CVE-2019-1994

CVE-2019-1994 affects Android 8.0–9 where DevelopmentTiles.java could leave development settings accessible due to an insecure default. This Elevation of Privilege vulnerability could grant access to development settings with no extra privileges; exploitation requires user interaction. Affected s...

CVE-2019-1994

In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. This could lead to unwanted access to development settings, with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2019-3598

CVE-2019-3598 affects McAfee Agent (MA) 5.x where a bug in how UDP requests are processed leads to a denial of service when handling specially crafted UDP packets. The vulnerability allows remote, unauthenticated attackers to potentially cause the MA service to stop responding, reducing availabil...

file/magic_fuzzer: Use-of-uninitialized-value in mprint

Detailed report: https://oss-fuzz.com/testcase?key=5634761748381696 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzermsanfile Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: mprint match filesoftmagic Sanitizer...

graphicsmagick/coder_MAT_fuzzer: Use-of-uninitialized-value in IsGrayImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5717091647225856 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderMATfuzzer Fuzz target binary: coderMATfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

Crypto Mining Service Coinhive to Call it Quits

Roughly one year ago, KrebsOnSecurity published a lengthy investigation into the individuals behind Coinhive.com, a cryptocurrency mining service that has been heavily abused to force hacked Web sites to mine virtual currency. On Tuesday, Coinhive announced plans to pull the plug on the project...

capstone/fuzz_disasmnext: Use-of-uninitialized-value in X86_insn_name

Detailed report: https://oss-fuzz.com/testcase?key=5700554943102976 Project: capstone Fuzzer: libFuzzercapstonefuzzdisasmnext Fuzz target binary: fuzzdisasmnext Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: X86insnname...

skia/image_filter_deserialize_width: Use-of-uninitialized-value in SkBaseShadowTessellator::stitchConcaveRings

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5686966203449344 Project: skia Fuzzer: libFuzzerskiaimagefilterdeserializewidth Fuzz target binary: imagefilterdeserializewidth Job Type: libfuzzermsanskia Platform Id: linux Crash Type:...

opencv/imdecode_fuzzer: Use-of-uninitialized-value in cv::PAMDecoder::readHeader

Detailed report: https://oss-fuzz.com/testcase?key=5659354838073344 Project: opencv Fuzzer: libFuzzerimdecodefuzzer Fuzz target binary: imdecodefuzzer Job Type: libfuzzermsanopencv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cv::PAMDecoder::readHeader...

keystone/fuzz_asm_x86_16: Use-of-uninitialized-value in llvm_ks::MCAssembler::fragmentNeedsRelaxation

Detailed report: https://oss-fuzz.com/testcase?key=6301049676103680 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8616 Fuzz target binary: fuzzasmx8616 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Unsafe Dependency Resolution

Overview org.immutables:value-fixture is a processor to create immutable objects and builders. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicio...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in fz_clamp

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5658959258583040 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

tidy-html5/tidy_fuzzer: Use-of-uninitialized-value in TextEndsWithNewline

Detailed report: https://oss-fuzz.com/testcase?key=5662667379834880 Project: tidy-html5 Fuzzer: libFuzzertidy-html5tidyfuzzer Fuzz target binary: tidyfuzzer Job Type: libfuzzermsantidy-html5 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: TextEndsWithNewline...

OPNsense < 19.1.1 - Cross-Site Scripting

Exploit Title: OPNsense 19.1 | Cross-Site Scripting Date: 01.02.2019 Exploit Author: Ozer Goker Vendor Homepage: https://opnsense.org Software Link: http://mirror.ams1.nl.leaseweb.net/opnsense/releases/19.1/OPNsense-19.1-OpenSSL-dvd-amd64.iso.bz2 Version: 19.1 Introduction OPNsense is an open...

The vulnerability of the elf_parse_notes function in the GNU Binutils development environment allows a hacker to trigger a service failure.

The vulnerability of the elfparsenotes function in the GNU Binutils development toolset is related to errors in accessing data beyond the specified buffer. Exploiting this vulnerability could allow a malicious actor to cause service failures by using an ELF file with a NOTES segment having a larg...

skia/api_mock_gpu_canvas: Use-of-uninitialized-value in Convexicator::BySign

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5706695492239360 Project: skia Fuzzer: libFuzzerskiaapimockgpucanvas Fuzz target binary: apimockgpucanvas Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

graphicsmagick/coder_PTIF_fuzzer: Use-of-uninitialized-value in DisassociateAlphaRegion

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5713410539388928 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderPTIFfuzzer Fuzz target binary: coderPTIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

CVE-2019-7692

install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration file mishandling in the N=83 case, as demonstrated by a call to the PHP fputs function that creates a .php file in the public folder...

kimageformats/kimgio_fuzzer: Use-of-uninitialized-value in QImage::pixel

Project: git://anongit.kde.org/kimageformats Detailed report: https://oss-fuzz.com/testcase?key=5676156395716608 Project: kimageformats Fuzzer: libFuzzerkimageformatskimgiofuzzer Fuzz target binary: kimgiofuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type:...

skia/api_raster_n32_canvas: Use-of-uninitialized-value in SkRect::setBoundsCheck

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5711966423744512 Project: skia Fuzzer: libFuzzerskiaapirastern32canvas Fuzz target binary: apirastern32canvas Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value...