The SMB vulnerability triggered“bloodshed”, far more than WannaCry-vulnerability warning-the black bar safety net

Preface Since the Shadow Brokers published NSA Elite hacking team Equation Group the use of 0-day vulnerabilities and hacker tools, hacker groups and independent hackers started to exploit these vulnerabilities and tools to initiate various attacks. But industry insiders believe that the 4 month...

gdal: Bad-cast to xercesc_3_1::DOMElement from xercesc_3_1::DOMTextImpl;ILI2Reader::setFieldDefn;ILI2Reader::setFieldDefn

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5314575312355328 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000836a798 Crash State:...

gdal: Heap-buffer-overflow in NASReader::SetFeaturePropertyDirectly

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4908186949648384 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=4857091871211520 Project: lcms Fuzzer: afllcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: aflasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

ShadowBrokers Planning Monthly Exploit, Data Dump Service

Popcorn in hand, the ShadowBrokers say they’re taking in the WannaCry outbreak from the sidelines before starting in June a subscription service for new exploits and stolen data akin to a wine of the month club. In what’s become a signature periodic rant from the unknowns behind the leak of...

Shadow Brokers, Who Leaked WannaCry SMB Exploit, Are Back With More 0-Days

The infamous hacking collective Shadow Brokers – the one who leaked the Windows SMB exploit in public that led to last weekend's WannaCrypt menace – are back, this time, to cause more damage. In typically broken English, the Shadow Brokers published a fresh statement with full of frustration a fe...

gdal: Heap-buffer-overflow in DDFFieldDefn::Initialize

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5536723368935424 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

gdal: Heap-buffer-overflow in DDFModule::FindFieldDefn

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5135458801549312 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

gdal: Heap-buffer-overflow in OGRReadWKBGeometryType

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5710786179629056 Project: gdal Fuzzer: libFuzzergdalwkbimportfuzzer Fuzz target binary: wkbimportfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Addres...

ffmpeg: Index-out-of-bounds in decode_audio_block

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=6455337349545984 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDAC3fuzzer Fuzz target binary: ffmpegAVCODECIDAC3fuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of May 8, 2017

Although I’m still dreaming of the sandy beaches of Cancun, it’s time to get back to reality. Security vulnerabilities never take a holiday and this week is no exception. In addition to our normal Digital Vaccine DV package delivered earlier this week, we also issued an out-of-band DV package to...

gdal: Heap-buffer-overflow in NITFGetField

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5956305300750336 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 5 Crash Address:...

OnePlus OTA One/X Crossover Vulnerability(CVE-2017-8851)

Products OnePlus X OnePlus One Vulnerable Version All OnePlus OxygenOS & HydrogenOS OTAs Technical Details Due to lenient updater-script on the OnePlus One & X’s OTA images see below, the fact both products use the same OTA verification keys, and the fact both products share the same...

ffmpeg: Index-out-of-bounds in decode_residual

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=6246484833992704 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDH264fuzzer Fuzz target binary: ffmpegAVCODECIDH264fuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds...

gnutls: Use-of-uninitialized-value in gnutls_memset

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=4591499331239936 Project: gnutls Fuzzer: libFuzzergnutlspkcs8keyparserfuzzer Fuzz target binary: gnutlspkcs8keyparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type:...

ffmpeg: Heap-buffer-overflow in sbr_x_gen

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5075102901207040 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDAACfuzzer Fuzz target binary: ffmpegAVCODECIDAACfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash...

Microsoft Issues Patches for Another Four Zero-Day Vulnerabilities

As part of this month's Patch Tuesday, Microsoft has released security patches for a total of 55 vulnerabilities across its products, including fixes for four zero-day vulnerabilities being exploited in the wild. Just yesterday, Microsoft released an emergency out-of-band update separately to pat...

harfbuzz: Index-out-of-bounds in hb_ot_face_metrics_accelerator_t::get_advance

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5672141338968064 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-fuzzer Fuzz target binary: hb-fuzzer Job Type: libfuzzerubsanharfbuzz Platform Id: linux Crash Type: Index-out-of-bounds Crash Addres...

Microsoft Fixes Malware Protection Engine and Several 0-Day Vulnerabilities, and Deprecates SHA-1

Hours before today’s Patch Tuesday release on the eve of May 8, Microsoft released an emergency updated to fix a vulnerability in their Malware Protection Engine. This critical vulnerability allows an attacker to take complete control of the victim's machine by just sending an e-mail attachment...

Microsoft Plugs Three Zero Day Holes as Part of May Patch Tuesday

Microsoft patched three zero day vulnerabilities actively under attack today as part of its May Patch Tuesday release. Researchers with FireEye who uncovered the three vulnerabilities said the bugs were actively being exploited by threat actors Turla and APT28. Two of the zero day vulnerabilities...