librawspeed/FujiDecompressorFuzzer: Use-after-poison in rawspeed::FujiDecompressor::copy_line_to_xtrans

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=4669760378765312 Project: librawspeed Fuzzer: afllibrawspeedFujiDecompressorFuzzer Fuzz target binary: FujiDecompressorFuzzer Job Type: aflasanlibrawspeed Platform Id: linux Crash Type:...

Mozilla Patches Critical Bug in Thunderbird

Mozilla issued a critical security update to its popular open-source Thunderbird email client. The patch was part of a December release of five fixes that included two bugs rated high and one rated moderate and another low. Mozilla said Thunderbird, which is also serves as a news, RSS and chat...

gdal/gdal_fuzzer: Crash in extpdstemplate

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5287456308985856 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00002072b678 Crash...

OpenJDK: insufficient access control checks in ActivationID (RMI, 8173697)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: unrestricted access to com.sun.org.apache.xml.internal.resolver (JAXP, 8173286)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAXP. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

libreoffice/mmlfuzzer: Bad-cast to SmStructureNode from SmMathSymbolNode in SmXMLTableContext_Impl::EndElement

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6148484173398016 Project: libreoffice Fuzzer: libFuzzerlibreofficemmlfuzzer Fuzz target binary: mmlfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

libreoffice/ww8fuzzer: Heap-use-after-free in SwRangeRedline::CopyToSection

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4560755794903040 Project: libreoffice Fuzzer: libFuzzerlibreofficeww8fuzzer Fuzz target binary: ww8fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...

libreoffice/xlsxfuzzer: Bad-cast to ZipPackageFolder from ZipPackageStream in ZipPackage::getZipFileContents

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5908578138324992 Project: libreoffice Fuzzer: libFuzzerlibreofficexlsxfuzzer Fuzz target binary: xlsxfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

Artica Web Proxy 3.06 - Remote Code Execution

Credits: John Page aka Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt + ISR: ApparitionSec Vendor: ======= www.articatech.com Product: ========= Artica Web Proxy v.3.06.112216...

MistServer 2.12 - Cross-Site Scripting

Credits: John Page aka Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MIST-SERVER-v2.12-UNAUTHENTICATED-PERSISTENT-XSS-CVE-2017-16884.txt + ISR: ApparitionSec Vendor: ============= mistserver.org Product: =========== MistServer v2.12 MistServer...

OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

librawspeed/LJpegDecompressorFuzzer: Use-after-poison in void rawspeed::LJpegDecompressor::decodeN<4>

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6742329370083328 Project: librawspeed Fuzzer: libFuzzerlibrawspeedLJpegDecompressorFuzzer Fuzz target binary: LJpegDecompressorFuzzer Job Type: libfuzzerasanlibrawspeed Platform Id: linux Cra...

proj4/standard_fuzzer: Crash in reverse_4d

Detailed report: https://oss-fuzz.com/testcase?key=6162480330964992 Project: proj4 Fuzzer: libFuzzerproj4standardfuzzer Fuzz target binary: standardfuzzer Job Type: libfuzzerasanproj4 Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7fbe21623158 Crash State: reverse4d pjinv4d projtra...

open62541/fuzz_binary_decode: Heap-use-after-free in UA_Array_copy

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=4845806130561024 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarydecode Fuzz target binary: fuzzbinarydecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type:...

librawspeed/SonyArw2DecompressorFuzzer: Crash in rawspeed::RawImage::create

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5956588557828096 Project: librawspeed Fuzzer: libFuzzerlibrawspeedSonyArw2DecompressorFuzzer Fuzz target binary: SonyArw2DecompressorFuzzer Job Type: libfuzzerasanlibrawspeed Platform Id: lin...

PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free Vulnerability

Exploit for windows platform in category dos / poc Multiple Vulnerabilities in PSFTPd Windows FTP Server ===================================================== Overview -------- Confirmed Affected Versions: 10.0.4 Build 729 Confirmed Patched Versions: None Vendor: Sergei Pleis Softwareentwicklung...

CVE-2017-6264

An elevation of privilege vulnerability exists in the NVIDIA GPU driver gm20bclkthrotsetcdevstate, where an out of bound memory read is used as a function pointer could lead to code execution in the kernel.This issue is rated as high because it could allow a local malicious application to execute...