EPS Processing Zero-Days Exploited by Multiple Threat Actors

In 2015, FireEye published details about two attacks exploiting vulnerabilities in Encapsulated PostScript EPS of Microsoft Office. One was a zero-day and one was patched weeks before the attack launched. Recently, FireEye identified three new zero-day vulnerabilities in Microsoft Office products...

EPS Processing Zero-Days Exploited by Multiple Threat Actors

In 2015, FireEye published details about two attacks exploiting vulnerabilities in Encapsulated PostScript EPS of Microsoft Office. One was a zero-day and one was patched weeks before the attack launched. Recently, FireEye identified three new zero-day vulnerabilities in Microsoft Office products...

Google openly“history's most severe”Windows RCE vulnerability details-vulnerability warning-the black bar safety net

Google Project Zero security team researcher Tavis Ormandy and Natalie Silvanovich that Windows found a serious vulnerability. Such as, within 90 days, the vulnerability has not been repaired, then they might publish the details. Recently, the vulnerability details have been released. Google to...

Wormable Windows Zero Day Reported to Microsoft

Google Project Zero researcher Tavis Ormandy has a long legacy of finding unknown, critical software vulnerabilities to his credit. So when he calls a new bug the worst in recent memory, it’s likely not hyperbole. On Saturday, Ormandy tweeted that he and colleague Natalie Silvanovich has found a...

ffmpeg: Heap-buffer-overflow in xwd_decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=4866094172995584 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDXWDfuzzer Fuzz target binary: ffmpegAVCODECIDXWDfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of May 1, 2017

As you read this blog, I am probably sitting on a beach in Cancun, Mexico getting a nice tan and not thinking about security well, maybe just a little. A couple of days before I left, I had to deal with the inevitable. It never fails – every time I am about to go on vacation, the urgency of thing...

ffmpeg: Heap-buffer-overflow in ff_htmlmarkup_to_ass

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5520132195483648 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDSAMIfuzzer Fuzz target binary: ffmpegAVCODECIDSAMIfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow...

Unpatched WordPress Password Reset Vulnerability Lingers

A zero-day vulnerability exists in WordPress Core that in some instances could allow an attacker to reset a user’s password and gain access to their account. Researcher Dawid Golunski of Legal Hackers disclosed the vulnerability on Wednesday via his new ExploitBox service. All versions of...

Advantech WebAccess

CVSS v3 7.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess Vulnerability: Absolute Path Traversal AFFECTED PRODUCTS The following WebAccess versions are affected: WebAccess Version 8.1 and prior. IMPACT Successful exploitation of this...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 24, 2017

There was a time when a person’s motivation to hack something was for financial reasons or for street cred. But now we’re seeing organizations that have other motivations. Pawn Storm is a cyber-espionage organization whose motives include foreign and domestic espionage, and influence on...

file: Heap-buffer-overflow in cdf_getuint32

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=4658680639258624 Project: file Fuzzer: aflfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: aflasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x611000000dc1 Cra...

Pawn Storm: The Power of Social Engineering

In our latest report on Pawn Storm a.k.a. APT28, Fancy Bear, Strontium, etc., researchers expose the scope and scale of the cyber espionage group’s attacks but more importantly their cyber tradecraft. Our researchers have observed activity going back seven years targeting government, military,...

Microsoft Office Word Malicious Hta Execution Exploit

This Metasploit module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how an olelink object can make a https request, and execute hta code in response. This bug was originally seen being exploited in the wild...

wireshark: Stack-use-after-return in add_tagged_field

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=6172256742932480 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerasanwireshark Platform Id...

wireshark: Heap-buffer-overflow in OALMarshal_UncompressValue

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=5900099865542656 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerasanwireshark Platform Id...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 17, 2017

I’ve never been one to adopt the latest fashion trends, aside from what I wore growing up in the 1980s. I wore shoulder pads, blue eyeliner, designer jeans, and even parachute pants. While I continue to rock my 80s hair to this day, other trends I thought were long gone are making a comeback...

WebKit operationSpreadGeneric Universal Cross Site Scripting

WebKit: UXSS via operationSpreadGeneric Once a spread operation is optimized, the function |operationSpreadGeneric| will be called from then on. But operationSpreadGeneric's trying to get a JSGlobalObject from the argument of a spread operation. It seems that that optimization is not implemented ...

WebKit operationSpreadGeneric Universal Cross Site Scripting Vulnerability

WebKit suffers from a universal cross site scripting vulnerability in operationSpreadGeneric. WebKit: UXSS via operationSpreadGeneric Once a spread operation is optimized, the function |operationSpreadGeneric| will be called from then on. But operationSpreadGeneric's trying to get a JSGlobalObjec...

The Shadow Brokers Release Zero Day Exploit Tools

On Friday, a hacker group known as The Shadow Brokers publicly released a large number of functional exploit tools. Several of these tools make use of zero-day vulnerabilities, most of which are in Microsoft Windows. Exploiting these vulnerabilities in many cases leads to remote code execution an...

dlplibs: Global-buffer-overflow in StarEncoding::read

Detailed report: https://oss-fuzz.com/testcase?key=6608338966020096 Project: dlplibs Fuzzer: libFuzzerdlplibssdwfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000000a9d1dc Crash State: StarEncoding::read StarEncoding::convert...