bugtraq - CVE-2015-0061 and CVE-2015-0063 (MS16-009/MS16-011)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 12 Feb 2016 10:13:58 +0100
From: Berend-Jan Wever <berendjanwever@...il.com>
To: bugtraq@...urityfocus.com
Subject: CVE-2015-0061 and CVE-2015-0063 (MS16-009/MS16-011)

Hello everyone,

I've recently released examples on twitter of how to trigger two
security vulnerabilities in Microsoft Internet Explorer. These issue
were discovered last year and reported to Microsoft through ZDI.
Microsoft release security updates to address these issues last Tuesday.

CVE-2016-0061:
https://twitter.com/berendjanwever/status/697819335574843394

CVE-2016-0063:
https://twitter.com/berendjanwever/status/697818121835581441

Both were found through fuzzing inspired by Michal Zalewski's cross_fuzz
http://lcamtuf.blogspot.nl/2011/01/announcing-crossfuzz-potential-0-day-in.html

Cheers,

SkyLined