Patch Tuesday Lowdown, October 2019 Edition

On Tuesday Microsoft issued software updates to fix almost five dozen security problems in Windows and software designed to run on top of it. By most accounts, it's a relatively light patch batch this month. Here's a look at the highlights. Happily, only about 15 percent of the bugs patched this...

Google October Android Security Update Fixes Critical RCE Flaws

UPDATE Google has released fixes for three critical-severity vulnerabilities in the Media framework of its Android operating system, which if exploited could allow a remote attacker to execute code. The remote code execution RCE flaws are part of Google’s October 2019 Android Security Bulletin,...

libsass:data_context_fuzzer: Use-of-uninitialized-value in std::__1::vector<std::__1::vector<Sass::SharedImpl<Sass::ComplexSelector>, std::

Detailed Report: https://oss-fuzz.com/testcase?key=5721443934928896 Project: libsass Fuzzing Engine: libFuzzer Fuzz Target: datacontextfuzzer Job Type: libfuzzermsanlibsass Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: std::1::vector, std::...

Using MixMode and Carbon Black to Spot a Watering Hole Attack

For those not familiar with watering hole attacks, they are attacks on a specific place—such as a restaurant—that many people visit. They generally involve malicious code being injected into an iframe on the company’s website. In the case of a restaurant, for example, the online menu would be a...

Google Warns of Android Zero-Day Bug Under Active Attack

Google is warning of an Android zero-day flaw actively being exploited in the wild, which gives an attacker full control over 18 phone models including its flagship Pixel handset and devices made by Samsung, Huawei and Xiaomi. Google’s Project Zero warned late Thursday that it suspected the...

Foxit PDF Reader Vulnerable to 8 High-Severity Flaws

Patches are available for eight high-severity flaws impacting the popular PDF software Foxit Reader. The bugs, which exist on Windows versions of the software, enable a remote attacker to execute arbitrary code on vulnerable systems. This week, Foxit Software, the company behind Foxit Reader,...

Virus Bulletin 2019: Japanese Attacks Highlight Savvy APT Strategy

LONDON — Three separate, multi-year APT campaigns targeting region-specific software showcase a savvy technique of leveraging zero-day vulnerabilities in niche software in order to infect victims with malware. According to researchers at JPCERT in Japan, speaking at Virus Bulletin 2019, both the...

Comodo Forums Hack Exposes 245,000 Users' Data — Recent vBulletin 0-day Used

If you have an account with the Comodo discussion board and support forums, also known as ITarian Forum, you should change your password immediately. Cybersecurity company Comodo has become one of the major victims of a recently disclosed vBulletin 0-day vulnerability, exposing login account...

Comodo Forums Hack Exposes 245,000 Users' Data — Recent vBulletin 0-day Used

If you have an account with the Comodo discussion board and support forums, also known as ITarian Forum, you should change your password immediately. Cybersecurity company Comodo has become one of the major victims of a recently disclosed vBulletin 0-day vulnerability, exposing login account...

Over A Billion Malicious Ad Impressions Exploit WebKit Flaw to Target Apple Users

The infamous eGobbler hacking group that surfaced online earlier this year with massive malvertising campaigns has now been caught running a new campaign exploiting two browser vulnerabilities to show intrusive pop-up ads and forcefully redirect users to malicious websites. To be noted, hackers...

imagemagick:ping_mvg_fuzzer: Use-of-uninitialized-value in TraceArcPath

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5718991703638016 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: pingmvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

[Unpatched] Critical 0-Day RCE Exploit for vBulletin Forum Disclosed Publicly

An anonymous hacker today publicly revealed details and proof-of-concept exploit code for an unpatched, critical zero-day remote code execution vulnerability in vBulletin—one of the widely used internet forum software, The Hacker News has learned. One of the reasons why the vulnerability should b...

[Unpatched] Critical 0-Day RCE Exploit for vBulletin Forum Disclosed Publicly

An anonymous hacker today publicly revealed details and proof-of-concept exploit code for an unpatched, critical zero-day remote code execution vulnerability in vBulletin—one of the widely used internet forum software, The Hacker News has learned. One of the reasons why the vulnerability should b...

Microsoft Releases Emergency Patches for IE 0-Day and Windows Defender Flaw

It's not a Patch Tuesday, but Microsoft is rolling out emergency out-of-band security patches for two new vulnerabilities, one of which is a critical Internet Explorer zero-day that cyber criminals are actively exploiting in the wild. Discovered by Clément Lecigne of Google's Threat Analysis Grou...

Microsoft Releases Emergency Patches for IE 0-Day and Windows Defender Flaw

It's not a Patch Tuesday, but Microsoft is rolling out emergency out-of-band security patches for two new vulnerabilities, one of which is a critical Internet Explorer zero-day that cyber criminals are actively exploiting in the wild. Discovered by Clément Lecigne of Google's Threat Analysis Grou...

Microsoft Internet Explorer Zero-Day Flaw Addressed in Out-of-Band Security Update

Microsoft has released out-of-band security updates addressing two vulnerabilities – including an Internet Explorer zero-day vulnerability being actively exploited in the wild. The Internet Explorer zero-day vulnerability CVE-2019-1367 is a remote code execution flaw that could enable an attacker...

cryptofuzz:cryptofuzz-openssl: Heap-use-after-free in CRYPTO_ocb128_cleanup

Detailed Report: https://oss-fuzz.com/testcase?key=5696250967490560 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl Job Type: libfuzzerasani386cryptofuzz Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0xbf9036fc Crash State:...

cryptofuzz:cryptofuzz-openssl-noasm: Heap-buffer-overflow in load_u32_be

Detailed Report: https://oss-fuzz.com/testcase?key=5662852966252544 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-noasm Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000009d1 Crash State: loadu32be...

xvid:fuzzer-decoder: Crash in decoder_decode

Detailed Report: https://oss-fuzz.com/testcase?key=5651853588561920 Project: xvid Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-decoder Job Type: libfuzzermsanxvid Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000fffff801 Crash State: decoderdecode xviddecore fuzzer.cpp Sanitizer...

xvid:fuzzer-decoder: Stack-buffer-overflow in BitstreamReadHeaders

Detailed Report: https://oss-fuzz.com/testcase?key=5638255688548352 Project: xvid Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-decoder Job Type: libfuzzerasanxvid Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 4 Crash Address: 0x7fff6d7f8058 Crash State: BitstreamReadHeaders...