VMware Releases Security Update

VMware has released a security update to address a vulnerability in VMware AirWatch Agent. A remote attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review the VMware Security Advisory VMSA-2018-0015 and apply the...

poppler/pdf_fuzzer: Use-of-uninitialized-value in clip01

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5669907504037888 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type:...

chakra: Crash in JsUtil::BaseDictionary<int, SList<Js::InlineCache*, Memory::ArenaAllocator, Fake

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=5985642830888960 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001048 Crash State: JsUtil::BaseDictionaryint,...

Mozilla Releases Security Update

Mozilla has released security updates to address vulnerabilities in Firefox and Firefox ESR. A remote attacker could exploit these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the Mozilla Security Advisory for Firefox 60.0.2 and Firefo...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address vulnerabilities in Flash Player. A remote attacker could exploit these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review Adobe Security Bulletin APSB18-19 and apply the necessary updates. This...

poppler/pdf_fuzzer: Use-of-uninitialized-value in JBIG2Bitmap::getSlice

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5086816502808576 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type:...

systemd/fuzz-journal-remote: Use-of-uninitialized-value in ascii_is_valid

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=5661112182767616 Project: systemd Fuzzer: libFuzzersystemdfuzz-journal-remote Fuzz target binary: fuzz-journal-remote Job Type: libfuzzermsansystemd Platform Id: linux Crash Type:...

Apple Releases Security Updates

Apple has released a security update for macOS High Sierra and supplemental updates for Sierra and El Capitan to address multiple vulnerabilities. An attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the...

Google Releases Security Update for Chrome

Google has released Chrome version 67.0.3396.62 for Windows, Mac, and Linux. This version addresses vulnerabilities that a remote attacker could exploit to take control of an affected system. NCCIC encourages users and administrators to review the Chrome Releases page and apply the necessary...

poppler/pdf_fuzzer: Use-of-uninitialized-value in FT_Set_Transform

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=6193455704309760 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type:...

IRS Warns Tax Professionals of Phishing Scam

The Internal Revenue Service IRS has issued a news release warning tax professionals to beware of a new phishing email scam. Cyber criminals posing as state accounting and professional associations have been sending emails to entice their targets to reveal login credentials. Tax practitioners...

poppler/pdf_fuzzer: Use-of-uninitialized-value in JBIG2Stream::readSymbolDictSeg

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5760120146362368 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type:...

llvm/llvm-dwarfdump-fuzzer: Heap-buffer-overflow in readInitExpr

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=4659922781339648 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow...

imagemagick/encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::median4

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4802636141297664 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderdngfuzzer Fuzz target binary: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Mozilla Releases Security Update for Thunderbird

Mozilla has released a security update to address vulnerabilities in Thunderbird. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the Mozilla Security Advisory for Thunderbird 52.8 and apply th...

Design/Logic Flaw

DISPUTED The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an...

UBUNTU-CVE-2017-17688

DISPUTED The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an...

CVE-2017-17688

CVE-2017-17688 concerns an OpenPGP CFB gadget/malleability attack (EFAIL) that can lead to plaintext exfiltration from encrypted emails. Connected advisories show Enigmail/OpenPGP patches (e.g., openSUSE SUSE/OpenSUSE-2019-368/395; Thunderbird enigmail updates) addressing this vulnerability by ti...

skia/image_filter_deserialize_width: Use-of-uninitialized-value in SkBlurMaskFilterImpl::filterRRectToNine

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5735437942390784 Project: skia Fuzzer: libFuzzerskiaimagefilterdeserializewidth Fuzz target binary: imagefilterdeserializewidth Job Type: libfuzzermsanskia Platform Id: linux Crash Type:...

PT-2018-6546 · Openpgp +1 · Openpgp +1

Name of the Vulnerable Software and Affected Versions: OpenPGP affected versions not specified Description: The issue allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration. This is reportedly a problem in applications that mishandle the...