High-Severity Cisco Webex Flaws Fixed

Cisco Systems has patched two high-severity vulnerabilities in its popular Webex video conferencing platform, which if exploited could allow an attacker to execute code on affected systems. Two multimedia players tied to the Webex platform are impacted. First is the Cisco Webex Network Recording...

mysql-server:fuzz_real_query: Heap-buffer-overflow in mysql_store_result

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=5731063664214016 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzrealquery Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash...

Apache Log4j - Arbitrary Code Execution in confserver/confluence (master)

h3. Issue Summary Arbitrary Code Execution in confserver/confluence master h3. Steps to Reproduce Vulnerability: Arbitrary Code Execution Severity: color:f9423aHighcolor Project: confserver/confluence Branch: master Scan Date: Unknown Vulnerability ID: CVE-2019-17571 log4j-core is vulnerable to...

libspectre:spectre_read_fuzzer: Heap-buffer-overflow in mem_true32_fill_rectangle

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5682195626983424 Project: libspectre Fuzzing Engine: honggfuzz Fuzz Target: spectrereadfuzzer Job Type: honggfuzzasanlibspectre Platform Id: linux Crash Type: Heap-buffer-overflow...

GhostCat: New High-Risk Vulnerability Affects Servers Running Apache Tomcat

If your web server is running on Apache Tomcat, you should immediately install the latest available version of the server application to prevent hackers from taking unauthorized control over it. Yes, that's possible because all versions 9.x/8.x/7.x/6.x of the Apache Tomcat released in the past 13...

harfbuzz:hb-draw-fuzzer: Heap-use-after-free in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5088336521986048 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-draw-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x61b000065bf9...

Unpatched Security Flaws Open Connected Vacuum to Takeover

SAN FRANCISCO – Researchers have discovered several high-severity vulnerabilities in a connected vacuum cleaner. The security holes could give remote attackers the capability to launch an array of attacks — from a denial of service DoS attack that renders the vacuum unusable, to viewing private...

Install Latest Chrome Update to Patch 0-Day Bug Under Active Attacks

Google yesterday released a new critical software update for its Chrome web browser for desktops that will be rolled out to Windows, Mac, and Linux users over the next few days. The latest Chrome 80.0.3987.122 includes security fixes for three new vulnerabilities, all of which have been marked...

pcre2:pcre2_fuzzer: Crash in match

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed Report: https://oss-fuzz.com/testcase?key=6290883744104448 Project: pcre2 Fuzzing Engine: libFuzzer Fuzz Target: pcre2fuzzer Job Type: libfuzzermsanpcre2 Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7fff9416d140 Crash State:...

osquery:osqueryfuzz-sqlquery: Heap-use-after-free in binCollFunc

Project: https://github.com/osquery/osquery.git Detailed Report: https://oss-fuzz.com/testcase?key=5174631483047936 Project: osquery Fuzzing Engine: libFuzzer Fuzz Target: osqueryfuzz-sqlquery Job Type: libfuzzerasanosquery Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address:...

openssl:client: Heap-use-after-free in CRYPTO_DOWN_REF

Project: https://github.com/openssl/openssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5131160508432384 Project: openssl Fuzzing Engine: libFuzzer Fuzz Target: client Job Type: libfuzzerasanopenssl Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address: 0x60f00002d56...

Mozilla Firefox 73 Browser Update Fixes High-Severity RCE Bugs

Mozilla has launched the latest version of its Firefox browser, which knocks out high-severity security flaws that leave systems open to attack by a remote adversary. The patched version of Mozilla’s browser, launched on Tuesday, is Firefox 73 and Firefox ESR 68.5. The Firefox ESR browser is its...

njs:njs_process_script_fuzzer: Heap-buffer-overflow in njs_json_append_string

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5142681640763392 Project: njs Fuzzing Engine: afl Fuzz Target: njsprocessscriptfuzzer Job Type: aflasannjs Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x625000a18900 Crash State:...

Brocade Fabric OS Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-30367 Potential Impact: Information Disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2019-16204 Summary Description: Brocade has released software security updates for Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d...

Multi-Vendor Desktop & WorkStation BIOS Security Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-28078 Potential Impact: Escalation of Privilege, Denial of Service, Information Disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2019-6190 Summary Description: When possible, Lenovo consolidates multiple BIOS security fixes and enhancement...

Intel CSME Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-30525 Potential Impact: Privilege escalation, denial of service, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2019-14598 Summary Description: Intel reported a potential security vulnerability in CSME subsystem may allow...

envoy:server_fuzz_test: Heap-use-after-free in Envoy::Upstream::StrictDnsClusterImpl::ResolveTarget::~ResolveTarget

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5143265307525120 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: serverfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

February 2020 Security Releases

February 2020 Security Releases Update 6-February-2020 Security releases available Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.js versions can be...

Zero Day Initiative Bug Hunters Rake in $1.5M in 2019

Zero Day Initiative ZDI awarded more than $1.5 million in cash and prizes to bug-hunters throughout 2019, it said, resulting in 1,035 security vulnerability advisories for the year. Most of those advisories 88 percent were published in conjunction with a patch from the vendor, Zero Day Initiative...

Cisco Patches Two High-Severity Bugs in its Small Business Switch Lineup

Cisco Systems released security patches on Wednesday for high-severity vulnerabilities affecting over a half dozen of its small business switches. The flaws allow remote unauthenticated adversaries to access sensitive information and level denial-of-service DoS attacks against affected gear...