pcre2: Heap-buffer-overflow in match

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5329850650853376 Project: pcre2 Fuzzer: libFuzzerpcre2fuzzer Fuzz target binary: pcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

pcre2: Heap-buffer-overflow in _pcre2_xclass_8

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5982700762562560 Project: pcre2 Fuzzer: libFuzzerpcre2fuzzer Fuzz target binary: pcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

libreoffice: Heap-buffer-overflow in EnhWMFReader::ReadEnhWMF

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5718557136519168 Project: libreoffice Fuzzer: libFuzzerlibreofficewmffuzzer Fuzz target binary: wmffuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

sqlite3: Crash in sqlite3DbMallocRawNN

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6739028850245632 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x630000524f22 Crash State:...

file: Crash in file_regexec

Project: https://github.com/file/file.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6112238637154304 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

Google to Make Certificate Transparency Mandatory By 2017

Google is making Certificate Transparency mandatory for its Chrome web browser by October 2017. Google software engineer Ryan Sleevi made the announcement in conjunction with the CA/Browser Forum that took place in Redmond, Washington last week. The move is an attempt to reduce the number of doma...

Moodle 'mod_assign_save_submission' function design vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in the 'modassignsavesubmission' function in Moodle...

PCI Council Gives Merchants Reprieve on PCI 3.1 Updates

The Payment Card Industry Security Standards Council PCI SSC released an update to its vulnerability standards and is giving merchants until June 2018 to migrate their security protocols, even though waiting is not recommended...

Chip-and-PIN Credit Cards and The Deadline: Here's What You need To Know

October 1 Liability shift ENDS! Today, 1st October 2015, is the deadline for US-based Banks and Retailers to roll out Chip-embedded Credit Cards powered by EVM Technology to customers that will make transactions more secure. EVM Technology stands for Europay, MasterCard and Visa -- a global...

OpenSSH Security Bypass Vulnerability

OpenSSH is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

UBUNTU-CVE-2015-5352

The x11openhelper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time...

“Tear forced war”in the second quarter: Google found Windows 7 and Windows 8.1 there is a local mentioning right and sandbox escape vulnerabilities, Microsoft deny it-vulnerability warning-the black bar safety net

The Google security team recently found that Windows 7 and Windows 8.1 there is a local mentioning right and sandbox escape vulnerabilities, it was Microsoft's ruthless denied. Google will publish vulnerability details and POC. Vulnerability description This problem exists in theoperating systems...

Seagate Business NAS Firmware Vulnerabilities Disclosed

Firmware running on certain Seagate network-attached storage devices that are popular with small businesses and home offices, are vulnerable to remote attacks. Researchers at Beyond Binary, a security consulting firm in Australia, on Sunday went public with their disclosure after a nearly...

Google Project Zero Vulnerability Disclosure Grace Period

Google’s unwavering vulnerability disclosure deadlines are the latest chapter in a decades-long debate about how to best inform affected users that there’s a security problem with their software. Since the start of the year, Google’s 90-day clock has most notably ticked down to zero on a trio of...

New Wave of CTB-Locker/Critroni Ransomware Hitting Victims

There is a new wave of attacks delivering the CTB-Locker or Critroni crypto ransomware, arriving through spam messages with a variety of lures in several different countries. CTB-Locker is one of the newer variants in the crypto ransomware family, a kind of malware that encrypts victims’ hard...

This back to the turn of Apple: Google today announced a number of Apple 0day vulnerabilities-vulnerability warning-the black bar safety net

Google Project Zero vulnerability research team today published a Apple number of 0day vulnerabilities and technical details of the vulnerability by enhancing the system permissions and then control the entire victims Mac computer. It is worth mentioning that just two weeks ago, Google just...

Google Discloses Another Unpatched Windows 8.1 Vulnerability

Google has once again released the details of a new privilege escalation bug in Microsoft's Windows 8.1 operating system before Microsoft planned to patch the bug, triggering a new quarrel between the two tech giants. This is second time in less than a month when the Google’s security research te...

FedRAMP deadline- Industry and Agency Days

The FedRAMP PMO sent out a notification that they are holding a FedRAMP Industry Day on June 4, 2014 and an Agency Day on June 10, 2014. Items to discuss include the June 5, 2014 deadline, NIST SP 800-53 rev 4 transitions and the 3PAO privitization progress to name a few. We wanted to republish t...

US-CERT Warns of More CryptoLocker Ransomware Infections

CryptoLocker is a devious evolution of now-familiar ransomware schemes in which the malware encrypts files it finds on a number of network resources and demands a ransom for the decryption key. US-CERT issued an advisory today warning businesses and consumers of the risks presented by CryptoLocke...

Are you in danger of missing the HIPAA Omnibus?

On September 23, 2013, many companies will be required by law to comply with HIPAA…and they dont even know it. Specifically, the final HIPAA Omnibus Rule pulls all companies under the law if they store, process, or transmit PHI data as part of their business processes. While the Omnibus Rule was...