ffmpeg/ffmpeg_AV_CODEC_ID_AGM_fuzzer: Crash in decode_huffman2

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5742854804078592 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDAGMfuzzer Fuzz target binary: ffmpegAVCODECIDAGMfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash...

drAFL - AFL + DynamoRIO = Fuzzing Binaries With No Source Code On Linux

Original AFL supports black-box coverage-guided fuzzing using QEMU mode. I highly recommend to try it first and if it doesn't work you can try this tool. Usage You need to specify DRRUNPATH to point to drrun launcher and LIBCOVPATH to point to libbinafl.so coverage library. You also need to switc...

cryptofuzz/cryptofuzz-openssl-noasm: Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

Project: https://github.com/guidovranken/cryptofuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5734873723043840 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-openssl-noasm Fuzz target binary: cryptofuzz-openssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Cra...

XSStrike v3.1.4 - Most Advanced XSS Detection Suite

XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler. Instead of injecting payloads and checking it works like all the other tools do, XSStrike analyses the response...

libreoffice/slkfuzzer: Global-buffer-overflow in mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_man

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5665026985164800 Project: libreoffice Fuzzer: libFuzzerlibreofficeslkfuzzer Fuzz target binary: slkfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

CVE-2019-0196

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly...

Mutiny Fuzzing Framework - Network Fuzzer That Operates By Replaying PCAPs Through A Mutational Fuzzer

The Mutiny Fuzzing Framework is a network fuzzer that operates by replaying PCAPs through a mutational fuzzer. The goal is to begin network fuzzing as quickly as possible, at the expense of being thorough. The general workflow for Mutiny is to take a sample of legitimate traffic, such as a browse...

php/php-fuzz-exif: Heap-buffer-overflow in exif_iif_add_value

Detailed report: https://oss-fuzz.com/testcase?key=5724097968865280 Project: php Fuzzer: aflphpphp-fuzz-exif Fuzz target binary: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60400002cbba Crash State: exifiifaddvalue exifiifaddtag...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash Vulnerability

NSS suffers from a NULL dereference issue when parsing Netscape Certificate Sequences in CERTDecodeCertPackage. nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash

nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple formats including PEM, PKCS7, and old Netscape Certificate Sequences. You can generate a Netscape Certificate...

Google Chrome < M73 - Data Race in ExtensionsGuestViewMessageFilter Exploit

Google Chrome M73 - Data Race in ExtensionsGuestViewMessageFilter Exploit There appears to be a race condition in the destruction of the ExtensionsGuestViewMessageFilter if the ProcessIdToFilterMap is modified concurrently. See the comment in the code:...

wireshark/fuzzshark_ip_proto-udp: Heap-buffer-overflow in g_array_append_vals

Detailed report: https://oss-fuzz.com/testcase?key=5765508667801600 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6030001d9c62...

radare2/ia_fuzz: Heap-buffer-overflow in r_utf8_strlen

Project: https://github.com/radare/radare2.git Detailed report: https://oss-fuzz.com/testcase?key=5683914623942656 Project: radare2 Fuzzer: aflradare2iafuzz Fuzz target binary: iafuzz Job Type: aflasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x623000102d02...

tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump sourc...

capstone/fuzz_disasmnext: Use-of-uninitialized-value in printOperand

Detailed report: https://oss-fuzz.com/testcase?key=5687796902133760 Project: capstone Fuzzer: libFuzzercapstonefuzzdisasmnext Fuzz target binary: fuzzdisasmnext Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: printOperand...

SecLists - A Collection Of Multiple Types Of Lists Used During Security Assessments, Collected In One Place (Usernames, Passwords, URLs, Sensitive Data Patterns, Fuzzing Payloads, Web Shells, And Many More)

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security...

Scalable Fuzzing Infrastructure: ClusterFuzz

ClusterFuzz is a scalable fuzzing infrastructure which finds security and stability issues in software. It is used by Google for fuzzing the Chrome Browser, and serves as the fuzzing backend for OSS-Fuzz . ClusterFuzz provides many features which help seamlessly integrate fuzzing into a software...

CDF - Crypto Differential Fuzzing

CDF is a tool to automatically test the correctness and security of cryptographic software. CDF can detect implementation errors, compliance failures, side-channel leaks, and so on. CDF implements a combination of unit tests with "differential fuzzing", an approach that compares the behavior of...

CANalyzat0r - Security Analysis Toolkit For Proprietary Car Protocols

This software project is a result of a Bachelor's thesis created atSCHUTZWERK in collaboration with Aalen University by Philipp Schmied. Please refer to the correspondingblog post for more information. Why another CAN tool? Built from scratch with new ideas for analysis mechanisms Bundles feature...

Fuzzing para-virtualized devices in Hyper-V

Introduction Hyper-V is the backbone of Azure, running on its Hosts to provide efficient and fair sharing of resources, but also isolation. That’s why we, in the vulnerability research team for Windows, have been working in the background for years now helping secure Hyper-V. And why Microsoft...