Re: [FD] SEC Consult SA-20191125-0 :: FortiGuard XOR Encryption in Multiple Fortinet Products

Hi, we received incorrect version information during the coordination phase thus our initial advisory stated that FortiOS v6.0.7 fixes the issue. Fortinet has just now confirmed that only v6.2.0 includes the patch. See their advisory: https://fortiguard.com/psirt/FG-IR-18-100 SEC Consult Vulner

[FD] CVE-2019-11932 (double free in libpl_droidsonroids_gif) many apps vulnerable

Hi list, CVE-2019-11932 is a vulnerability in the android-gif-drawable library. Yet the CVE text doesn't mention "android-gif-drawable". It only mentions WhatsApp. There could be over 28,400 free Android apps that use this library. And it seems that quite a few (24) of those 28k+ apps other than

[FD] Vulnerability in MiBox3

HI, I would like to report a security vulnerability in Xiaomi Mi Box (model: MIBOX3, build.id : MHC19). The vulnerability allows rescaling and corrupting the display without any privilege requirement, thus creating an opportunity for a non-privilege malicious app to disable the basic funct

[FD] pari/gp on debian stable allow arbitrary file write

pari/gp on debian stable allow arbitrary file write pari/gp is CAS (computer algebra system). pari/gp version 2.9.1 on debian stretch and 2.11 on debian buster allow arbitrary file write and hence arbitrary code execution. poc: \\ a.gp \\ to run: \r a.gp default("logfile","/tmp/a.txt");d

[FD] Anhui Huami Mi Fit Android Application - Unencrypted Update Check

Anhui Huami Mi Fit Android Application - Unencrypted Update Check -- https://www.info-sec.ca/advisories/Huami-Mi-Fit.html Overview "Mi Fit tracks your activity, analyzes sleep, and evaluates your workouts." (https://play.google.com/store/apps/details?id=com.xiaomi.hm.health) Issue The Anhui H

[FD] [CFP] Security BSides Ljubljana 0x7E4 | April 4, 2020

NmddmNMM MMN..-..--+MMNy:...-.-/yNMMM MMy..ymd-.:Mm::-:osyo-..-mMM MM:..---.:dM/..+NNyyMN/..:MM Mm../dds.-oy.-.dMh--mMds++M