WordPress Patches 3-Year-Old High-Severity RCE Bug

WordPress released a 5.5.2 update to its ubiquitous web publishing software platform. The update patches a high-severity bug, which could allow a remote unauthenticated attacker to take over a targeted website via a narrowly tailored denial-of-service attack. In all, the WordPress Security and...

ffmpeg:ffmpeg_dem_VIVIDAS_fuzzer: Heap-buffer-overflow in avio_read

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6581200338288640 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegdemVIVIDASfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x6150000001e5...

Nvidia Warns Gamers of Severe GeForce Experience Flaws

Nvidia, which makes gaming-friendly graphics processing units GPUs, has issued fixes for two high-severity flaws in the Windows version of its GeForce Experience software. GeForce Experience is a supplemental application to the GeForce GTX graphics card — it keeps users’ drivers up-to-date,...

New Chrome 0-day Under Active Attacks – Update Your Browser Now

Attention readers, if you are using Google Chrome browser on your Windows, Mac, or Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today. Google released Chrome version 86.0.4240.111 today to patch several security...

[ASA-202010-4] linux-lts: multiple issues

Arch Linux Security Advisory ASA-202010-4 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux-lts Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1250 Summary ======= The...

wolfssl:fuzzer-wolfssl-server-randomize: Heap-buffer-overflow in fp_to_unsigned_bin_at_pos

Detailed Report: https://oss-fuzz.com/testcase?key=5123165615030272 Project: wolfssl Fuzzing Engine: afl Fuzz Target: fuzzer-wolfssl-server-randomize Job Type: aflasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x602000001040 Crash State: fptounsignedbinatpo...

leptonica:graphics_fuzzer: Heap-buffer-overflow in pixFindHorizontalRuns

Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=5084149326807040 Project: leptonica Fuzzing Engine: afl Fuzz Target: graphicsfuzzer Job Type: aflasanleptonica Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...

pcapplusplus:FuzzTarget: Bad-cast to pcpp::IDnsResource from invalid vptr in pcpp::DnsLayer::parseResources

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=4695026405474304 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000190260...

Google Rolls Out Fixes for High-Severity Android System Flaws

Google has released patches addressing high-severity flaws in its System component. The flaws could be remotely exploited to gain access to additional permissions. Overall, 50 flaws were patched as part of Google’s October security update for the Android operating system, released on Monday. As...

AMD Radeon Driver Vulnerability - Lenovo Support US

No description provided...

AMD Radeon Driver Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-48973 Potential Impact: Denial of service Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2020-12933 Summary Description: AMD reported a potential vulnerability in AMD Radeon graphics drivers that could result in denial of service. Mitigation Strate...

Cloud Networking Operating System (CNOS) Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-44423 Potential Impact: Remote code execution Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2020-8349 Summary Description: An internal security review has identified an unauthenticated remote code execution vulnerability in CNOS’ optional REST A...

Lenovo ThinkPad Stack Wireless Router Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-48228 Potential Impact: Privilege escalation Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2020-8350 Summary Description: An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router that could allow escalation of...

Lenovo ThinkPad Stack Wireless Router Vulnerability - Lenovo Support US

No description provided...

CVE-2020-5422: UAA password may appear in BOSH System Metrics Server process arguments | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM through ps or looking at process...

Cisco Issues Patches For 2 High-Severity IOS XR Flaws Under Active Attacks

Cisco yesterday released security patches for two high-severity vulnerabilities affecting its IOS XR software that were found exploited in the wild a month ago. Tracked as CVE-2020-3566 and CVE-2020-3569, details for both zero-day unauthenticated DoS vulnerabilities were made public by Cisco late...

openh264:decoder_fuzzer: Heap-buffer-overflow in WelsDec::WelsDecodeMbCabacPSlice

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5730626752479232 Project: openh264 Fuzzing Engine: afl Fuzz Target: decoderfuzzer Job Type: aflasanopenh264 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash Address: 0x61800000379b...

[ASA-202009-14] yaws: multiple issues

Arch Linux Security Advisory ASA-202009-14 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-12872 CVE-2020-24379 CVE-2020-24916 Package : yaws Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1228 Summary ======= The packag...

Cisco Patch-Palooza Tackles 29 High-Severity Bugs

Cisco Systems released a barrage of patches, Thursday, aimed at fixing bugs in the networking giant’s ubiquitous IOS operating system. The patches plug holes in a wide range of products and address denial-of-service, file overwrite and input validation attacks. The advisory was planned and part o...

libavif:avif_decode_fuzzer: Heap-use-after-free in avifFileTypeIsCompatible

Project: https://github.com/AOMediaCodec/libavif.git Detailed Report: https://oss-fuzz.com/testcase?key=6481926825967616 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: avifdecodefuzzer Job Type: libfuzzerasanlibavif Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...