google lists zero day list of exploits – “in the wild” – catastrophic security hole in WhatsApp’s voip-stack allows malware and spying on iOS and Android – signal seems still good

21.May.2019

google’s security lab “project zero“

has made itself a name.

(you can subscribe to their rss feed with thunderbird.)

Posted by Ben Hawkes, Project Zero (team lead) (2019-05-15)

Project Zero’s team mission is to “make zero-day hard”, i.e. to make it more costly to discover and exploit security vulnerabilities. We primarily achieve this by performing our own security research, but at times we also study external instances of zero-day exploits that were discovered “in the wild”. These cases provide an interesting glimpse into real-world attacker behavior and capabilities, in a way that nicely augments the insights we gain from our own research.

Today, we’re sharing our tracking spreadsheet for publicly known cases of detected zero-day exploits, in the hope that this can be a useful community resource:

Spreadsheet link: 0day “In the Wild”

This data is collected from a range of public sources. We include relevant links to third-party analysis and attribution, but we do this only for your information; their inclusion does not mean we endorse or validate the content there. The data described in the spreadsheet is nothing new, but we think that collecting it together in one place is useful. For example, it shows that:

On average, a new “in the wild” exploit is discovered every 17 days (but in practice these often clump together in exploit chains that are all discovered on the same date);
Across all vendors, it takes 15 days on average to patch a vulnerability that is being used in active attacks;
A detailed technical analysis on the root-cause of the vulnerability is published for 86% of listed CVEs;
Memory corruption issues are the root-cause of 68% of listed CVEs.

We also think that this data poses an interesting question: what is the detection rate of 0day exploits? In other words, at what rate are 0day exploits being used in attacks without being detected? This is a key “unknown parameter” in security, and how you model it will greatly inform your views, plans, and priorities as a defender.

It’s also important that we interpret this data as a failure-case for an attacker, and so it doesn’t make sense to draw overarching conclusions about attacker behavior based on a limited data set like this — we see a brief glimpse, but not the whole story.

Additionally, the rate of detection is likely to differ substantially between platforms (e.g. mobile vs desktop), so it’s not useful for direct comparisons between platforms either.

Finally, if you spot something in the spreadsheet that looks incorrect, let us know! We hope to maintain and improve this spreadsheet over time, and welcome suggestions for additions or corrections based on publicly available data.

src: https://googleprojectzero.blogspot.com/p/0day.html

src: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/htmlview?sle=true#

catastrophic security hole in WhatsApp’s voip-stack allows malware and spying

i just hope there is no such thing in signal, telegram and co. X-D

another OpenSource VideoConferencing system:

https://dwaves.de/2017/02/24/webrtc-based-video-conferencing-howto-setup-jitsi-debian-mate-opensource-alternative-to-skype/

“The attacker can simply insert the Spyware into the respective device by a WhatsApp call, even if the called one does not pick up at all.” (auto translated from src: heise.de)

“By February 2018, WhatsApp had over one and a half billion users,^[51]^[52] making it the most popular messaging application at the time.^[52]^[53] It has grown in multiple countries, including Brazil, India, and large parts of Europe, including the United Kingdom and France.^[52]”

(src: wikipedia.org)

Just imagine – you could send those 1.5 billion phones a specially crafted message and ransom-encrypt all the phone’s content and charge 10$ for decryption?

It is probably also used by private and governmental intelligence companies to spy on target people’s phones.

CVE-2019-3568
Description: A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number.

Affected Versions: The issue affects WhatsApp for Android prior to v2.19.134,

WhatsApp Business for Android prior to v2.19.44,

WhatsApp for iOS prior to v2.19.51,

WhatsApp Business for iOS prior to v2.19.51,

WhatsApp for Windows Phone prior to v2.18.348,

WhatsApp for Tizen prior to v2.18.15.

While signal.org mention that Snowden and Laura Poitras recommend:

signal.org Messenger (Open Whisper Systems) (they now even have a Desktop-Version with official packages.deb for Debian/Ubuntu, but you can also install signal messenger on Fedora/RedHat/CentOS7 like this)

Signal seemed to be “independent” – in fact – Moxie Marlinspike sold it to Twitter for an undiscloused amount of money – which makes the whole thing smell fishy… but according to wikipedia everything is “okidokay”

“During an interview with The New Yorker in October 2014, he recommended using “anything from Moxie Marlinspike and Open Whisper Systems”.^[54] During a remote appearance at an event hosted by Ryerson University and Canadian Journalists for Free Expression in March 2015, Snowden said that Signal is “very good” and that he knew the security model.^[55] Asked about encrypted messaging apps during a Reddit AMA in May 2015, he recommended “Signal for iOS, Redphone/TextSecure for Android”.^[56]^[57] In November 2015, Snowden tweeted that he used Signal “every day”.^[58]”

(src: https://en.wikipedia.org/wiki/Signal_Messenger#Reception)

I use Signal every day. #notesforFBI (Spoiler: they already know) https://t.co/KNy0xppsN0

— Edward Snowden (@Snowden) November 2, 2015

Even if Moxie Marlinspike left Twitter to – again – to form a company with a

“Whisper Systems was an enterprise mobile security company that was co-founded by security researcher Moxie Marlinspike and roboticist Stuart Anderson in 2010.^[1] The company was acquired by Twitter in November 2011.^[2]^[3]^[4]

Some of the company’s software products were released under free software licenses after the acquisition,^[5]which led to the creation of an independent organization called Open Whisper Systems.^[6]” (src: Wikipedia.org)

“Marlinspike later left Twitter and founded Open Whisper Systems as a collaborative open source project for the continued development of TextSecure and RedPhone.^[19]^[20]”

2011: “Twitter acquired the company that makes TextSecure, Whisper Systems”

“In countries where governments have more strict control over wireless networks, Whisper Systems’ apps have been extremely helpful to dissidents wanting to communicate and organize securely.” (src: 2011: mashable.com)

RedPhone: A stand-alone application for encrypted voice calling on Android. RedPhone integrated with the system dialer to make calls, but used ZRTP to set up an end-to-end encrypted VoIP channel for the actual call. RedPhone was designed specifically for mobile devices, using audio codecs and buffer algorithms tuned to the characteristics of mobile networks, and used push notifications to preserve the user’s device’s battery life while still remaining responsive.^[81] RedPhone was merged into TextSecure on November 2, 2015.^[37] TextSecure was then renamed as Signal for Android.^[37] RedPhone’s source code was available under the GPLv3 license.^[81]

TextSecure

TextSecure: A stand-alone application for encrypted messaging on Android.^[82]^[83] TextSecure could be used to send and receive SMS, MMS, and instant messages.^[84] It used end-to-end encryption with forward secrecy and deniable authentication to secure all instant messages to other TextSecure users.^[60]^[83]^[85]^[86] TextSecure was merged with RedPhone to become Signal for Android^[37], but lost its ability to encrypt SMS. The source code is available under the GPLv3 license.^[82]

0day “In the Wild”
2	Last updated: 2019-05-15
3
4	This spreadsheet is used to track cases of zero-day exploits that were detected “in the wild”. This means the vulnerability was detected in real attacks against users as a zero-day vulnerability (i.e. not known to the public or the vendor at the time of detection). This data is collected from a range of public sources. We include relevant links to third-party analysis and attribution, but we do this only for your information; their inclusion does not mean we endorse or validate the content there.
5
6	An introduction to this spreadsheet is available on the Project Zero blog:
7	https://googleprojectzero.blogspot.com/p/0day.html
8
9	Some additional notes on how the data is processed:
10	– Scope for inclusion: there are some 0day exploits (such as CVE-2017-12824) in areas that aren’t active research targets for Project Zero. Generally this list includes targets that Project Zero has previously investigated (i.e. there are bug reports in our issue tracker) or will investigate in the near future.
11	– Security supported: this list does not include exploits for software that is explicitly EOL at the time of discovery (such as the ExplodingCan exploit for IIS on Windows Server 2003, surfaced in 2017).
12	– Post-disclosure: this list does not include CVEs that were opportunistically exploited by attackers in the gap between public disclosure (or “full disclosure”) and a patch becoming available to users (such as CVE-2015-0072, CVE-2018-8414 or CVE-2018-8440).
13	– Reasonable inference: this list includes exploits that were not discovered in an active breach, but were leaked or discovered in a form that suggests with high confidence that they were probably used “in the wild” at some point (e.g. Equation Group and Hacking Team leaks).
14	– Date resolution: we only set the date of discovery when the reporter specifies one. If a discovery is indicated as being made in “late April” or “early March”, we record that as if no date was provided.
15	– Attribution: generally the “claimed attribution” column refers to the attack team that is reportedly using the exploit, but in some cases it can refer to the supplier of the exploit (c.f. HackingTeam, NSO Group, Exodus Intel) if no other information is available.
16	– Time range: data collection starts from the day we announced Project Zero — July 15, 2014.
17
18	For additions, corrections, questions, or comments, please contact 0day-in-the-wild@google.com

1	CVE	Vendor	Product	Type	Description	Date Discovered	Date Patched	Advisory	Analysis URL	Claimed Attribution	Claimed Attribution URL
2	CVE-2019-3568	Facebook	WhatsApp	Memory Corruption	Buffer overflow in SRTCP packets	???	2019-05-13	https://www.facebook.com/security/advisories/cve-2019-3568	https://research.checkpoint.com/the-nso-whatsapp-vulnerability-this-is-how-it-happened/	NSO Group	https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab
3	CVE-2019-0803	Microsoft	Windows	Memory Corruption	Unspecified memory corruption in win32k	???	2019-04-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803	???	???	???
4	CVE-2019-0859	Microsoft	Windows	Memory Corruption	Use-after-free in CreateWindowEx	2019-03-17	2019-04-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859	https://securelist.com/new-win32k-zero-day-cve-2019-0859/90435/	???	???
5	CVE-2019-0703	Microsoft	Windows	Information Leak	Unspecified information leak vulnerability in SMB	???	2019-03-12	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0703	???	APT3/Buckeye	https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit
6	CVE-2019-0808	Microsoft	Windows	Memory Corruption	NULL pointer dereference in win32k!xxxMNFindWindowFromPoint	???	2019-03-12	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808	https://blog.360totalsecurity.com/en/analysis-of-the-causes-of-cve-2019-0808-core-elevation-permission-vulnerability/	???	???
7	CVE-2019-0797	Microsoft	Windows	Memory Corruption	Race condition in NtDCompositionDestroyConnection	2019-02-22	2019-03-12	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0797	https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/	FruityArmor/Stealth Falcon, and Sandcat	https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/
8	CVE-2019-5786	Google	Chrome	Memory Corruption	Use-after-free in FileReader	???	2019-03-01	https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html	https://blog.exodusintel.com/2019/03/20/cve-2019-5786-analysis-and-exploitation/	???	???
9	CVE-2019-0676	Microsoft	Internet Explorer	Information Leak	Unspecified information leak vulnerability	???	2019-02-12	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676	???	???	???
10	CVE-2019-7286	Apple	iOS	Memory Corruption	Use-after-free in CFPrefsDaemon	???	2019-02-07	https://support.apple.com/en-us/HT209520	https://blog.zecops.com/vulnerabilities/analysis-and-reproduction-of-cve-2019-7286/	???	???
11	CVE-2019-7287	Apple	iOS	Memory Corruption	Buffer overflow in ProvInfoIOKitUserClient	???	2019-02-07	https://support.apple.com/en-us/HT209520	https://www.antid0te.com/blog/19-02-23-ios-kernel-cve-2019-7287-memory-corruption-vulnerability.html	???	???
12	CVE-2018-8653	Microsoft	Internet Explorer	Memory Corruption	Use-after-free in Enumerator	???	2018-12-19	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653	https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/ie-scripting-flaw-still-a-threat-to-unpatched-systems-analyzing-cve-2018-8653/	???	???
13	CVE-2018-8611	Microsoft	Windows	Memory Corruption	Race condition in kernel transaction manager	2018-10-29	2018-12-11	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8611	https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/	FruityArmor/Stealth Falcon, and Sandcat	https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/
14	CVE-2018-15982	Adobe	Flash	Memory Corruption	Use-after-free in TVSDK Metadata	2018-11-29	2018-12-05	https://helpx.adobe.com/security/products/flash-player/apsb18-42.html?red=a	http://blogs.360.cn/post/PoisonNeedles_CVE-2018-15982_EN	???	???
15	CVE-2018-8589	Microsoft	Windows	Memory Corruption	Race condition in win32k!xxxMoveWindow	2018-10-17	2018-11-13	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8589	https://securelist.com/a-new-exploit-for-zero-day-vulnerability-cve-2018-8589/88845/	FruityArmor/Stealth Falcon, and Sandcat	https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/
16	CVE-2018-8453	Microsoft	Windows	Memory Corruption	Use-after-free in win32kfull!xxxDestroyWindow	2018-08-17	2018-10-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453	https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/	FruityArmor/Stealth Falcon	https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/
17	CVE-2018-8373	Microsoft	VBScript	Memory Corruption	Use-after-free in VBScript AssignVar	2018-07-11	2018-08-14	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8373	https://blog.trendmicro.com/trendlabs-security-intelligence/use-after-free-uaf-vulnerability-cve-2018-8373-in-vbscript-engine-affects-internet-explorer-to-run-shellcode/	???	???
18	CVE-2018-5002	Adobe	Flash	Memory Corruption	Out-of-bounds read/write in AVM li8 opcode	???	2018-06-07	https://helpx.adobe.com/security/products/flash-player/apsb18-19.html	https://s.tencent.com/research/report/489.html	FruityArmor/Stealth Falcon	https://twitter.com/craiu/status/1038046509793722368
19	CVE-2018-4990	Adobe	Reader	Memory Corruption	Out-of-bounds free in JPEG2000 CMAP	???	2018-05-14	https://helpx.adobe.com/security/products/acrobat/apsb18-09.html	https://srcincite.io/blog/2018/05/21/adobe-me-and-a-double-free.html	???	???
20	CVE-2018-8120	Microsoft	Windows	Memory Corruption	NULL pointer dereference in NtUserSetImeInfoEx	???	2018-05-08	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120	https://www.welivesecurity.com/2018/05/15/tale-two-zero-days/	???	???
21	CVE-2018-8174	Microsoft	VBScript	Memory Corruption	Use-after-free in VBScriptClass::Release	???	2018-05-08	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174	https://securelist.com/root-cause-analysis-of-cve-2018-8174/85486/	???	???
22	CVE-2018-4878	Adobe	Flash	Memory Corruption	Use-after-free in MediaPlayer DRM Listener	???	2018-02-06	https://helpx.adobe.com/security/products/flash-player/apsb18-03.html	http://blog.morphisec.com/cve-2018-4878-an-analysis-of-the-flash-player-hack	ScarCruft/APT37/Reaper	https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html
23	CVE-2018-0802	Microsoft	Office	Memory Corruption	Buffer overflow in equation editor lfFaceName	???	2018-01-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802	https://www.freebuf.com/vuls/159789.html	???	???
24	CVE-2017-11292	Adobe	Flash	Memory Corruption	Type confusion in TVSDK BufferControlParameters	2017-10-10	2017-10-16	https://helpx.adobe.com/security/products/flash-player/apsb17-32.html	https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/	BlackOasis	https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
25	CVE-2017-11826	Microsoft	Office	Memory Corruption	Memory corruption in Open XML format nested tags	2017-09-28	2017-10-10	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826	https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analyzing-microsoft-office-zero-day-exploit-cve-2017-11826-memory-corruption-vulnerability/	???	???
26	CVE-2017-8759	Microsoft	Office	Logic/Design Flaw	Code injection in SOAP WSDL parser	???	2017-09-12	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759	https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html	BlackOasis	https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
27	CVE-2017-8464	Microsoft	Windows	Logic/Design Flaw	Code injection in LNK file ExtraData parsing	???	2017-06-13	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464	http://www.vxjump.net/files/vuln_analysis/cve-2017-8464.txt	???	???
28	CVE-2017-8543	Microsoft	Windows	Memory Corruption	Buffer overflow in Windows Search CTableVariant	???	2017-06-13	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8543	https://mp.weixin.qq.com/s/X2JcKCpCH4exDoxMK5oN5Q?	???	???
29	CVE-2017-0261	Microsoft	Office	Memory Corruption	Use-after free in EPS restore operator	???	2017-05-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0261	https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html	Turla	https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
30	CVE-2017-0262	Microsoft	Office	Memory Corruption	Type Confusion in EPS forall operator	???	2017-05-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0262	https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
31	CVE-2017-0263	Microsoft	Windows	Memory Corruption	Use-after-free in win32k!xxxDestroyWindow	???	2017-05-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0263	https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
32	CVE-2017-0222	Microsoft	Internet Explorer	Memory Corruption	Unspecified memory corruption in Internet Explorer	???	2017-05-09	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0222	???	???	???
33	CVE-2017-8291	Ghostscript	Ghostscript	Memory Corruption	Type confusion in rsdparams internal operator	???	2017-04-27	https://bugs.ghostscript.com/show_bug.cgi?id=697799	https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce1	???	https://web.archive.org/web/20170618201817/https://blog.hipchat.com/2017/04/24/hipchat-security-notice/
34	CVE-2017-0210	Microsoft	Internet Explorer	UXSS	UXSS in htmlFile ActiveX control	???	2017-04-11	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0210	https://blog.talosintelligence.com/2017/04/ms-tuesday.html	???	???
35	CVE-2017-0199	Microsoft	Office	Logic/Design Flaw	Logic/design flaw in embedded HTA documents	???	2017-04-11	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199	https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html	??? (FINSPY/LatentBot)	https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
36	CVE-2017-1274	IBM	Domino	Memory Corruption	Buffer overflow in IMAP EXAMINE (EmphasisMine)	???	2017-03-20	http://www-01.ibm.com/support/docview.wss?uid=swg22002280	???	Equation Group	https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
37	CVE-2017-3881	Cisco	IOS	Memory Corruption	Buffer overflow in IOS Cluster Management Protocol	???	2017-03-17	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp	https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/	Vault 7	https://blogs.cisco.com/security/the-wikileaks-vault-7-leak-what-we-know-so-far
38	CVE-2017-0149	Microsoft	Internet Explorer	Memory Corruption	Memory corruption in VBScript rtJoin	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-006	https://twitter.com/jq0904/status/1062168435818283008	???	???
39	CVE-2017-0022	Microsoft	XML Core Services	Information Leak	Information leak in MSXML version resource	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-022	https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-0022-microsoft-patches-vulnerability-exploited-adgholas-neutrino/	AdGholas/Neutrino	???
40	CVE-2017-0005	Microsoft	Windows	Memory Corruption	Unspecified memory corruption in GDI	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-013	https://cloudblogs.microsoft.com/microsoftsecure/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/	ZIRCONIUM/APT31	https://cloudblogs.microsoft.com/microsoftsecure/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/
41	CVE-2017-0143	Microsoft	Windows	Memory Corruption	Type confusion in SMB messages (EternalSynergy)	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010	https://blogs.technet.microsoft.com/srd/2017/07/13/eternal-synergy-exploit-analysis/	Equation Group	https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
42	CVE-2017-0144	Microsoft	Windows	Memory Corruption	Buffer overflow in SMB File Extended Attributes (EternalBlue)	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010	https://research.checkpoint.com/eternalblue-everything-know/	Equation Group	https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
43	CVE-2017-0145	Microsoft	Windows	Memory Corruption	Unspecified type confusion in SMB (EternalRomance)	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010	https://www.microsoft.com/security/blog/2017/06/16/analysis-of-the-shadow-brokers-release-and-mitigation-with-windows-10-virtualization-based-security/	Equation Group	https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
44	CVE-2017-0146	Microsoft	Windows	Memory Corruption	Race condition in SMB transactions (EternalChampion)	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010	https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/	Equation Group	https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
45	CVE-2017-0147	Microsoft	Windows	Information Leak	Information leak in SMB transactions (EternalChampion)	???	2017-03-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010	https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/	Equation Group	https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
46	CVE-2016-7892	Adobe	Flash	Memory Corruption	Unspecified use-after-free issue	???	2016-12-13	https://helpx.adobe.com/security/products/flash-player/apsb16-39.html	???	???	???
47	CVE-2016-9079	Mozilla	Firefox	Memory Corruption	Use-after-free in SVG Animation (Tor exploit)	2016-11-29	2016-11-30	https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/	https://bugzilla.mozilla.org/show_bug.cgi?id=1321066	Exodus Intel	https://www.forbes.com/sites/thomasbrewster/2016/12/02/exodus-intel-the-company-that-exposed-tor-for-cops-child-porn-bust/
48	CVE-2016-7256	Microsoft	Windows	Memory Corruption	Memory corruption on OpenType fonts CFF name index	???	2016-11-08	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-132	https://asec.ahnlab.com/1050	???	https://www.microsoft.com/security/blog/2017/01/13/hardening-windows-10-with-zero-day-exploit-mitigations/
49	CVE-2016-7255	Microsoft	Windows Kernel	Memory Corruption	Memory corruption in NtUserSetWindowLongPtr	2016-10-21	2016-11-08	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-135	https://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/
50	CVE-2016-7855	Adobe	Flash	Memory Corruption	Unspecified use-after-free issue	2016-10-21	2016-10-26	https://helpx.adobe.com/security/products/flash-player/apsb16-36.html	https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/
51	CVE-2016-5195	Linux	Kernel	Memory Corruption	Race condition in copy-on-write (DirtyCOW)	???	2016-10-18	https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails	???	???	???
52	CVE-2016-3298	Microsoft	Internet Explorer	Information Leak	Information leak in Microsoft.XMLDOM	???	2016-10-11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118	https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2016-3298-microsoft-fixes-another-ie-zero-day-used-in-adgholas/	AdGholas/Neutrino	https://www.proofpoint.com/us/threat-insight/post/microsoft-patches-CVE-2016-3298-second-information-disclosure-zero-day
53	CVE-2016-3393	Microsoft	Windows	Memory Corruption	Memory corruption in TTF cjComputeGLYPHSET_MSFT_GENERAL	???	2016-10-11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120	https://securelist.com/windows-zero-day-exploit-used-in-targeted-attacks-by-fruityarmor-apt/76396/	FruityArmor/Stealth Falcon	https://securelist.com/windows-zero-day-exploit-used-in-targeted-attacks-by-fruityarmor-apt/76396/
54	CVE-2016-7193	Microsoft	Office	Memory Corruption	Memory corruption in \dfrxst	???	2016-10-11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-121	https://paper.seebug.org/288/	???	???
55	CVE-2016-3351	Microsoft	Internet Explorer	Information Leak	Information leak in a.mimeType	???	2016-09-13	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104	https://blog.trendmicro.com/trendlabs-security-intelligence/microsoft-patches-ieedge-zeroday-used-in-adgholas-malvertising-campaign/	AdGholas	https://www.proofpoint.com/us/threat-insight/post/Microsoft-Patches-Zero-Day-Exploited-By-AdGholas-GooNky-Malvertising
56	CVE-2016-4655	Apple	iOS	Information Leak	Information leak in kernel OSUnserializeBinary (Pegasus)	2016-08-15	2016-08-25	https://support.apple.com/en-us/HT207107	https://info.lookout.com/rs/051-ESQ-475/images/pegasus-exploits-technical-details.pdf	NSO Group	https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
57	CVE-2016-4656	Apple	iOS	Memory Corruption	Use-after-free in kernel OSUnserializeBinary (Pegasus)	2016-08-15	2016-08-25	https://support.apple.com/en-us/HT207107	https://info.lookout.com/rs/051-ESQ-475/images/pegasus-exploits-technical-details.pdf	NSO Group	https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
58	CVE-2016-4657	Apple	WebKit	Memory Corruption	Use-after-free in MarkedArgumentBuffer (Pegasus)	2016-08-15	2016-08-25	https://support.apple.com/en-us/HT207107	https://info.lookout.com/rs/051-ESQ-475/images/pegasus-exploits-technical-details.pdf	NSO Group	https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
59	CVE-2016-6366	Cisco	ASA	Memory Corruption	Buffer overflow in SNMP parsing (EXTRABACON)	2016-08-15	2016-08-17	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp	https://blog.silentsignal.eu/2016/08/25/bake-your-own-extrabacon/	Equation Group	https://securelist.com/the-equation-giveaway/75812/
60	CVE-2016-6367	Cisco	ASA	Memory Corruption	Buffer overflow in CLI parsing (EPICBANANA)	2016-08-15	2016-08-17	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli	???	Equation Group	https://securelist.com/the-equation-giveaway/75812/
61	CVE-2016-4171	Adobe	Flash	Memory Corruption	Memory corruption in ExecPolicy metadata parsing	???	2016-06-15	https://helpx.adobe.com/security/products/flash-player/apsb16-18.html	https://securelist.com/operation-daybreak/75100/	ScarCruft/APT37/Reaper	https://securelist.com/operation-daybreak/75100/
62	CVE-2016-4117	Adobe	Flash	Memory Corruption	Type confusion in tvsdk DeleteRangeTimelineOperation	2016-05-08	2016-05-12	https://helpx.adobe.com/security/products/flash-player/apsb16-15.html	https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html	BlackOasis	https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
63	CVE-2016-0189	Microsoft	Internet Explorer	Memory Corruption	Memory corruption in VBScript AccessArray	???	2016-05-10	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051	https://theori.io/research/cve-2016-0189	???	https://www.symantec.com/connect/blogs/internet-explorer-zero-day-exploit-used-targeted-attacks-south-korea
64	CVE-2016-0162	Microsoft	Internet Explorer	Information Leak	Unspecified file detection issue	???	2016-04-12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-037	https://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/	Stegano/Astrum	https://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/
65	CVE-2016-0165	Microsoft	Windows Kernel	Memory Corruption	Buffer overflow in RGNMEMOBJ::vCreate	???	2016-04-12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039	https://www.secureauth.com/blog/ms16-039-windows-10-64-bits-integer-overflow-exploitation-by-using-gdi-objects	???	???
66	CVE-2016-0167	Microsoft	Windows Kernel	Memory Corruption	Use-after-free in win32k!xxxMNDestroyHandler	2016-03-08	2016-04-12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039	https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html	FIN8	https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html
67	CVE-2016-1019	Adobe	Flash	Memory Corruption	Type confusion in FileReference	2016-04-02	2016-04-07	https://helpx.adobe.com/security/products/flash-player/apsb16-10.html	https://blog.trendmicro.com/trendlabs-security-intelligence/look-adobe-flash-player-cve-2016-1019-zero-day-vulnerability/	Magnitude	https://www.proofpoint.com/us/threat-insight/post/killing-zero-day-in-the-egg
68	CVE-2016-1010	Adobe	Flash	Memory Corruption	Buffer overflow in BitmapData.copyPixels	???	2016-03-10	https://helpx.adobe.com/security/products/flash-player/apsb16-08.html	https://blog.trendmicro.com/trendlabs-security-intelligence/root-cause-analysis-recent-flash-zero-day-vulnerability-cve-2016-1010/	ScarCruft/APT37/Reaper	https://securelist.com/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/75082/
69	CVE-2016-0984	Adobe	Flash	Memory Corruption	Use-after-free in Sound.loadPCMFromByteArray	2016-01-11	2016-02-09	https://helpx.adobe.com/security/products/flash-player/apsb16-04.html	https://bugs.chromium.org/p/project-zero/issues/detail?id=698&redir=1	BlackOasis	https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
70	CVE-2016-0034	Microsoft	Silverlight	Memory Corruption	Memory corruption in BinaryReader	2015-11-25	2016-01-12	https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2016/ms16-006	https://securelist.com/blog/research/73255/the-mysterious-case-of-cve-2016-0034-the-hunt-for-a-microsoft-silverlight-0-day/	HackingTeam	https://web.archive.org/web/20150706010312/https://twitter.com/hackingteam
71	CVE-2015-8651	Adobe	Flash	Memory Corruption	Integer overflow in domainMemory	???	2015-12-28	https://helpx.adobe.com/security/products/flash-player/apsb16-01.html	???	Dark Hotel	https://web.archive.org/web/20160104165148/http://drops.wooyun.org/tips/11726
72	CVE-2015-6175	Microsoft	Windows Kernel	Memory Corruption	Memory corruption in gpuenergydrv.sys	???	2015-12-08	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-135	???	???
73	CVE-2015-4902	Oracle	Java	Logic/Design Flaw	Click-to-play bypass	???	2015-10-20	https://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html	https://blog.trendmicro.com/trendlabs-security-intelligence/new-headaches-how-the-pawn-storm-zero-day-evaded-javas-click-to-play-protection/	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://blog.trendmicro.com/trendlabs-security-intelligence/new-headaches-how-the-pawn-storm-zero-day-evaded-javas-click-to-play-protection/
74	CVE-2015-7645	Adobe	Flash	Type Confusion	Type confusion in IExternalizable.writeExternal	2015-10-13	2015-10-16	https://helpx.adobe.com/security/products/flash-player/apsb15-27.html	https://bugs.chromium.org/p/project-zero/issues/detail?id=547	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/
75	CVE-2015-2546	Microsoft	Windows Kernel	Memory Corruption	Use-after-free in xxxSendMessage (tagPOPUPMENU)	???	2015-09-08	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-097	https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf	???	???
76	CVE-2015-2545	Microsoft	Office	Memory Corruption	Use-after-free in EPS forall operator	???	2015-09-08	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-099	https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf	???	???
77	CVE-2015-2502	Microsoft	Internet Explorer	Memory Corruption	Use-after-free in CMarkup::ReparentTableSection	???	2015-08-18	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-093	https://twitter.com/Laughing_Mantis/statuses/633839231840841728	???	???
78	CVE-2015-1642	Microsoft	Office	Memory Corruption	Use-after-free in CTaskSymbol	2015-02-27	2015-08-11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081	https://labs.mwrinfosecurity.com/advisories/2015/08/17/microsoft-office-ctasksymbol-use-after-free-vulnerability/	???	???
79	CVE-2015-1769	Microsoft	Windows	Logic/Design Flaw	Symbolic link attack in Mount Manager	???	2015-08-11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-085	http://h3ysatan.blogspot.com/2016/01/cve-2015-1769-cve-2015-1769-mount.html	???	???
80	CVE-2015-2426	Microsoft	Windows	Memory Corruption	OpenType Font Driver buffer overflow in ZwGdiAddFontMemResourceEx	2015-07-05	2015-07-20	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078	http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-leak-uncovers-another-windows-zero-day-ms-releases-patch/	HackingTeam	https://web.archive.org/web/20150706010312/https://twitter.com/hackingteam
81	CVE-2015-5122	Adobe	Flash	Use-after-free	Use-after-free in TextBlock	2015-07-05	2015-07-14	https://helpx.adobe.com/security/products/flash-player/apsb15-18.html	https://blog.trendmicro.com/trendlabs-security-intelligence/another-zero-day-vulnerability-arises-from-hacking-team-data-leak/	HackingTeam	https://web.archive.org/web/20150706010312/https://twitter.com/hackingteam
82	CVE-2015-5123	Adobe	Flash	Use-after-free	Use-after-free in BitmapData	2015-07-05	2015-07-14	https://helpx.adobe.com/security/products/flash-player/apsb15-18.html	https://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerges-from-hacking-team-leak/	HackingTeam	https://web.archive.org/web/20150706010312/https://twitter.com/hackingteam
83	CVE-2015-2387	Microsoft	Windows Kernel	Memory Corruption	ATMFD.DLL named escape memory corruption	2015-07-05	2015-07-14	https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-077	https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/	HackingTeam	https://web.archive.org/web/20150706010312/https://twitter.com/hackingteam
84	CVE-2015-2425	Microsoft	Internet Explorer	Use-after-free	Use-after-free in MutationObserver	2015-07-05	2015-07-14	https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-065	https://blog.trendmicro.com/trendlabs-security-intelligence/gifts-from-hacking-team-continue-ie-zero-day-added-to-mix/	HackingTeam	https://web.archive.org/web/20150706010312/https://twitter.com/hackingteam
85	CVE-2015-2424	Microsoft	Office	Memory Corruption	Heap corruption in Forms.Image.1	2015-06-30	2015-07-14	https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-070	https://web.archive.org/web/20150717041821/http://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://web.archive.org/web/20150717041821/http://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/
86	CVE-2015-2590	Oracle	Java	Race Condition	Race condition in ObjectInputStream.readSerialData	???	2015-07-14	https://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	https://twitter.com/tiraniddo/status/621308239909646336	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-trend-micro-discovers-new-java-zero-day-exploit/
87	CVE-2015-5119	Adobe	Flash	Use-after-free	Use-after-free in ByteArray ValueOf	2015-07-05	2015-07-08	https://helpx.adobe.com/security/products/flash-player/apsb15-16.html	https://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/	HackingTeam	https://web.archive.org/web/20150706010312/https://twitter.com/hackingteam
88	CVE-2015-3113	Adobe	Flash	Memory Corruption	Buffer overflow in FLV media parsing	???	2015-06-23	https://helpx.adobe.com/security/products/flash-player/apsb15-14.html	https://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-zero-day-shares-same-root-cause-as-older-flaws/	APT3	https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html
89	CVE-2015-2360	Microsoft	Windows Kernel	Memory Corruption	Use-after-free on tagCLS object	???	2015-06-09	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-061	https://blog.trendmicro.com/trendlabs-security-intelligence/analysis-of-cve-2015-2360-duqu-2-0-zero-day-vulnerability/	Duqu/Unit 8200	https://securelist.com/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/70504/
90	CVE-2015-4495	Mozilla	Firefox	Logic/Design Flaw	Same-origin policy bypass in PDF reader	2015-08-05	2015-08-06	https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/	https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/	???	???
91	CVE-2015-1701	Microsoft	Windows Kernel	Logic/Design Flaw	CreateWindow callback validation error	2015-04-18	2015-05-12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051	https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
92	CVE-2015-3043	Adobe	Flash	Memory Corruption	Buffer overflow in FLV media parsing	2015-04-13	2015-04-14	https://helpx.adobe.com/security/products/flash-player/apsb15-06.html	https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html	APT28/Sofacy/Pawn Storm/Fancy Bear/Sednit/STRONTIUM/Tsar Team	https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
93	CVE-2015-1641	Microsoft	Office	Memory Corruption	Type confusion in SmartTag element	???	2015-04-14	https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-033	https://paper.seebug.org/351/	???	???
94	CVE-2015-0071	Microsoft	Internet Explorer	Information Leak	Out-of-bounds read in Js::JavascriptRegExpConstructor::SetProperty	???	2015-02-10	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009	http://blog.trendmicro.com/trendlabs-security-intelligence/bypassing-aslr-with-cve-2015-0071-an-out-of-bounds-read-vulnerability/	Codoso/APT19	https://web.archive.org/web/20150213004519/http://www.isightpartners.com/2015/02/codoso/
95	CVE-2015-0313	Adobe	Flash	Use-after-free	Use-after-free in ByteArray::Clear	2015-01-14	2015-02-05	https://helpx.adobe.com/security/products/flash-player/apsb15-04.html	http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-0313-the-new-flash-player-zero-day/	Hanjuan	https://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-0313-the-new-flash-player-zero-day/
96	CVE-2015-0311	Adobe	Flash	Use-after-free	Use-after-free in ByteArray::UncompressViaZlibVariant	2015-01-20	2015-01-27	https://helpx.adobe.com/security/products/flash-player/apsb15-03.html	https://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-0311-flash-zero-day-vulnerability/	Angler	https://blog.trendmicro.com/trendlabs-security-intelligence/flash-greets-2015-with-new-zero-day/
97	CVE-2015-0310	Adobe	Flash	Information Leak	Out-of-bounds read in RegExp::exec	2015-01-16	2015-01-22	https://helpx.adobe.com/security/products/flash-player/apsb15-02.html	https://bugs.chromium.org/p/chromium/issues/detail?id=442585	Angler	https://www.fireeye.com/blog/threat-research/2015/05/angler_ek_exploiting.html
98	CVE-2015-0016	Microsoft	Windows	Logic/Design Flaw	Improper path validation leads to IE sandbox escape	???	2015-01-13	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-004	http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explorer-sandbox/	???	???
99	CVE-2014-9163	Adobe	Flash	Memory Corruption	Unspecified stack buffer overflow in Flash	???	2014-12-09	https://helpx.adobe.com/security/products/flash-player/apsb14-27.html	???	Codoso/APT19	https://web.archive.org/web/20150213004519/http://www.isightpartners.com/2015/02/codoso/
100	CVE-2014-6324	Microsoft	Windows	Logic/Design Flaw	Logic/design flaw in Kerberos KDC allowing remote domain controller escalation of privilege	???	2014-11-18	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068	https://blogs.technet.microsoft.com/srd/2014/11/18/additional-information-about-cve-2014-6324/	???	???
101	CVE-2014-6352	Microsoft	Office	Logic/Design Flaw	Logic/design flaw in Packager OLE class	???	2014-11-11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064	https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/bypassing-microsofts-patch-for-the-sandworm-zero-day-even-editing-can-cause-harm/	???	???
102	CVE-2014-4077	Microsoft	Windows	Logic/Design Flaw	Unspecified sandbox escape vulnerability in IME (Japanese)	???	2014-11-11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-078	???	???	???
103	CVE-2014-4113	Microsoft	Windows	Memory Corruption	NULL pointer dereference in win32k!win32k!xxxHandleMenuMessages	???	2014-10-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-058	https://www.fireeye.com/blog/threat-research/2014/10/two-targeted-attacks-two-new-zero-days.html	HURRICANE PANDA	https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/
104	CVE-2014-4148	Microsoft	Windows	Memory Corruption	Unspecified memory corruption in TrueType fonts	???	2014-10-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-058	https://www.fireeye.com/blog/threat-research/2014/10/two-targeted-attacks-two-new-zero-days.html	???	???
105	CVE-2014-8439	Adobe	Flash	Memory Corruption	Unspecified memory corruption in Flash	???	2014-10-14	https://helpx.adobe.com/security/products/flash-player/apsb14-22.html	???	Angler	https://www.f-secure.com/weblog/archives/00002768.html
106	CVE-2014-4123	Microsoft	Internet Explorer	Memory Corruption	Unspecified sandbox escape vulnerability	???	2014-10-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-056	???	???	???
107	CVE-2014-4114	Microsoft	Office	Logic/Design Flaw	Logic/design flaw in Packager OLE class	???	2014-10-14	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-060	https://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/	Sandworm/Black Energy	https://web.archive.org/web/20141014083644/http://www.isightpartners.com/2014/10/cve-2014-4114/
108	CVE-2014-0546	Adobe	Reader	Logic/Design Flaw	Unspecified sandbox escape vulnerability	???	2014-08-12	https://helpx.adobe.com/security/products/acrobat/apsb14-19.html	???	Animal Farm	https://securelist.com/the-mysterious-case-of-cve-2016-0034-the-hunt-for-a-microsoft-silverlight-0-day/73255/
109	CVE-2014-2817	Microsoft	Internet Explorer	Logic/Design Flaw	Sandbox escape in IIEAxInstallBrokerBrokerPtr	???	2014-08-12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-051	https://twitter.com/tiraniddo/status/522135160675127296	???	???

tweets:

Tweets by benhawkes

liked this article?

only together we can create a truly free world
plz support dwaves to keep it up & running!
(yes the info on the internet is (mostly) free but beer is still not free (still have to work on that))
really really hate advertisement
contribute: whenever a solution was found, blog about it for others to find!
talk about, recommend & link to this blog and articles
thanks to all who contribute!

admin