Microsoft Edge Chakra JIT Loop Analysis Bug

Microsoft Edge: Chakra: JIT: Loop analysis bug CVE-2018-0777 Here's the PoC demonstrating OOB write. function optarr, start, end for let i = start; i end; i++ if i === 10 i += 0; // -- a arri = 2.3023e-320; function main let arr = new Array100; arr.fill1.1; for let i = 0; i 1000; i++ optarr, 0, 3...

We Did It Again! Trend Micro Named a Leader in 2018 Gartner Magic Quadrant for Intrusion Detection and Prevention Systems (IDPS)

Trend Micro has been named a Leader in the Gartner 2018 Magic Quadrant for Intrusion Detection and Prevention Systems IDPS again. We have improved our position in both Completeness of Vision and Ability to Execute from last year, and we believe that placement in the Leaders’ quadrant illustrates...

imagemagick/encoder_sixel_fuzzer: Heap-buffer-overflow in ResetMagickMemory

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4971915790778368 Project: imagemagick Fuzzer: aflimagemagickencodersixelfuzzer Fuzz target binary: encodersixelfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

Microsoft Edge Chakra JIT Incorrect Bounds Calculation

Microsoft Edge: Chakra: JIT: Incorrect bounds calculation CVE-2018-0769 Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method. // Track bounds for add or sub with a constant. For instance, consider b = a + 2. The value of 'b' should track // that it is equal to the...

imagemagick/encoder_xpm_fuzzer: Use-of-uninitialized-value in ParseCommandOption

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5459937892237312 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderxpmfuzzer Fuzz target binary: encoderxpmfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

OBS studio 20.1.3 - Local Buffer Overflow Exploit

Exploit for windows platform in category dos / poc author = ''' Created: ScrR1pTK1dd13 Name: Greg Priest Mail: email protected Exploit Title: OBS-Studio-20.1.3 Local Buffer Overflow Zer0Day SEH Based PoC Date: 2018.01.15 Exploit Author: Greg Priest Version: OBS-Studio-20.1.3 Tested on: Windows7 x...

dlplibs/marinerwrtfuzzer: Heap-buffer-overflow in WriterPlsParserInternal::WindowsInfo::getColumnLimitsFor

Detailed report: https://oss-fuzz.com/testcase?key=4712010408263680 Project: dlplibs Fuzzer: libFuzzerdlplibsmarinerwrtfuzzer Fuzz target binary: marinerwrtfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x603000000840 Crash State:...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 8, 2018

Last week, three interesting vulnerabilities popped up on the news and security feeds. Researchers disclosed CVE-2017-5753 and CVE-2017-5715, collectively known as Spectre, and CVE-2017-5754, known as Meltdown. These vulnerabilities take advantage of “speculative execution” of instructions...

libreoffice/htmlfuzzer: Heap-use-after-free in SwTextFootnote::GetTextNode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5183158522740736 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

Microsoft’s Jan. 2018 Patch Tuesday Lowdown

Microsoft on Tuesday released 14 security updates, including fixes for the Spectre and Meltdown flaws detailed last week, as well as a zero-day vulnerability in Microsoft Office that is being exploited in the wild. Separately, Adobe pushed a security update to its Flash Player software. Last week...

Microsoft Edge Chakra JIT Op_MaxInAnArray / Op_MinInAnArray Misuse

Microsoft Edge: Chakra: JIT: OpMaxInAnArray and OpMinInAnArray can explicitly call user defined JavaScript functions CVE-2017-11893 1. Call patterns like "Math.max.applyMath, 1, 2, 3, 4, 5" and "Math.max.applyMath, arr" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" i...

Microsoft Releases Patches for 16 Critical Flaws, Including a Zero-Day

If you think that only CPU updates that address this year's major security flaws—Meltdown and Spectre—are the only ones you are advised to grab immediately, there are a handful of major security flaws that you should pay attention to. Microsoft has issued its first Patch Tuesday for 2018 to addre...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 1, 2018

Happy New Year! It’s out with the old, in with the new, right? Except we all know that the old tends to stick around, especially when it comes to vulnerabilities and patching them. Trend Micro predicts that that 2018’s biggest attacks will originate from known vulnerabilities. And speaking of kno...

Not So Crystal Clear - Zeus Variant Spoils Ukrainian Holiday

This post was authored by Edmund Brumaghin with contributions from Ben Baker, Dave Maynor and Matthew Molyett. Introduction Talos has observed a cyber attack which was launched using the official website of Ukraine-based accounting software developer Crystal Finance Millennium CFM. This vector is...

libreoffice/fodsfuzzer: Heap-use-after-free in cppu::_destructData

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4963204691132416 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

Wickr Inc - Zero Day Vulnerability Research Report P1

Document Title: =============== Wickr Inc - Zero Day Vulnerability Research Report P1 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1994 Document: https://www.vulnerability-lab.com/resources/documents/56129965121925.rar Key: 3986592835691561956295629856195 Videos:...

Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities

Document Title: =============== Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2055 Playlist: https://www.youtube.com/playlist?list=PL2hnNNM3yw-3svLm9UdSzvlVVZcx5DxV Videos:...

Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities

Document Title: =============== Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2055 Playlist: https://www.youtube.com/playlist?list=PL2hnNNM3yw-3svLm9UdSzvlVVZcx5DxV Videos:...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of December 25, 2017

Last Sunday, my day could be best described by the lyrics of Sammy Hagar’s song “I Can’t Drive 55.” I was issued a ticket for an alleged speeding infraction. I usually drive about 10 mph over the speed limit, but my “alleged” lead foot got the best of me and so did the Texas Highway Patrol. C’est...

gdal/cad_fuzzer: in CADHandle::getAsLong

Detailed report: https://oss-fuzz.com/testcase?key=6093626703609856 Project: gdal Fuzzer: aflgdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: READ 8 Crash Address: 0x6020000428dd Crash State: CADHandle::getAsLong DWGFileRNUMBER::GetNOD...