gdal: Heap-buffer-overflow in OGRReadWKBGeometryType

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5710786179629056 Project: gdal Fuzzer: libFuzzergdalwkbimportfuzzer Fuzz target binary: wkbimportfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Addres...

gdal: Heap-buffer-overflow in NITFGetField

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5956305300750336 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 5 Crash Address:...

ffmpeg: Index-out-of-bounds in decode_residual

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=6246484833992704 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDH264fuzzer Fuzz target binary: ffmpegAVCODECIDH264fuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds...

harfbuzz: Index-out-of-bounds in hb_ot_face_glyf_accelerator_t::get_extents

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=4523479581851648 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-fuzzer Fuzz target binary: hb-fuzzer Job Type: libfuzzerubsanharfbuzz Platform Id: linux Crash Type: Index-out-of-bounds Crash Addres...

ffmpeg: Heap-buffer-overflow in ff_htmlmarkup_to_ass

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5520132195483648 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDSAMIfuzzer Fuzz target binary: ffmpegAVCODECIDSAMIfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow...

teknion.com XSS vulnerability

Vulnerable URL: http://www.teknion.com/pricingmodule/filing-storageledger/default.asp?country=canada%22%27%20Style=position:fixed;top:0;left:0;font-size:999px;%20Onmouseenter=confirmOPENBUGBOUNTY%20//=filingstorage=all=ledger=pricing==Accessories=LFA= Details: Description| Value ---|--- Patched:|...

wireshark: Heap-buffer-overflow in OALMarshal_UncompressValue

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=5900099865542656 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerasanwireshark Platform Id...

libyaml: Use-of-uninitialized-value in yaml_parser_scan_flow_scalar

Project: https://github.com/yaml/libyaml.git Detailed report: https://oss-fuzz.com/testcase?key=5607885063061504 Project: libyaml Fuzzer: libFuzzerlibyamlfuzzer Fuzz target binary: libyamlfuzzer Job Type: libfuzzermsanlibyaml Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=5036643692052480 Project: lcms Fuzzer: afllcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: aflasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Tax-themed phishing and malware attacks proliferate during the tax filing season

Tax-themed scams and social engineering attacks are as certain as death or tax itself. Every year we see these attacks, and 2017 is no different. These attacks circulate year-round as cybercriminals take advantage of the different country and region tax schedules, but they peak in the months...

libass: Attempting free in ass_drawing_free

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6332129302544384 Project: libass Fuzzer: libFuzzerlibassfuzzer Fuzz target binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Attempting free Crash...

Yahoo Tells SEC It Knew About Data Breach in 2014

Yahoo fessed up in its latest SEC filing that it knew in 2014 that attackers were on its network and stole information from 500 million accounts. The breach was disclosed in September and Yahoo blamed state-sponsored attackers, a claim that was challenged by some experts who instead said a crimin...

libchewing: Heap-buffer-overflow in _Inner_InternalSpecialSymbol

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4509892513628160 Fuzzer: libFuzzerchewingrandominitfuzzer Job Type: libfuzzerasanlibchewing Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x7f6fe2738fb0 Crash State: InnerInternalSpecialSymbol...

Heap-buffer-overflow in tt_size_select

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4667213659242496 Fuzzer: libFuzzerfreetype2fuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

IRS Announces Safeguards to Protect Taxpayer Information

The Internal Revenue Service IRS has issued two news releases addressing new safeguards to protect taxpayers and strengthen authentication requirements. The electronic filing e-File PIN, an alternative signature verification tool used to assist with electronic tax filing, will no longer be...

Stable Channel Update

The Chrome team is delighted to announce the promotion of Chrome 50 to the stable channel for Windows, Mac and Linux. Chrome 50.0.2661.75 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new...

Remote Command Execution Vulnerability in ACE Information Security Filing and Adverse Information Monitoring System

ACE Mingjian Website Security Filing and Undesirable Information Detection System is a security monitoring system that integrates the three major functions of automatic website domain name collection, automatic website filing verification and automatic monitoring of undesirable information of...

FBI may have found a New Way to Unlock Shooter's iPhone without Apple

There's more coming to the high-profile Apple vs. FBI case. The Federal Bureau of Investigation FBI might not need Apple's assistance to unlock iPhone 5C that belonged to San Bernardino shooter, Syed Rizwan Farook. If you have followed the San Bernardino case closely, you probably know everything...

QNAP Systems QNAP QTS Directory Traversal Vulnerability

QNAP Systems QNAP QTS is a Turbo NAS operating system from QNAP Systems. A directory traversal vulnerability exists in QNAP Systems QNAP QTS. When AFP is enabled in the program, a remote attacker can read or write arbitrary files by submitting a special directory traversal request while accessing...

SQL Injection Vulnerability in the Key Parameters of Investment Project Filing System of Zhongshan Netizen Software Co.

Zhongshan City, the net government software limited company investment project filing system is based on modern network technology and database technology to achieve an online e-government system. There is a SQL injection vulnerability in the key parameter of the Investment Project Filing...