libreoffice/tgafuzzer: Heap-buffer-overflow in vcl::bitmap::RawBitmap::SetPixel

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5733672629043200 Project: libreoffice Fuzzer: afllibreofficetgafuzzer Fuzz target binary: tgafuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1...

Hackers Exploiting 'Bitmessage' Zero-Day to Steal Bitcoin Wallet Keys

Bitmessage developers have warned of a critical 'remotely executable' zero-day vulnerability in the PyBitmessage application that was being exploited in the wild. Bitmessage is a Peer-to-Peer P2P communications protocol used to send encrypted messages to users. Since it is decentralized and...

February 14, 2018 – Morning Cyber Coffee Headlines – “Valentine’s Day” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! February 14 2018 - Headlines Carbon Black in the News: Endpoint security suites...

Hackers Exploit 'Telegram Messenger' Zero-Day Flaw to Spread Malware

A zero-day vulnerability has been discovered in the desktop version for end-to-end encrypted Telegram messaging app that was being exploited in the wild in order to spread malware that mines cryptocurrencies such as Monero and ZCash. The Telegram vulnerability was uncovered by security researcher...

Romance Scams Drive Necurs Botnet Activity in Run Up to Valentine’s Day

Necurs botnet activity is spiking as scammers use the network to flood inboxes with promises of companionship, in part of a seasonal wave of Valentine’s Day-themed spam. Victims are encouraged to share revealing photos of themselves, which scammers later use as leverage in extortion shakedowns. T...

graphicsmagick/coder_PICT_fuzzer: Unknown signal in DestroyCacheInfo

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6624475274543104 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderPICTfuzzer Fuzz target binary: coderPICTfuzzer Job Type: libfuzzerubsangraphicsmagick Platform Id: linux Crash Type:...

imagemagick/encoder_miff_fuzzer: Stack-buffer-overflow in QueryColorCompliance

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4843070479663104 Project: imagemagick Fuzzer: aflimagemagickencodermifffuzzer Fuzz target binary: encodermifffuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 5, 2018

It was a busy week in the cyber security world, but it shouldn’t be surprising given that the 2018 Winter Olympics in Pyeongchang have begun. I shouldn’t blame just the Olympics, but it’s hard not to given the international focus, controversy around the ban of certain athletes and its proximity t...

yara/dex_fuzzer: Heap-buffer-overflow in dex_parse

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5104899873308672 Project: yara Fuzzer: aflyaradexfuzzer Fuzz target binary: dexfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x62e0000178f8...

imagemagick/encoder_mvg_fuzzer: Heap-buffer-overflow in FileToBlob

Detailed report: https://oss-fuzz.com/testcase?key=4892658276237312 Project: imagemagick Fuzzer: aflimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x63200002c801 Crash State:...

graphicsmagick/coder_PCT_fuzzer: Unknown signal in AcquireString

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6515514101727232 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderPCTfuzzer Fuzz target binary: coderPCTfuzzer Job Type: libfuzzerubsangraphicsmagick Platform Id: linux Crash Type:...

imagemagick/rotate_fuzzer: Use-of-uninitialized-value in PerceptibleReciprocal

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4686820978720768 Project: imagemagick Fuzzer: libFuzzerimagemagickrotatefuzzer Fuzz target binary: rotatefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Vitek - Remote Command Execution / Information Disclosure (PoC) Vulnerability

Exploit for multiple platform in category remote exploits STX Subject: Vitek RCE and Information Disclosure and possible other OEM Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis December 2017 PoC: https://github.com/mcw0/PoC Release date: December 22, 201...

Safer Internet Day 2018: ad blockers and anti-trackers

The path to a safer Internet can be a bit of a quandary. What programs should you buy? How long should your passwords be? Is it okay to write them down? What makes a website secure? All of these questions can merit their own lengthy essays, so today, on Safer Internet Day, we’re going to look at...

Beers with Talos EP 22: Forget the ASA, Rob Joyce Favorited Craig’s Tweet

Beers with Talos BWT Podcast Episode 22 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP22 Show Notes: Recorded 2/2/18 - Guests two EPs in a row! We are joined by Omar Santos from Cisco PSI...

graphicsmagick/coder_PCT_fuzzer: Unknown signal in cfree

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6411297525596160 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderPCTfuzzer Fuzz target binary: coderPCTfuzzer Job Type: libfuzzerubsangraphicsmagick Platform Id: linux Crash Type:...

New Flash Player zero-day comes inside Office document

Update 2018-02-06: Adobe has released a patch for this vulnerability. More information is available here. We tested this zero-day with a proof-of concept that was made available. Rather than launching it from within Office, we turned it into a drive-by download attack. The animation below shows...

openthread/ip6-send-fuzzer: Stack-buffer-overflow in ot::NetworkData::ServiceTlv::IsThreadEnterprise

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5472780666535936 Project: openthread Fuzzer: aflopenthreadip6-send-fuzzer Fuzz target binary: ip6-send-fuzzer Job Type: aflasanopenthread Platform Id: linux Crash Type: Stack-buffer-overflow...

Safer Internet Day

February 6, 2018, is Safer Internet Day SID, a worldwide event aimed at promoting the safe and positive use of digital technology for all users, especially children and teens. This year's SID theme—Create, Connect and Share Respect: A better Internet starts with you—encourages everyone to play...

graphicsmagick/coder_PCT_fuzzer: Unknown signal in cfree

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=4961303614455808 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderPCTfuzzer Fuzz target binary: coderPCTfuzzer Job Type: libfuzzerubsangraphicsmagick Platform Id: linux Crash Type:...