Public Vulnerabilities Discovered Using BFF - CERTCC/certfuzz GitHub Wiki

The following vulnerabilities were found using BFF on Linux or Mac

• Xpdf and poppler contain multiple vulnerabilities in the processing of JBIG2 data
• Adobe Reader contains multiple vulnerabilities in the processing of JPX data
• Foxit Reader contains multiple vulnerabilities in the processing of JPX data
• VMware VMnc AVI video codec image height heap overflow
• Microsoft Indeo video codecs contain multiple vulnerabilities
• Adobe Flash ActionScript AVM2 newfunction vulnerability
• Adobe Flash 10.1 ActionScript AVM1 ActionPush vulnerability
• JasPer memory corruption vulnerabilities
• Apple Mac OS X ATS data-font memory corruption vulnerability
• Apple Mac OS X CoreText embedded font vulnerability
• Oracle Outside In 8.5.2 contains multiple stack buffer overflows
• Steam Counter Strike BSP map file stack buffer overflow

The following vulnerabilities were found using BFF for Windows (Formerly known as FOE)

• Apple QuickTime JPEG2000 heap buffer overflow
• Oracle Outside In contains exploitable vulnerabilities in Lotus 123 and Microsoft CAB file parsers
• Oracle Outside In CorelDRAW file parser stack buffer overflow
• Windows font library file buffer overflow
• Microsoft Windows TrueType font array indexing vulnerability
• Microsoft Office Publisher contains multiple exploitable vulnerabilities
• Google Chrome multiple vulnerabilities
• Adobe Flash memory corruption vulnerability
• Adobe Shockwave 11.5.9.615 contains multiple memory corruption vulnerabilities
• Adobe Reader and Acrobat font memory corruption vulnerability
• LibreOffice 3.3 'Lotus Word Pro' document import filter contains multiple vulnerabilities
• Microsoft Office uninitialized object pointer vulnerability
• Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers
• Iceni products PDF parser stack buffer overflow
• Oracle Outside In contains an exploitable vulnerability in Lotus 123 v4 parser
• Adobe Shockwave 11.6.7.637 contains multiple exploitable vulnerabilities
• Symantec Antivirus products fail to properly handle CAB files
• Nuance PDF viewing products contain multiple vulnerabilities
• Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers
• AT&T Connect Participant Application for Windows v9.5.35 contains a stack-based buffer overflow vulnerability
• J2k-Codec contains multiple exploitable vulnerabilities
• Microsoft Office file format converter memory corruption vulnerability