xvid:fuzzer-decoder: Crash in get_mv_data

Detailed Report: https://oss-fuzz.com/testcase?key=5173897682485248 Project: xvid Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-decoder Job Type: libfuzzerasanxvid Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0001800c9f40 Crash State: getmvdata getmv getmotionvector Sanitizer:...

libreoffice:ww6fuzzer: Heap-use-after-free in SwIndex::Remove

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5648669272965120 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: ww6fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

Warning: Researcher Drops phpMyAdmin Zero-Day Affecting All Versions

A cybersecurity researcher recently published details and proof-of-concept for an unpatched zero-day vulnerability in phpMyAdmin—one of the most popular applications for managing the MySQL and MariaDB databases. phpMyAdmin is a free and open source administration tool for MySQL and MariaDB that's...

Warning: Researcher Drops phpMyAdmin Zero-Day Affecting All Versions

A cybersecurity researcher recently published details and proof-of-concept for an unpatched zero-day vulnerability in phpMyAdmin—one of the most popular applications for managing the MySQL and MariaDB databases. phpMyAdmin is a free and open source administration tool for MySQL and MariaDB that's...

LastPass Credential Leak From Previous Site Vulnerability

LastPass suffers from an issue where bypassing dopopupregister leaks credentials from the previous site. lastpass: bypassing dopopupregister leaks credentials from previous site I noticed that you can create a popup without calling dopopupregister by iframing popupfilltab.html i.e. via...

LastPass Credential Leak From Previous Site

lastpass: bypassing dopopupregister leaks credentials from previous site I noticed that you can create a popup without calling dopopupregister by iframing popupfilltab.html i.e. via moz-extension, ms-browser-extension, chrome-extension, etc. It's a valid webaccessibleresource. Because...

libhevc:hevc_dec_fuzzer: Heap-buffer-overflow in ihevcd_mv_merge

Project: https://android.googlesource.com/platform/external/libhevc Detailed Report: https://oss-fuzz.com/testcase?key=5747011424354304 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzerasani386libhevc Platform Id: linux Crash Type: Heap-buffer-overflow READ...

Beers with Talos Ep. #61: Hacking for good is a bad idea

Beers with Talos BWT Podcast episode No. 61 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded Aug. 30, 2019: In this extra-sized episode, we cover a lot, starting with Retadup, and discussing the intricate...

Microsoft Addresses Two Zero-Days Under Active Attack

Two elevation-of-privilege vulnerabilities that have been exploited in the wild as zero-days are at the heart of September’s Patch Tuesday update from Microsoft. The two EoP vulnerabilities under active attack consist of CVE-2019-1214, which exists in the Windows Common Log File System CLFS Drive...

Adobe Fixes Critical Flash Player Code Execution Flaws

Adobe has issued patches for critical vulnerabilities in Flash Player which, if exploited, could lead to arbitrary code execution. Overall, as part of its September Security Bulletin, Adobe patched three vulnerabilities, including two critical-severity flaws in Flash Player and one “important”...

Adobe Releases Security Patches For Critical Flash Player Vulnerabilities

It's Patch Tuesday again—the day of the month when both Adobe and Microsoft release security patches for vulnerabilities in their software. Adobe has just released its monthly security updates to address a total of 3 security vulnerabilities in only two of its products this time—Adobe Flash Playe...

In-depth exploration found in the wild iOS exploit chain a-vulnerability warning-the black bar safety net

Series Foreword Project Zero One of the tasks is the analysis of the 0-day vulnerability, we often partner with other companies to find security vulnerabilities and submit, the final goal is to promote the popular system architecture of the security improvements to help protect throughout end...

China's APT3 Pilfers Cyberweapons from the NSA

The advanced persistent threat APT group known as APT3, which researchers across the board link to the Chinese government, has built a full in-house battery of exploits and cybertools collectively dubbed “UPSynergy.” An analysis of the toolkit has uncovered a geopolitical cat-and-mouse spy game: ...

libhevc:hevc_dec_fuzzer: Heap-buffer-overflow in ihevcd_parse_slice_data

Project: https://android.googlesource.com/platform/external/libhevc Detailed Report: https://oss-fuzz.com/testcase?key=5753353983754240 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzerasani386libhevc Platform Id: linux Crash Type: Heap-buffer-overflow WRIT...

unicorn:fuzz_emu_arm64_armbe: Use-of-uninitialized-value in float64_squash_input_denormal_aarch64eb

Project: https://github.com/unicorn-engine/unicorn.git Detailed Report: https://oss-fuzz.com/testcase?key=5638957731151872 Project: unicorn Fuzzing Engine: libFuzzer Fuzz Target: fuzzemuarm64armbe Job Type: libfuzzermsanunicorn Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

libhevc:hevc_dec_fuzzer: Stack-buffer-overflow in ihevcd_ref_list

Project: https://android.googlesource.com/platform/external/libhevc Detailed Report: https://oss-fuzz.com/testcase?key=5637475766108160 Project: libhevc Fuzzing Engine: afl Fuzz Target: hevcdecfuzzer Job Type: aflasanlibhevc Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 4 Crash...

This Week in Security News: New Zero-Day Vulnerability Findings and Mobile Phishing Scams

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn how music festival goers need to be on guard for phishing attacks when trying to find a lost iPhone. Also, read how Trend Micro...

Zerodium to pay up to $2.5 million for reporting 0-day Android exploits

By Uzair Amir Zero-Day Android exploits are now more valuable then iOS exploits. This is a post from HackRead.com Read the original post: Zerodium to pay up to $2.5 million for reporting 0-day Android exploits...

DNS Protection: A "Must" in Security Solutions for any Company

Domain name system DNS services are often a point of vulnerability for businesses, so DNS security has become a growing concern for many of them. DNS is a critical element for all companies because it turns domain names into internet protocol IP addresses. Cyber criminals have been digging into D...

Android Zero-Day Bug Opens Door to Privilege Escalation Attack, Researchers Warn

UPDATE Researchers are warning of a high-severity zero-day vulnerability in Google’s Android operating system, which if exploited could give a local attacker escalated privileges on a target’s device. The specific flaw exists within the v4l2 Video4Linux 2 driver, which is the Android media driver...