he was still the governor of Indiana, and his account was used to attempt t...

unicorn:fuzz_emu_arm_thumb: Crash in helper_wfe_arm

Project: https://github.com/unicorn-engine/unicorn.git Detailed Report: https://oss-fuzz.com/testcase?key=5139312127770624 Project: unicorn Fuzzing Engine: libFuzzer Fuzz Target: fuzzemuarmthumb Job Type: libfuzzermsanunicorn Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

Imperva Mitigates Exploits of Citrix Vulnerability – Right Out of the Box

On December 17, Citrix issued a Security Bulletin on an unauthenticated remote code execution vulnerability CVE-2019-19781 affecting its Citrix Application Delivery Controller ADC - formerly known as NetScaler ADC - and its Citrix Gateway - formerly known as NetScaler Gateway. At the time of the...

Microsoft Warns of Unpatched IE Browser Zero-Day That's Under Active Attacks

Internet Explorer is dead, but not the mess it left behind. Microsoft earlier today issued an emergency security advisory warning millions of Windows users of a new zero-day vulnerability in Internet Explorer IE browser that attackers are actively exploiting in the wild — and there is no patch ye...

Microsoft Warns of Unpatched IE Browser Zero-Day That's Under Active Attacks

Internet Explorer is dead, but not the mess it left behind. Microsoft earlier today issued an emergency security advisory warning millions of Windows users of a new zero-day vulnerability in Internet Explorer IE browser that attackers are actively exploiting in the wild — and there is no patch ye...

poppler:pdf_fuzzer: Use-of-uninitialized-value in BaseCryptStream::BaseCryptStream

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=5735911623229440 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target:...

ndpi:fuzz_ndpi_reader: Heap-buffer-overflow in get_ndpi_flow_info

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5746418505744384 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6060001f46fb...

Critical Windows Vulnerability Discovered by NSA

Yesterday's Microsoft Windows patches included a fix for a critical vulnerability in the system's crypto library. A spoofing vulnerability exists in the way Windows CryptoAPI Crypt32.dll validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by using a...

graphicsmagick:enhance_fuzzer: Heap-buffer-overflow in InsertRow

Detailed Report: https://oss-fuzz.com/testcase?key=5758629114544128 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: enhancefuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address: 0x7f3759afae04 Crash State: InsertRow...

unicorn:fuzz_emu_arm_armbe: Crash in helper_uc_tracecode

Project: https://github.com/unicorn-engine/unicorn.git Detailed Report: https://oss-fuzz.com/testcase?key=5737813991751680 Project: unicorn Fuzzing Engine: libFuzzer Fuzz Target: fuzzemuarmarmbe Job Type: libfuzzerasanunicorn Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000012...

Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware

Remote Code Execution Exploit CVE-2019-19781- Citrix Applica...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5642531954229248 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...

Critical Firefox 0-Day Under Active Attacks – Update Your Browser Now!

Attention! Are you using Firefox as your web browsing software on your Windows, Linux, or Mac systems? If yes, you should immediately update your free and open-source Firefox web browser to the latest version available on Mozilla's website. Why the urgency? Mozilla earlier today released Firefox...

Critical Firefox 0-Day Under Active Attacks – Update Your Browser Now!

Attention! Are you using Firefox as your web browsing software on your Windows, Linux, or Mac systems? If yes, you should immediately update your free and open-source Firefox web browser to the latest version available on Mozilla's website. Why the urgency? Mozilla earlier today released Firefox...

Google Ditches Patch-Time Bug Disclosure in Favor of 90-Day Policy

Google’s Project Zero bug-hunting team is making a big change to its vulnerability disclosure policies. Full details on any vulnerability will be made public 90 days after discovery, regardless of when the bug is fixed. That means that whether it’s patched on Day 20 or Day 120, bug details will g...

Mozilla Updates Firefox Browser: Zero-Day Bug Patched, Fingerprinting Nixed

UPDATE Mozilla patched a critical vulnerability actively being exploited in the wild with its latest update to the Firefox browser. Mozilla said in a security bulletin Wednesday that it was “aware of targeted attacks in the wild that were abusing the flaw. A successful attack “could make it...