OSV-2023-27 Heap-buffer-overflow in OT::Layout::GPOS_impl::PairSet<OT::Layout::MediumTypes>::apply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55287 Crash type: Heap-buffer-overflow READ 1 Crash state: OT::Layout::GPOSimpl::PairSet::apply OT::Layout::GPOSimpl::PairPosFormat13::apply bool OT::hbacceleratesubtablescontextt::applytoOT::Layout::GPOSimpl::Pair...

Cyber Signals: Risks to critical infrastructure on the rise

Today, the third edition of Cyber Signals was released spotlighting security trends and insights gathered from Microsoft’s 43 trillion daily security signals and 8,500 security experts. In this edition, we share new insights on wider risks that converging IT, Internet of Things IoT, and operation...

3 New Vulnerabilities Affect OT Products from German Companies Festo and CODESYS

Researchers have disclosed details of three new security vulnerabilities affecting operational technology OT products from CODESYS and Festo that could lead to source code tampering and denial-of-service DoS. The vulnerabilities, reported by Forescout Vedere Labs, are the latest in a long list of...

Over a Dozen New BMC Firmware Flaws Expose OT and IoT Devices to Remote Attacks

Over a dozen security flaws have been discovered in baseboard management controller BMC firmware from Lanner that could expose operational technology OT and internet of things IoT networks to remote attacks. BMC refers to a specialized service processor, a system-on-chip SoC, that's found in serv...

OSV-2022-1212 Heap-buffer-overflow in OT::hb_ot_apply_context_t::skipping_iterator_t::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53722 Crash type: Heap-buffer-overflow READ 4 Crash state: OT::hbotapplycontextt::skippingiteratort::next bool OT::matchinput bool OT::contextapplylookup...

OSV-2022-1209 Heap-buffer-overflow in OT::hb_ot_apply_context_t::skipping_iterator_t::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53714 Crash type: Heap-buffer-overflow READ 4 Crash state: OT::hbotapplycontextt::skippingiteratort::next OT::Layout::GSUBimpl::Ligature::apply bool OT::hbacceleratesubtablescontextt::applytoOT::Layout::GSUBimpl::Liga...

Vulnerable SDK components lead to supply chain risks in IoT and OT environments

December 8, 2022 update - Reflected additional research on Boa-related CVEs and updated supply chain diagram. Vulnerabilities in network components, architecture files, and developer tools have become increasingly popular attack vectors to gain access into secure networks and devices. External...

Vulnerable SDK components lead to supply chain risks in IoT and OT environments

December 8, 2022 update - Reflected additional research on Boa-related CVEs and updated supply chain diagram. Vulnerabilities in network components, architecture files, and developer tools have become increasingly popular attack vectors to gain access into secure networks and devices. External...

harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc

A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service DoS via unspecified vectors...

harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc

A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service DoS via unspecified vectors...

harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc

A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service DoS via unspecified vectors...

harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc

A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service DoS via unspecified vectors...

Prevent Ransomware Attacks on Critical Infrastructure

Cyberattacks against critical infrastructure can cause massive societal disruption and take an enormous financial toll. Discover how to protect six key OT domains to help prevent ransomware and other threats to essential operations...

EulerOS 2.0 SP9 : harfbuzz (EulerOS-SA-2022-2319)

According to the versions of the harfbuzz packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service DoS via...

The vulnerability of the hb-ot-shape-fallback.cc component in the Harfbuzz text transformation library, which allows a hacker to trigger a service failure.

The vulnerability of the hb-ot-shape-fallback.cc component in the Harfbuzz text transformation library is related to a numerical overflow in the hb-ot-shape-fallback.cc file. Exploiting this vulnerability could allow an attacker to cause a service failure by sending specially crafted data to the...

New Evil PLC Attack Weaponizes PLCs to Breach OT and Enterprise Networks

Cybersecurity researchers have elaborated a novel attack technique that weaponizes programmable logic controllers PLCs to gain an initial foothold in engineering workstations and subsequently invade the operational technology OT networks. Dubbed "Evil PLC" attack by industrial security firm...

Malicious Package

Overview ot-daily-algorithm is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview ot-performance is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview ot-pausedetector is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious Package

Overview ot-menu-test is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...