Multi-vendor BIOS Security Vulnerabilities (June 2020) - Lenovo Support US

Lenovo Security Advisory: LEN-30042 Potential Impact: Privilege escalation, denial of service, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2020-0528, CVE-2020-0529, CVE-2020-8320, CVE-2020-8321, CVE-2020-8322, CVE-2020-8323, CVE-2020-8333, CVE-2020-833...

Multi-vendor BIOS Security Vulnerabilities (June 2020) - Lenovo Support US

No description provided...

Intel SSD Advisory - Lenovo Support US

Lenovo Security Advisory: LEN-30040 Potential Impact: Information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2020-0527 Summary Description: Intel reported a potential security vulnerability in Intel Solid State Drive SSD products that may allow information...

opensc:fuzz_pkcs15_reader: Stack-buffer-overflow in tcos_decipher

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5226571123392512 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerasanopensc Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address:...

pcapplusplus:FuzzTarget: Crash in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=4818312294039552 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

ndpi:fuzz_ndpi_reader: Heap-use-after-free in ndpi_http_check_content

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5150034495799296 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x62b00000fbf3 Cra...

pcapplusplus:FuzzTarget: Bad-cast to pcpp::IDnsResource from invalid vptr in pcpp::DnsLayer::~DnsLayer

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5187603245826048 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000263260...

libspng:spng_read_fuzzer: Heap-double-free in spng__free

Project: https://gitlab.com/randy408/libspng.git https://github.com/randy408/libspng.git Detailed Report: https://oss-fuzz.com/testcase?key=6554438277005312 Project: libspng Fuzzing Engine: libFuzzer Fuzz Target: spngreadfuzzer Job Type: libfuzzerasanlibspng Platform Id: linux Crash Type:...

suricata:fuzz_sigpcap: Heap-use-after-free in DetectParseDupSigCompareFunc

Project: https://github.com/OISF/suricata.git Detailed Report: https://oss-fuzz.com/testcase?key=5103702007611392 Project: suricata Fuzzing Engine: honggfuzz Fuzz Target: fuzzsigpcap Job Type: honggfuzzasansuricata Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

cras:rclient_message: Heap-buffer-overflow in surround51_to_stereo_downmix_mtx

Detailed Report: https://oss-fuzz.com/testcase?key=5731428137697280 Project: cras Fuzzing Engine: honggfuzz Fuzz Target: rclientmessage Job Type: honggfuzzasancras Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x6030000414bc Crash State: surround51tostereodownmixmtx...

Critical Cisco Bug in Unified CCX Allows Remote Code Execution

Cisco has hurried out a fix out for a critical remote code-execution flaw in its customer interaction management solution, Cisco Unified Contact Center Express CCX. Cisco’s Unified CCX software is touted as a “contact center in a box” that allows companies to deploy customer-care applications. Th...

firestore:firestore_serializer_fuzzer: Crash in pb_release_single_field

Detailed Report: https://oss-fuzz.com/testcase?key=5691535105720320 Project: firestore Fuzzing Engine: afl Fuzz Target: serializerfuzzer Job Type: aflasanfirestore Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0xfffffffffffffff1 Crash State: pbreleasesinglefield pbrelease pbdecode...

keystone:fuzz_asm_x86_64: Bad-cast to const llvm_ks::MCSectionELF from llvm_ks::MCSectionMachO in llvm_ks::MCELFStreamer::ChangeSection

Detailed Report: https://oss-fuzz.com/testcase?key=5733234540544000 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8664 Job Type: libfuzzerubsankeystone Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000002a51160 Crash State: Bad-cast to const llvmks::MCSectionELF from...

envoy:codec_impl_fuzz_test: Bad-cast to testing::internal::FunctionMocker<Envoy::Network::Connection::State ()> from testing::internal::UntypedFunctionMockerBase in Envoy::Network::MockConnection::state

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5653835151572992 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffe11206980 Crash...

Cisco Fixes High-Severity Flaws In Firepower Security Software, ASA

Cisco has stomped out 12 high-severity vulnerabilities across several network security products. The flaws can be exploited by unauthenticated remote attackers to launch an array of attacks – from denial of service DoS to sniffing out sensitive data. Specifically affected is Cisco’s Firepower...

graphicsmagick:coder_WPG_fuzzer: Heap-use-after-free in ImportGrayQuantumType

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6294798204141568 Project: graphicsmagick Fuzzing Engine: afl Fuzz Target: coderWPGfuzzer Job Type: aflasangraphicsmagick Platform Id: linux Crash Type: Heap-use-after-free WRITE 2 Crash Address...

[ASA-202005-4] a2ps: multiple issues

Arch Linux Security Advisory ASA-202005-4 ========================================= Severity: High Date : 2020-05-06 CVE-ID : CVE-2014-0466 CVE-2015-8107 Package : a2ps Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1150 Summary ======= The package a2ps before versio...

BlogEngine 3.3 - (syndication.axd) XML External Entity Injection Vulnerability

Exploit for xml platform in category web applications Title: BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection Author: Daniel Martinez Adan aDoN90 Homepage: https://blogengine.io/ Software Link: https://blogengine.io/support/download/ Affected Versions: 3.3 Vulnerability: XML...

oniguruma:fuzzer: Heap-use-after-free in node_min_byte_len

Detailed Report: https://oss-fuzz.com/testcase?key=5650250581934080 Project: oniguruma Fuzzing Engine: afl Fuzz Target: fuzzer Job Type: aflasanoniguruma Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x6070000005d0 Crash State: nodeminbytelen tunequant tunetree Sanitize...

HardDrive 2.1 Arbitrary File Upload

Document Title: =============== HardDrive v2.1 iOS - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2221 Release Date: ============= 2020-04-29 Vulnerability Laboratory ID VL-ID: ====================================...