imagemagick/encoder_dng_fuzzer: Index-out-of-bounds in LibRaw::scale_colors_loop

Detailed report: https://oss-fuzz.com/testcase?key=4830316907724800 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderdngfuzzer Fuzz target binary: encoderdngfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext. Specifically, it stores customer data in unique directories...

imagemagick/encoder_mvg_fuzzer: Crash in TracePath

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5349958956875776 Project: imagemagick Fuzzer: libFuzzerimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

envoy/h1_capture_fuzz_test: Heap-use-after-free in Envoy::FakeRawConnection::FakeRawConnection

Detailed report: https://oss-fuzz.com/testcase?key=6215556767154176 Project: envoy Fuzzer: libFuzzerenvoyh1capturefuzztest Fuzz target binary: h1capturefuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6120000fdf68 Crash State:...

DiliCMS Cross-Site Scripting Vulnerability

DiliCMS aka DiligentCMS is a content management system CMS based on Codelgniter. A cross-site scripting vulnerability exists in the System Settings - Site Settings filing number field of the admin/index.php file in DiliCMS version 2.4.0. A remote attacker can exploit this vulnerability to inject...

imagemagick/encoder_heic_fuzzer: Heap-buffer-overflow in ff_hevc_put_hevc_qpel_pixels_8_sse

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5358449251581952 Project: imagemagick Fuzzer: aflimagemagickencoderheicfuzzer Fuzz target binary: encoderheicfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

IC3 Issues Alert on Tech Support Fraud

The Internet Crime Complaint Center IC3 has released an alert on tech support fraud. Tech support fraud involves criminals claiming to provide technical support to fix problems that don't exist. Their methods include placing calls, sending pop-ups, engaging misleading lock screens, and sending...

A cure for the common cold call: freeze them out

The phone rings and it's a number I don’t recognize. That’s enough to bring my mood down a few degrees. It shouldn’t, but unfortunately experience has taught me that at least 95 percent of the calls from numbers that are “private” or that I don’t have an account name stored for on my phone are...

graphicsmagick/coder_XCF_fuzzer: Use-of-uninitialized-value in AlphaCompositePixel

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5069895264894976 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderXCFfuzzer Fuzz target binary: coderXCFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

skia/path_deserialize: Heap-buffer-overflow in SkPath::moveTo

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5078673775394816 Project: skia Fuzzer: libFuzzerskiapathdeserialize Fuzz target binary: pathdeserialize Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash...

A week in security (January 29 – February 04)

Last week on Labs, we looked into PUPs stealing and using mainstream logos of security and tech companies to further gain user trust, GandCrab and Scarab ransomware variants in the wild, and a new Mac malware called OSX.CreativeUpdater that can be distributed via MacUpdate. We also profiled...

tor/oss-fuzz-consensus: Heap-buffer-overflow in mock_crypto_pk_public_checksig__nocheck

Project: https://git.torproject.org/tor.git Detailed report: https://oss-fuzz.com/testcase?key=5170904637112320 Project: tor Fuzzer: libFuzzertoross-fuzz-consensus Fuzz target binary: oss-fuzz-consensus Job Type: libfuzzerasantor Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

tor/oss-fuzz-extrainfo: Use-of-uninitialized-value in memarea_strdup

Project: https://git.torproject.org/tor.git Detailed report: https://oss-fuzz.com/testcase?key=6117917679681536 Project: tor Fuzzer: libFuzzertoross-fuzz-extrainfo Fuzz target binary: oss-fuzz-extrainfo Job Type: libfuzzermsantor Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

dlplibs: Heap-buffer-overflow in ucnv_UTF8FromUTF8

Detailed report: https://oss-fuzz.com/testcase?key=6715693878738944 Project: dlplibs Fuzzer: libFuzzerdlplibspdbfuzzer Fuzz target binary: pdbfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x604000000afc Crash State: ucnvUTF8FromUTF...

SEC Discloses Hackers Broke Into Edgar Corporate Filing System Last Year

This month has been full of breaches. Now, the Securities and Exchange Commission SEC, the top U.S. markets regulator, has disclosed that hackers managed to hack into its financial document filing system and may have illegally profited from the stolen information. On Wednesday, the SEC announced...

openthread: Stack-buffer-overflow in ot::NetworkData::PrefixTlv::GetSubTlvs

Detailed report: https://oss-fuzz.com/testcase?key=5490815742771200 Project: openthread Fuzzer: libFuzzeropenthreadip6-send-fuzzer Fuzz target binary: ip6-send-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7fb823a8eb22 Crash...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 61 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 61.0.3163.79 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

dlplibs: Container-overflow in libvisio::VSDContentCollector::_generateBezierSegmentsFromNURBS

Detailed report: https://oss-fuzz.com/testcase?key=6337251178971136 Project: dlplibs Fuzzer: libFuzzerdlplibsvsdfuzzer Fuzz target binary: vsdfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Container-overflow READ 8 Crash Address: 0x606000000590 Crash State:...

gdal: Heap-buffer-overflow in memBitRead

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6434613171847168 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

gdal: Heap-buffer-overflow in NASReader::SetFeaturePropertyDirectly

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4908186949648384 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...