Heap Based Buffer Overflow News Today

Microsofts May 2024 Patch Tuesday addresses 61 vulnerabilities, including three zero-days. Two critical RCE flaws and browser patches are also highlighted.

The Binarly REsearch team investigates vulnerable image parsing components across the entire UEFI firmware ecosystem and finds all major device manufacturers are impacted on both x86 and ARM-based devices.

GUEST OPINION: The Qualys Threat Research Unit (TRU) has discovered three vulnerabilities in RenderDoc. This blog will delve into the details of these...

On January 17th 2023, X41 and Gitlab published a report of the source code audit they performed on Git (funded by the OSTIF foundation).

Cybersecurity and Infrastructure Security Agency has added to the catalog of vulnerabilities another 15 security issues actively used in cyber attacks.

The high-severity vulnerabilities that CISA has added to its patch-now list include SeriousSAM privilege escalation and SMB remote code execution.

Introduction I noticed that the network subsystem was already being fuzzed extensively by syzkaller, but that subsystems like Bluetooth were less well covered. In general, research on the Bluetooth host attack surface seemed to be quite limited – with most public vulnerabilities in Bluetooth only affecting the firmware or the specification itself, and only allowing attackers to eavesdrop and/or manipulate information. But what if attackers could take full control over devices? The most promin...

Sudo vulnerability could give attackers root access on Linux systems Security researchers have revealed details of a vulnerability in Sudo that could be exploited by an attacker to gain root privileges on a wide range of Linux-based systems. News of the security flaw was shared by Qualys, and it has been described as "perhaps the most significant sudo vulnerability in recent memory". Worryingly, the heap-based buffer overflow bug has existed for almost a decade. It is known as Baron Samedit, tr...

Matrikon Honeywell is one of three IoT vendors that faced vulnerabilities in their process to implement the open platform communication (OPC) network protocol ahead of a 2020 fix. (Spencer Platt/Getty Images) At least nine vulnerabilities in the approach three leading IoT vendors used to implement the open platform communication (OPC) network protocol created conditions that could potentially expose product users to denial-of-service (DoS) attacks, remote code ex...