Debian: Security Advisory (DSA-4181-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome < 66.0.3359.117 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 66.0.3359.117. It is, therefore, affected by multiple vulnerabilities as referenced in the 201804stable-channel-update-for-desktop advisory. - Insufficiently sanitized distributed objects in Updater in Google Chrome on...

Stable Channel Update for Desktop

The stable channel has been updated to 66.0.3359.139 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

wireshark/fuzzshark_ip_proto-udp: Heap-buffer-overflow in dissect_ber_constrained_bitstring

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=4859050050191360 Project: wireshark Fuzzer: aflwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: aflasanwireshark...

icu/number_format_fuzzer: Crash in __msan_memset

Detailed report: https://oss-fuzz.com/testcase?key=6252124296970240 Project: icu Fuzzer: libFuzzericunumberformatfuzzer Fuzz target binary: numberformatfuzzer Job Type: libfuzzermsanicu Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x72f000010000 Crash State: msanmemset...

imagemagick/enhance_fuzzer: Use-of-uninitialized-value in EnhanceImage

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5651741958733824 Project: imagemagick Fuzzer: libFuzzerimagemagickenhancefuzzer Fuzz target binary: enhancefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Debian: Security Advisory (DSA-4178-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 66 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 66.0.3359.117 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcomin...

[SECURITY] Fedora 28 Update: freexl-1.0.5-1.fc28

FreeXL is a library to extract valid data from within an Excel spreadsheet .xls Design goals: simple and lightweight stable, robust and efficient easily and universally portable completely ignore any GUI-related oddity...

openssl/asn1: Heap-buffer-overflow in asn1_ex_i2c

Project: https://github.com/openssl/openssl.git Detailed report: https://oss-fuzz.com/testcase?key=5721463706353664 Project: openssl Fuzzer: aflopensslasn1 Fuzz target binary: asn1 Job Type: aflasanopenssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6030000029f1...

systemd/fuzz-unit-file: Use-of-uninitialized-value in streq_ptr

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=4908210742886400 Project: systemd Fuzzer: libFuzzersystemdfuzz-unit-file Fuzz target binary: fuzz-unit-file Job Type: libfuzzermsansystemd Platform Id: linux Crash Type: Use-of-uninitialized-value...

libtiff/tiff_read_rgba_fuzzer: Use-of-uninitialized-value in inflate

Detailed report: https://oss-fuzz.com/testcase?key=5273368258412544 Project: libtiff Fuzzer: libFuzzerlibtifftiffreadrgbafuzzer Fuzz target binary: tiffreadrgbafuzzer Job Type: libfuzzermsanlibtiff Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: inflate...

imagemagick/ping_mng_fuzzer: Use-of-uninitialized-value in mng_minimum_box

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=6209869771177984 Project: imagemagick Fuzzer: libFuzzerimagemagickpingmngfuzzer Fuzz target binary: pingmngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

CVE-2018-6918

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able ...

graphicsmagick/coder_XCF_fuzzer: Use-of-uninitialized-value in AlphaCompositePixel

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5383447750115328 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderXCFfuzzer Fuzz target binary: coderXCFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

net-snmp/agentx_parse_fuzzer: Stack-buffer-overflow in agentx_parse_string

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed report: https://oss-fuzz.com/testcase?key=5727267801006080 Project: net-snmp Fuzzer: libFuzzernet-snmpagentxparsefuzzer Fuzz target binary: agentxparsefuzzer Job Type: libfuzzerasannet-snmp Platform I...

Debian: Security Advisory (DSA-4162-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4156-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4156-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 29, 2018 https://www.debian.org/security/faq -...

VulnCheck KEV: CVE-2017-20149

The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on...

Scilico I, Librarian 'id' Parameter Cross-Site Scripting Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. A cross-site scripting vulnerability exists in the 'id' parameter of the stable.php file in Scilico I, Librarian 4.8 and earlier versions. A remote attacker can exploit this vulnerability to...