harfbuzz/hb-subset-fuzzer: Heap-double-free in hb_vector_t<CFF::op_str_t, 8u>::fini

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5695865298092032 Project: harfbuzz Fuzzer: libFuzzerhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-double-free Crash...

Hacker Discloses New Unpatched Windows Zero-Day Exploit On Twitter

A security researcher with Twitter alias SandboxEscaper today released proof-of-concept PoC exploit for a new zero-day vulnerability affecting Microsoft's Windows operating system. SandboxEscaper is the same researcher who previously publicly dropped exploits for two Windows zero-day...

Hacker Discloses New Unpatched Windows Zero-Day Exploit On Twitter

A security researcher with Twitter alias SandboxEscaper today released proof-of-concept PoC exploit for a new zero-day vulnerability affecting Microsoft's Windows operating system. SandboxEscaper is the same researcher who previously publicly dropped exploits for two Windows zero-day...

Microsoft IE Zero Day Gets Emergency Patch

Microsoft patched a zero-day vulnerability in its Internet Explorer browser that is actively being exploited by attackers. The bug, reported by Google, is a remote code execution vulnerability that allowed attackers to infiltrate vulnerable systems via a booby trapped website that could have...

Microsoft Issues Emergency Patch For Under-Attack IE Zero Day

Microsoft today issued an out-of-band security update to patch a critical zero-day vulnerability in Internet Explorer IE Web browser that attackers are already exploiting in the wild to hack into Windows computers. Discovered by security researcher Clement Lecigne of Google's Threat Analysis Grou...

Microsoft Issues Emergency Patch For Under-Attack IE Zero Day

Microsoft today issued an out-of-band security update to patch a critical zero-day vulnerability in Internet Explorer IE Web browser that attackers are already exploiting in the wild to hack into Windows computers. Discovered by security researcher Clement Lecigne of Google's Threat Analysis Grou...

yara/dotnet_fuzzer: Heap-buffer-overflow in dotnet_parse_us

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5725060321509376 Project: yara Fuzzer: libFuzzeryaradotnetfuzzer Fuzz target binary: dotnetfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address...

The Market of Billions -- Are You Prepared For The Peaks?

Yes, we truly are the market of billions! I love Graham D. Brown's distinctive representation of this massive business opportunity in South Asia in his Asia Matters report. In 2018, over 50% of the world's total online retail sales happened in the Asia-Pacific region. eMarketer reports that onlin...

skia/animated_image_decode: Heap-buffer-overflow in swizzle_index_to_n32

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5695054438465536 Project: skia Fuzzer: libFuzzerskiaanimatedimagedecode Fuzz target binary: animatedimagedecode Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

Microsoft Issues Patch for Windows Zero-Day Flaw Under Active Attack

Microsoft today, on its year-end December Patch Tuesday, released security updates to patch a total 39 vulnerabilities its Windows operating systems and applications—10 of which are rated as critical and other important in severity. One of the security vulnerabilities patched by the tech giant th...

Microsoft Issues Patch for Windows Zero-Day Flaw Under Active Attack

Microsoft today, on its year-end December Patch Tuesday, released security updates to patch a total 39 vulnerabilities its Windows operating systems and applications—10 of which are rated as critical and other important in severity. One of the security vulnerabilities patched by the tech giant th...

Zero-Day Bug Patched by Microsoft, Part of December Patch TuesdZero-Day Bug Fixed by Microsoft in December Patch Tuesdayay

Microsoft has patched a zero-day vulnerability actively being used against older versions of the Windows operating system, as part of its December Patch Tuesday updates. According to the software giant, the vulnerability CVE-2018-8611 is an elevation-of-privilege EoP bug that affects Windows 7...

Patch Tuesday, December 2018 Edition

Adobe and Microsoft each released updates today to tackle critical security weaknesses in their software. Microsoft's December patch batch is relatively light, addressing more than three dozen vulnerabilities in Windows and related applications. Adobe has issued security fixes for its Acrobat and...

Using Fuzzing to Mine for Zero-Days

Fuzzing is a term that sounds hard to take seriously. But it needs to be, in light of today’s attack landscape. Fuzzing has traditionally been a sophisticated technique used by professional threat researchers to discover vulnerabilities in hardware and software interfaces and applications. They d...

From DirectX to the Windows Kernel--a few of the CVE vulnerability analysis-vulnerability warning-the black bar safety net

One, Foreword Operating systemthe kernel is each vulnerability the use of chain final goal, we can view the Zero Day Initiative ZDI Pwn2Own calendar year, race, and understand this aspect of the content. Windows kernel has always been the attacker keen to target, my favorite is the abuse of the...

New Adobe Flash Zero-Day Exploit Found Hidden Inside MS Office Docs

Cybersecurity researchers have discovered a new zero-day vulnerability in Adobe Flash Player that hackers are actively exploiting in the wild as part of a targeted campaign appears to be attacking a Russian state health care institution. The vulnerability, tracked as CVE-2018-15982 , is a...

New Adobe Flash Zero-Day Exploit Found Hidden Inside MS Office Docs

Cybersecurity researchers have discovered a new zero-day vulnerability in Adobe Flash Player that hackers are actively exploiting in the wild as part of a targeted campaign appears to be attacking a Russian state health care institution. The vulnerability, tracked as CVE-2018-15982, is a...

New Flash Player zero-day used against Russian facility

For the past couple of years, Office documents have largely replaced exploit kits as the primary malware delivery vector, giving threat actors the choice between social engineering lures and exploits or a combination of both. While today's malicious spam malspam heavily relies on macros and popul...

Adobe Flash Zero-Day Leveraged Via Office Docs in Campaign

An Adobe Flash Player zero-day exploit has been spotted in the wild as part of a widespread campaign, researchers said on Wednesday. Adobe has just issued a patch for the previously unknown critical flaw. The vulnerability, CVE-2018-15982, is a use-after-free flaw enabling arbitrary code executio...

harfbuzz/hb-subset-fuzzer: Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5660711141769216 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflo...