libreoffice/slkfuzzer: Global-buffer-overflow in mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_man

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5665026985164800 Project: libreoffice Fuzzer: libFuzzerlibreofficeslkfuzzer Fuzz target binary: slkfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

CVE-2019-0196

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly...

Mutiny Fuzzing Framework - Network Fuzzer That Operates By Replaying PCAPs Through A Mutational Fuzzer

The Mutiny Fuzzing Framework is a network fuzzer that operates by replaying PCAPs through a mutational fuzzer. The goal is to begin network fuzzing as quickly as possible, at the expense of being thorough. The general workflow for Mutiny is to take a sample of legitimate traffic, such as a browse...

php/php-fuzz-exif: Heap-buffer-overflow in exif_iif_add_value

Detailed report: https://oss-fuzz.com/testcase?key=5724097968865280 Project: php Fuzzer: aflphpphp-fuzz-exif Fuzz target binary: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60400002cbba Crash State: exifiifaddvalue exifiifaddtag...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash Vulnerability

NSS suffers from a NULL dereference issue when parsing Netscape Certificate Sequences in CERTDecodeCertPackage. nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash

nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple formats including PEM, PKCS7, and old Netscape Certificate Sequences. You can generate a Netscape Certificate...

Google Chrome < M73 - Data Race in ExtensionsGuestViewMessageFilter Exploit

Google Chrome M73 - Data Race in ExtensionsGuestViewMessageFilter Exploit There appears to be a race condition in the destruction of the ExtensionsGuestViewMessageFilter if the ProcessIdToFilterMap is modified concurrently. See the comment in the code:...

wireshark/fuzzshark_ip_proto-udp: Heap-buffer-overflow in g_array_append_vals

Detailed report: https://oss-fuzz.com/testcase?key=5765508667801600 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6030001d9c62...

radare2/ia_fuzz: Heap-buffer-overflow in r_utf8_strlen

Project: https://github.com/radare/radare2.git Detailed report: https://oss-fuzz.com/testcase?key=5683914623942656 Project: radare2 Fuzzer: aflradare2iafuzz Fuzz target binary: iafuzz Job Type: aflasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x623000102d02...

tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump sourc...

capstone/fuzz_disasmnext: Use-of-uninitialized-value in printOperand

Detailed report: https://oss-fuzz.com/testcase?key=5687796902133760 Project: capstone Fuzzer: libFuzzercapstonefuzzdisasmnext Fuzz target binary: fuzzdisasmnext Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: printOperand...

SecLists - A Collection Of Multiple Types Of Lists Used During Security Assessments, Collected In One Place (Usernames, Passwords, URLs, Sensitive Data Patterns, Fuzzing Payloads, Web Shells, And Many More)

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security...

Scalable Fuzzing Infrastructure: ClusterFuzz

ClusterFuzz is a scalable fuzzing infrastructure which finds security and stability issues in software. It is used by Google for fuzzing the Chrome Browser, and serves as the fuzzing backend for OSS-Fuzz . ClusterFuzz provides many features which help seamlessly integrate fuzzing into a software...

CDF - Crypto Differential Fuzzing

CDF is a tool to automatically test the correctness and security of cryptographic software. CDF can detect implementation errors, compliance failures, side-channel leaks, and so on. CDF implements a combination of unit tests with "differential fuzzing", an approach that compares the behavior of...

CANalyzat0r - Security Analysis Toolkit For Proprietary Car Protocols

This software project is a result of a Bachelor's thesis created atSCHUTZWERK in collaboration with Aalen University by Philipp Schmied. Please refer to the correspondingblog post for more information. Why another CAN tool? Built from scratch with new ideas for analysis mechanisms Bundles feature...

Fuzzing para-virtualized devices in Hyper-V

Introduction Hyper-V is the backbone of Azure, running on its Hosts to provide efficient and fair sharing of resources, but also isolation. That’s why we, in the vulnerability research team for Windows, have been working in the background for years now helping secure Hyper-V. And why Microsoft...

Fuzzing para-virtualized devices in Hyper-V

Introduction Introduction Hyper-V is the backbone of Azure, running on its Hosts to provide efficient and fair sharing of resources, but also isolation. That’s why we, in the vulnerability research team for Windows, have been working in the background for years now helping secure Hyper-V. And why...

Htcap - A Web Application Scanner Able To Crawl Single Page Application (SPA) In A Recursive Manner By Intercepting Ajax Calls And DOM Changes

Htcap is a web application scanner able to crawl single page application SPA in a recursive manner by intercepting ajax calls and DOM changes. Htcap is not just another vulnerability scanner since it's focused on the crawling process and it's aimed to detect and intercept ajax/fetch calls,...

readstat/fuzz_format_sas7bcat: Heap-buffer-overflow in readstat_convert

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5673098437722112 Project: readstat Fuzzer: aflreadstatfuzzformatsas7bcat Fuzz target binary: fuzzformatsas7bcat Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

MemITM - Tool To Make In Memory Man In The Middle

The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them ...