libreoffice/slkfuzzer: Global-buffer-overflow in mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_man

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5665026985164800 Project: libreoffice Fuzzer: libFuzzerlibreofficeslkfuzzer Fuzz target binary: slkfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

CVE-2019-0196

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly...

php/php-fuzz-exif: Heap-buffer-overflow in exif_iif_add_value

Detailed report: https://oss-fuzz.com/testcase?key=5724097968865280 Project: php Fuzzer: aflphpphp-fuzz-exif Fuzz target binary: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60400002cbba Crash State: exifiifaddvalue exifiifaddtag...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash Vulnerability

NSS suffers from a NULL dereference issue when parsing Netscape Certificate Sequences in CERTDecodeCertPackage. nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash

nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple formats including PEM, PKCS7, and old Netscape Certificate Sequences. You can generate a Netscape Certificate...

Google Chrome < M73 - Data Race in ExtensionsGuestViewMessageFilter Exploit

Google Chrome M73 - Data Race in ExtensionsGuestViewMessageFilter Exploit There appears to be a race condition in the destruction of the ExtensionsGuestViewMessageFilter if the ProcessIdToFilterMap is modified concurrently. See the comment in the code:...

wireshark/fuzzshark_ip_proto-udp: Heap-buffer-overflow in g_array_append_vals

Detailed report: https://oss-fuzz.com/testcase?key=5765508667801600 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6030001d9c62...

radare2/ia_fuzz: Heap-buffer-overflow in r_utf8_strlen

Project: https://github.com/radare/radare2.git Detailed report: https://oss-fuzz.com/testcase?key=5683914623942656 Project: radare2 Fuzzer: aflradare2iafuzz Fuzz target binary: iafuzz Job Type: aflasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x623000102d02...

tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump sourc...

capstone/fuzz_disasmnext: Use-of-uninitialized-value in printOperand

Detailed report: https://oss-fuzz.com/testcase?key=5687796902133760 Project: capstone Fuzzer: libFuzzercapstonefuzzdisasmnext Fuzz target binary: fuzzdisasmnext Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: printOperand...

SecLists - A Collection Of Multiple Types Of Lists Used During Security Assessments, Collected In One Place (Usernames, Passwords, URLs, Sensitive Data Patterns, Fuzzing Payloads, Web Shells, And Many More)

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security...

Scalable Fuzzing Infrastructure: ClusterFuzz

ClusterFuzz is a scalable fuzzing infrastructure which finds security and stability issues in software. It is used by Google for fuzzing the Chrome Browser, and serves as the fuzzing backend for OSS-Fuzz . ClusterFuzz provides many features which help seamlessly integrate fuzzing into a software...

CANalyzat0r - Security Analysis Toolkit For Proprietary Car Protocols

This software project is a result of a Bachelor's thesis created atSCHUTZWERK in collaboration with Aalen University by Philipp Schmied. Please refer to the correspondingblog post for more information. Why another CAN tool? Built from scratch with new ideas for analysis mechanisms Bundles feature...

Fuzzing para-virtualized devices in Hyper-V

Introduction Introduction Hyper-V is the backbone of Azure, running on its Hosts to provide efficient and fair sharing of resources, but also isolation. That’s why we, in the vulnerability research team for Windows, have been working in the background for years now helping secure Hyper-V. And why...

Fuzzing para-virtualized devices in Hyper-V

Introduction Hyper-V is the backbone of Azure, running on its Hosts to provide efficient and fair sharing of resources, but also isolation. That’s why we, in the vulnerability research team for Windows, have been working in the background for years now helping secure Hyper-V. And why Microsoft...

readstat/fuzz_format_sas7bcat: Heap-buffer-overflow in readstat_convert

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5673098437722112 Project: readstat Fuzzer: aflreadstatfuzzformatsas7bcat Fuzz target binary: fuzzformatsas7bcat Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

MemITM - Tool To Make In Memory Man In The Middle

The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them ...

FreeBSD : chromium -- multiple vulnerabilities (546d4dd4-10ea-11e9-b407-080027ef1a23)

Google Chrome Releases reports : 43 security fixes in this release, including : - High CVE-2018-17480: Out of bounds write in V8 - High CVE-2018-17481: Use after free in PDFium - High CVE-2018-18335: Heap buffer overflow in Skia - High CVE-2018-18336: Use after free in PDFium - High CVE-2018-1833...

clamav/clamav_scanmap_PDF_fuzzer: Heap-buffer-overflow in pdf_nextlinestart

Detailed report: https://oss-fuzz.com/testcase?key=5168958492114944 Project: clamav Fuzzer: aflclamavscanmapPDFfuzzer Fuzz target binary: clamavscanmapPDFfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x611000188a6a Crash State:...

Epic Holiday Cookie Baking

One aspect of being a penetration tester that is always rewarding is the process of rabbit-holing into an area of interest and letting the data guide me to my destination. Recently, while updating and testing new code on a custom cookie fuzzing tool Anomalous Cookie -...