ffmpeg:ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer: Global-buffer-overflow in parse_band_ext

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5709394985091072 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDATRAC9fuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer: Heap-buffer-overflow in decodeplane8

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5718556033679360 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDIFFILBMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address...

graphicsmagick:coder_MNG_fuzzer: Heap-buffer-overflow in ReadMNGImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6322015271387136 Project: graphicsmagick Fuzzing Engine: afl Fuzz Target: coderMNGfuzzer Job Type: aflasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Addres...

cryptofuzz:cryptofuzz-openssl-noasm: Use-of-uninitialized-value in EVP_DecryptUpdate

Detailed Report: https://oss-fuzz.com/testcase?key=5736062923571200 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: EVPDecryptUpdate...

Tianfu Cup Round-Up: Safari, Chrome, D-Link Routers and Office 365 Successfully Hacked

Hackers over the weekend successfully compromised widely used software and hardware–including browsers Safari and Chrome, D-Link routers and the Office 365 suite–using zero-day vulnerabilities at the annual Tianfu Cup gathering. The hacking competition, held in Chengdu, China, is very similar to...

opensc:fuzz_pkcs15_reader: Heap-double-free in coolkey_free_private_data

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5630085302583296 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerasanopensc Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x603000000340 Cra...

wabt:wasm2wat_fuzzer: Heap-buffer-overflow in wabt::string_view::compare

Project: https://github.com/WebAssembly/wabt.git Detailed Report: https://oss-fuzz.com/testcase?key=5195494439780352 Project: wabt Fuzzing Engine: libFuzzer Fuzz Target: wasm2watfuzzer Job Type: libfuzzerasani386wabt Platform Id: linux Crash Type: Heap-buffer-overflow READ 6 Crash Address:...

This Week in Security News: APT33 Botnets Used for Extreme Narrow Targeting and Microsoft’s Patch Tuesday Arrives with A Patch for An IE Zero-Day

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the APT33 threat group that is using live C&C servers for extremely narrow targeting. Also, read about Trend Micro’s complete...

Alibaba's Singles' Day Set Sales Records: Reinforces Mobile Optimization Lessons for All Retailers

On its 20th anniversary, Singles' Day 11 November, a popular Chinese shopping day meant to celebrate the status of those who are single, set a new one-day record of $38 billion in sales, a 26% increase over 2018 $30.7 billion, according to multiple media reports. However, according to Akamai data...

Patch Tuesday, November 2019 Edition

Microsoft today released updates to plug security holes in its software, including patches to fix at least 74 weaknesses in various flavors of Windows and programs that run on top of it. The November updates include patches for a zero-day flaw in Internet Explorer that is currently being exploite...

Microsoft Patches RCE Bug Actively Under Attack

A critical bug in a Microsoft scripting engine, under active attack, has been patched as part of Microsoft’s Patch Tuesday security roundup. The vulnerability exists in Internet Explorer and allows an attacker to execute rogue code if a victim is coaxed into visiting a malicious web page, or, if...

firestore:serializer_fuzzer: Crash in pb_release_single_field

Detailed Report: https://oss-fuzz.com/testcase?key=5650431242141696 Project: firestore Fuzzing Engine: libFuzzer Fuzz Target: serializerfuzzer Job Type: libfuzzerasanfirestore Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x000000187eef Crash State: pbreleasesinglefield pbrelease...

matio:matio_fuzzer: Heap-buffer-overflow in H5O_fill_new_shared_decode

Project: git://git.code.sf.net/p/matio/matio Detailed Report: https://oss-fuzz.com/testcase?key=5672244609286144 Project: matio Fuzzing Engine: afl Fuzz Target: matiofuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x61500004fac8 Crash State:...

Why Many People Got Mysterious Valentine’s Day Texts Today

The issue was reportedly caused by a maintenance update made to “messaging platforms of multiple carriers in the US."...

xvid:fuzzer-decoder: Use-of-uninitialized-value in BitstreamReadHeaders

Detailed Report: https://oss-fuzz.com/testcase?key=5670159510929408 Project: xvid Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-decoder Job Type: libfuzzermsanxvid Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: BitstreamReadHeaders decoderdecode xviddecore...

Fuji Electric V-Server

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Fuji Electric Equipment: V-Server Vulnerability: Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device being accessed; several heap-based buffer overflows...

ndpi:fuzz_process_packet: Heap-buffer-overflow in getNameLength

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5650190824636416 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60700000051e...

Tips to Accelerating PCI Data Security Standard Projects with Deep Security as a Service

Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...

ffmpeg:ffmpeg_AV_CODEC_ID_XMA2_fuzzer: Index-out-of-bounds in xma_decode_packet

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5635373899710464 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDXMA2fuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

cryptofuzz:cryptofuzz-boringssl: Heap-buffer-overflow in DesSetKey

Detailed Report: https://oss-fuzz.com/testcase?key=5689068197511168 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x602000000d27 Crash State: DesSetKey...