sleuthkit:sleuthkit_mmls_gpt_fuzzer: Index-out-of-bounds in tsk_img_read

Project: https://github.com/sleuthkit/sleuthkit.git Detailed Report: https://oss-fuzz.com/testcase?key=6482187290148864 Project: sleuthkit Fuzzing Engine: libFuzzer Fuzz Target: sleuthkitmmlsgptfuzzer Job Type: libfuzzerubsansleuthkit Platform Id: linux Crash Type: Index-out-of-bounds Crash...

openexr:openexr_exrenvmap_fuzzer: Segv on unknown address in Imf_2_5::hufUncompress

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5896229264031744 Project: openexr Fuzzing Engine: afl Fuzz Target: openexrexrenvmapfuzzer Job Type: aflasanopenexr Platform Id: linux Crash Type: Segv on unknown address Crash...

OSV-2020-1600 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24786 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBasecryptofuzz::component::Ciphertext, cryptofuzz::operatio cryptofuzz::ExecutorBasecryptofuzz::component::Ciphertex...

rdkit:mol_data_stream_to_mol_fuzzer: Bad-cast to RDKit::Atom from invalid vptr in RDKit::SubstanceGroup::addAtomWithBookmark

Detailed Report: https://oss-fuzz.com/testcase?key=6001237489876992 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzerubsanrdkit Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000032d2ea0 Crash State: Bad-cast to RDKit::Atom from invalid...

Barbervisor: Journey developing a snapshot fuzzer with Intel VT-x

By Cory Duplantis. One of the ways vulnerability researchers find bugs is with fuzzing. At a high level, fuzzing is the process of generating and mutating random inputs for a given target to crash it. In 2017, I started developing a bare metal hypervisor for the purposes of snapshot fuzzing:...

cryptofuzz:cryptofuzz-boringssl-noasm: Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5726830049624064 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type:...

aflnet

It is an offensive tool for Network protocols. The repository contains a greybox fuzzer for protocol implementations, named AFLNet. It takes a mutational approach and uses state-feedback, in addition to code-coverage feedback, to guide the fuzzing process. AFLNet is seeded with a corpus of record...

skia:sksl2spirv: Heap-use-after-free in SkSL::VariableReference::~VariableReference

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=4899879000997888 Project: skia Fuzzing Engine: afl Fuzz Target: sksl2spirv Job Type: aflasanskia Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60e00002c218 Crash State:...

skia:sksl2spirv: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5806581326020608 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2spirv Job Type: libfuzzerubsanskia Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: undefined UBSAN Crash...

libucl:ucl_add_string_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6498000277602304 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerubsanlibucl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000ec99ae8 Crash State: NULL Sanitizer: undefined UBSAN...

CWFF - Create Your Custom Wordlist For Fuzzing

CWFF is a tool that creates a special High quality fuzzing/content discovery wordlist for you at the highest speed possible using concurrency and it's heavily inspired by @tomnomnom's Who, What, Where, When, Wordlist NahamCon2020. Usage CWFF -h --threads --github --subdomains --recursive...

ndpi:fuzz_ndpi_reader: Heap-buffer-overflow in ndpi_workflow_process_packet

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=6256390180700160 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x604000000140...

rdkit:mol_data_stream_to_mol_fuzzer: Stack-buffer-overflow in RDKit::ParseMolBlockProperties

Detailed Report: https://oss-fuzz.com/testcase?key=5068710860292096 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzerasani386rdkit Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0xffca746f Crash State:...

suricata:fuzz_applayerparserparse: Heap-buffer-overflow in TLSDecodeHSHelloSessionID

Project: https://github.com/OISF/suricata.git Detailed Report: https://oss-fuzz.com/testcase?key=5733181224124416 Project: suricata Fuzzing Engine: libFuzzer Fuzz Target: fuzzapplayerparserparse Job Type: libfuzzerasansuricata Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address...

Oralyzer - Tool To Identify Open Redirection

Oralyzer, a simple python script, capable of identifying the open redirection vulnerability in a website. It does that by fuzzing the url i.e. provided as the input. Features Oralyzer can identify different types of Open Redirect Vulnerabilities : Header Based Javascript Based Meta Tag Based...

assimp:assimp_fuzzer: Heap-buffer-overflow in Assimp::IOStreamBuffer<char>::getNextDataLine

Detailed Report: https://oss-fuzz.com/testcase?key=5183227204206592 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x602000000200 Crash State:...

MMS Exploit Part 3: Constructing the Memory Corruption Primitives

Posted by Mateusz Jurczyk, Project Zero This post is the third of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published a...

onefuzz

:exclamation: IMPORTANT NOTICE :exclamation: August 31...

HawkScan - Security Tool For Reconnaissance And Information Gathering On A Website

Security Tool for Reconnaissance and Information Gathering on a website. python 2.x & 3.x This script use "WafW00f" to detect the WAF in the first step https://github.com/EnableSecurity/wafw00f This script use "Sublist3r" to scan subdomains https://github.com/aboul3la/Sublist3r This script use...

rdkit:smiles_string_to_mol_fuzzer: Stack-buffer-overflow in bool SmilesParseOps::parser::read_int<std::__1::__wrap_iter<char const*> >

Detailed Report: https://oss-fuzz.com/testcase?key=6210527601360896 Project: rdkit Fuzzing Engine: afl Fuzz Target: smilesstringtomolfuzzer Job Type: aflasanrdkit Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7fff0e6f2108 Crash State: bool...