{"vulnerability": "cve-2015-2820", "sightings": [{"uuid": "ccdd75db-3730-4e3c-a07f-705419b2d3f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2015-2820", "type": "seen", "source": "Telegram/HKj6TR4_hMohrGsEUcNFD_ijNGdim3MCZhggfzha3EYtXw", "content": "", "creation_timestamp": "2024-03-25T14:38:09.000000Z"}, {"uuid": "213a8f21-c289-4ca9-806d-03937c6b7657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2015-2820", "type": "seen", "source": "https://t.me/tengkorakcybercrewz/810", "content": "roaches to define what a 'good fuzzer' is, but real users are more likely to be interested in whether a tool has found something useful. We do not have anyone at OUSPG running tests or even developing Radamsa full-time, but we obviously do make occasional test-runs, both to assess the usefulness of the tool, and to help improve robustness of the target programs. For the test-runs we try to select programs that are mature, useful to us, widely used, and, preferably, open source and/or tend to process data from outside sources.\n\nThe list below has some CVEs we know of that have been found by using Radamsa. Some of the results are from our own test runs, and some have been kindly provided by CERT-FI from their tests and other users. As usual, please note that CVE:s should be read as 'product X is now more robust (against Y)'.\nCVE program credit CVE-2007-3641 libarchive OUSPG CVE-2007-3644 libarchive OUSPG CVE-2007-3645 libarchive OUSPG CVE-2008-1372 bzip2 OUSPG CVE-2008-1387 ClamAV OUSPG CVE-2008-1412 F-Secure OUSPG CVE-2008-1837 ClamAV OUSPG CVE-2008-6536 7-zip OUSPG CVE-2008-6903 Sophos Anti-Virus OUSPG CVE-2010-0001 Gzip integer underflow in unlzw CVE-2010-0192 Acroread OUSPG CVE-2010-1205 libpng OUSPG CVE-2010-1410 Webkit OUSPG CVE-2010-1415 Webkit OUSPG CVE-2010-1793 Webkit OUSPG CVE-2010-2065 libtiff found by CERT-FI CVE-2010-2443 libtiff found by CERT-FI CVE-2010-2597 libtiff found by CERT-FI CVE-2010-2482 libtiff found by CERT-FI CVE-2011-0522 VLC found by Harry Sintonen CVE-2011-0181 Apple ImageIO found by Harry Sintonen CVE-2011-0198 Apple Type Services found by Harry Sintonen CVE-2011-0205 Apple ImageIO found by Harry Sintonen CVE-2011-0201 Apple CoreFoundation found by Harry Sintonen CVE-2011-1276 Excel found by Nicolas Gr\u00e9goire of Agarri CVE-2011-1186 Chrome OUSPG CVE-2011-1434 Chrome OUSPG CVE-2011-2348 Chrome OUSPG CVE-2011-2804 Chrome/pdf OUSPG CVE-2011-2830 Chrome/pdf OUSPG CVE-2011-2839 Chrome/pdf OUSPG CVE-2011-2861 Chrome/pdf OUSPG CVE-2011-3146 librsvg found by Sauli Pahlman CVE-2011-3654 Mozilla Firefox OUSPG CVE-2011-3892 Theora OUSPG CVE-2011-3893 Chrome OUSPG CVE-2011-3895 FFmpeg OUSPG CVE-2011-3957 Chrome OUSPG CVE-2011-3959 Chrome OUSPG CVE-2011-3960 Chrome OUSPG CVE-2011-3962 Chrome OUSPG CVE-2011-3966 Chrome OUSPG CVE-2011-3970 libxslt OUSPG CVE-2012-0449 Firefox found by Nicolas Gr\u00e9goire of Agarri CVE-2012-0469 Mozilla Firefox OUSPG CVE-2012-0470 Mozilla Firefox OUSPG CVE-2012-0457 Mozilla Firefox OUSPG CVE-2012-2825 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2849 Chrome/GIF OUSPG CVE-2012-3972 Mozilla Firefox found by Nicolas Gr\u00e9goire of Agarri CVE-2012-1525 Acrobat Reader found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2871 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2870 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2870 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-4922 tor found by the Tor project CVE-2012-5108 Chrome OUSPG via NodeFuzz CVE-2012-2887 Chrome OUSPG via NodeFuzz CVE-2012-5120 Chrome OUSPG via NodeFuzz CVE-2012-5121 Chrome OUSPG via NodeFuzz CVE-2012-5145 Chrome OUSPG via NodeFuzz CVE-2012-4186 Mozilla Firefox OUSPG via NodeFuzz CVE-2012-4187 Mozilla Firefox OUSPG via NodeFuzz CVE-2012-4188 Mozilla Firefox OUSPG via NodeFuzz CVE-2012-4202 Mozilla Firefox OUSPG via NodeFuzz CVE-2013-0744 Mozilla Firefox OUSPG via NodeFuzz CVE-2013-1691 Mozilla Firefox OUSPG CVE-2013-1708 Mozilla Firefox OUSPG CVE-2013-4082 Wireshark found by cons0ul CVE-2013-1732 Mozilla Firefox OUSPG CVE-2014-0526 Adobe Reader X/XI Pedro Ribeiro (pedrib@gmail.com) CVE-2014-3669 PHP CVE-2014-3668 PHP CVE-2014-8449 Adobe Reader X/XI Pedro Ribeiro (pedrib@gmail.com) CVE-2014-3707 cURL Symeon Paraschoudis CVE-2014-7933 Chrome OUSPG CVE-2015-0797 Mozilla Firefox OUSPG CVE-2015-0813 Mozilla Firefox OUSPG CVE-2015-1220 Chrome OUSPG CVE-2015-1224 Chrome OUSPG CVE-2015-2819 Sybase SQL vah_13 (ERPScan) CVE-2015-2820 SAP Afaria vah_13 (ERPScan) CVE-2015-7091 Apple QuickTime Pedro Ribeiro (pedrib@gmail.com) CVE-2015-8330 SAP PCo agent Mathieu G[...]", "creation_timestamp": "2024-03-25T14:38:09.000000Z"}, {"uuid": "2ccbbfa1-324c-4cac-a87d-79351a9b9aae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2015-2820", "type": "seen", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/3890", "content": "CVE-2015-2819 Sybase SQL vah_13 (ERPScan)   CVE-2015-2820 SAP Afaria vah_13 (ERPScan)   CVE-2015-7091 Apple QuickTime Pedro Ribeiro (pedrib@gmail.com)   CVE-2015-8330 SAP PCo agent Mathieu GELI (ERPScan)   CVE-2016-1928 SAP HANA hdbxsengine Mathieu Geli (ERPScan)   CVE-2016-3979 SAP NetWeaver @ret5et (ERPScan)   CVE-2016-3980 SAP NetWeaver @ret5et (ERPScan)   CVE-2016-4015 SAP NetWeaver @vah_13 (ERPScan)   CVE-2016-4015 SAP NetWeaver @vah_13 (ERPScan)   CVE-2016-9562 SAP NetWeaver @vah_13 (ERPScan)   CVE-2017-5371 SAP ASE OData @vah_13 (ERPScan)   CVE-2017-9843 SAP NETWEAVER @vah_13 (ERPScan)   CVE-2017-9845 SAP NETWEAVER @vah_13 (ERPScan)   CVE-2018-0101 (https://www.nccgroup.trust/globalassets/newsroom/uk/events/offensivecon2018-the-return-of-robin-hood-vs-cisco-asa.pdf) Cisco ASA WebVPN/AnyConnect @saidelike (NCC Group)    We would like to thank the Chromium project and Mozilla for analyzing, fixing and reporting further many of the above mentioned issues, CERT-FI for feedback and disclosure handling, and other users, projects and vendors who have responsibly taken care of uncovered bugs. Thanks The following people have contributed to the development of radamsa in code, ideas, issues or otherwise.  Darkkey Branden Archer  Troubleshooting Issues in Radamsa can be reported to the issue tracker. The tool is under development, but we are glad to get error reports even for known issues to make sure they are not forgotten. You can also drop by at #radamsa on Freenode if you have questions or feedback. Issues your programs should be fixed. If Radamsa finds them quickly (say, in an hour or a day) chances are that others will too. Issues in other programs written by others should be dealt with responsibly. Even fairly simple errors can turn out to be exploitable, especially in programs written in low-level languages. In case you find something potentially severe, like an easily reproducible crash, and are unsure what to do with it, ask the vendor or project members, or your local CERT. FAQ Q: If I find a bug with radamsa, do I have to mention the tool?\n A: No. Q: Will you make a graphical version of radamsa?\nA: No. The intention is to keep it simple and scriptable for use in automated (https://www.kitploit.com/search/label/Automated) regression tests and continuous testing. Q: I can't install! I don't have root access on the machine!\n A: You can omit the $ make install part and just run radamsa from bin/radamsa in the build directory, or copy it somewhere else and use from there. Q: Radamsa takes several GB of memory to compile!1\n A: This is most likely due to an issue with your C compiler. Use prebuilt images or try the quick build instructions in this page. Q: Radamsa does not compile using the instructions in this page!\n A: Please file an issue at https://gitlab.com/akihe/radamsa/issues/new if you don't see a similar one already filed, send email (aohelin@gmail.com) or IRC (#radamsa on freenode). Q: I used fuzzer X and found much more bugs from program Y than Radamsa did.\n A: Cool. Let me know about it (aohelin@gmail.com) and I'll try to hack something X-ish to radamsa if it's general purpose enough. It'd also be useful to get some samples which you used to check how well radamsa does, because it might be overfitting some heuristic. Q: Can I get support for using radamsa?\n A: You can send email to aohelin@gmail.com or check if some of us happen to be hanging around at #radamsa on freenode. Q: Can I use radamsa on Windows?\n A: An experimental Windows executable is now in Downloads, but we have usually not tested it properly since we rarely use Windows internally. Feel free to file an issue if something is broken. Q: How can I install radamsa?\n A: Grab a binary from downloads and run it, or $ make && sudo make install. Q: How can I uninstall radamsa?\n A: Remove the binary you grabbed from downloads, or $ sudo make uninstall. Q: Why are many outputs generated by Radamsa equal?", "creation_timestamp": "2024-03-26T12:31:51.000000Z"}, {"uuid": "157c36bd-2b5f-4795-96d5-2da78e0c92c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2015-2820", "type": "seen", "source": "https://t.me/tengkorakcybercrewz/4400", "content": "roaches to define what a 'good fuzzer' is, but real users are more likely to be interested in whether a tool has found something useful. We do not have anyone at OUSPG running tests or even developing Radamsa full-time, but we obviously do make occasional test-runs, both to assess the usefulness of the tool, and to help improve robustness of the target programs. For the test-runs we try to select programs that are mature, useful to us, widely used, and, preferably, open source and/or tend to process data from outside sources.\n\nThe list below has some CVEs we know of that have been found by using Radamsa. Some of the results are from our own test runs, and some have been kindly provided by CERT-FI from their tests and other users. As usual, please note that CVE:s should be read as 'product X is now more robust (against Y)'.\nCVE program credit CVE-2007-3641 libarchive OUSPG CVE-2007-3644 libarchive OUSPG CVE-2007-3645 libarchive OUSPG CVE-2008-1372 bzip2 OUSPG CVE-2008-1387 ClamAV OUSPG CVE-2008-1412 F-Secure OUSPG CVE-2008-1837 ClamAV OUSPG CVE-2008-6536 7-zip OUSPG CVE-2008-6903 Sophos Anti-Virus OUSPG CVE-2010-0001 Gzip integer underflow in unlzw CVE-2010-0192 Acroread OUSPG CVE-2010-1205 libpng OUSPG CVE-2010-1410 Webkit OUSPG CVE-2010-1415 Webkit OUSPG CVE-2010-1793 Webkit OUSPG CVE-2010-2065 libtiff found by CERT-FI CVE-2010-2443 libtiff found by CERT-FI CVE-2010-2597 libtiff found by CERT-FI CVE-2010-2482 libtiff found by CERT-FI CVE-2011-0522 VLC found by Harry Sintonen CVE-2011-0181 Apple ImageIO found by Harry Sintonen CVE-2011-0198 Apple Type Services found by Harry Sintonen CVE-2011-0205 Apple ImageIO found by Harry Sintonen CVE-2011-0201 Apple CoreFoundation found by Harry Sintonen CVE-2011-1276 Excel found by Nicolas Gr\u00e9goire of Agarri CVE-2011-1186 Chrome OUSPG CVE-2011-1434 Chrome OUSPG CVE-2011-2348 Chrome OUSPG CVE-2011-2804 Chrome/pdf OUSPG CVE-2011-2830 Chrome/pdf OUSPG CVE-2011-2839 Chrome/pdf OUSPG CVE-2011-2861 Chrome/pdf OUSPG CVE-2011-3146 librsvg found by Sauli Pahlman CVE-2011-3654 Mozilla Firefox OUSPG CVE-2011-3892 Theora OUSPG CVE-2011-3893 Chrome OUSPG CVE-2011-3895 FFmpeg OUSPG CVE-2011-3957 Chrome OUSPG CVE-2011-3959 Chrome OUSPG CVE-2011-3960 Chrome OUSPG CVE-2011-3962 Chrome OUSPG CVE-2011-3966 Chrome OUSPG CVE-2011-3970 libxslt OUSPG CVE-2012-0449 Firefox found by Nicolas Gr\u00e9goire of Agarri CVE-2012-0469 Mozilla Firefox OUSPG CVE-2012-0470 Mozilla Firefox OUSPG CVE-2012-0457 Mozilla Firefox OUSPG CVE-2012-2825 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2849 Chrome/GIF OUSPG CVE-2012-3972 Mozilla Firefox found by Nicolas Gr\u00e9goire of Agarri CVE-2012-1525 Acrobat Reader found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2871 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2870 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-2870 libxslt found by Nicolas Gr\u00e9goire of Agarri CVE-2012-4922 tor found by the Tor project CVE-2012-5108 Chrome OUSPG via NodeFuzz CVE-2012-2887 Chrome OUSPG via NodeFuzz CVE-2012-5120 Chrome OUSPG via NodeFuzz CVE-2012-5121 Chrome OUSPG via NodeFuzz CVE-2012-5145 Chrome OUSPG via NodeFuzz CVE-2012-4186 Mozilla Firefox OUSPG via NodeFuzz CVE-2012-4187 Mozilla Firefox OUSPG via NodeFuzz CVE-2012-4188 Mozilla Firefox OUSPG via NodeFuzz CVE-2012-4202 Mozilla Firefox OUSPG via NodeFuzz CVE-2013-0744 Mozilla Firefox OUSPG via NodeFuzz CVE-2013-1691 Mozilla Firefox OUSPG CVE-2013-1708 Mozilla Firefox OUSPG CVE-2013-4082 Wireshark found by cons0ul CVE-2013-1732 Mozilla Firefox OUSPG CVE-2014-0526 Adobe Reader X/XI Pedro Ribeiro (pedrib@gmail.com) CVE-2014-3669 PHP CVE-2014-3668 PHP CVE-2014-8449 Adobe Reader X/XI Pedro Ribeiro (pedrib@gmail.com) CVE-2014-3707 cURL Symeon Paraschoudis CVE-2014-7933 Chrome OUSPG CVE-2015-0797 Mozilla Firefox OUSPG CVE-2015-0813 Mozilla Firefox OUSPG CVE-2015-1220 Chrome OUSPG CVE-2015-1224 Chrome OUSPG CVE-2015-2819 Sybase SQL vah_13 (ERPScan) CVE-2015-2820 SAP Afaria vah_13 (ERPScan) CVE-2015-7091 Apple QuickTime Pedro Ribeiro (pedrib@gmail.com) CVE-2015-8330 SAP PCo agent Mathieu G[...]", "creation_timestamp": "2024-03-25T14:38:09.000000Z"}]}