CVE-2019-11465

An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even...

CVE-2019-11465

CVE-2019-11465 affects Couchbase Server 5.5.x (up to 5.5.3) and 6.0.0. The Memcached "connections" stat block exposes a non-redacted username and system info from bug reports, potentially leaking user names. The issue is fixed in 5.5.4 and 6.0.1 by properly tagging usernames in logs and hashing t...

libhevc:hevc_dec_fuzzer: Use-of-uninitialized-value in ihevcd_fmt_conv_420sp_to_rgb565

Detailed Report: https://oss-fuzz.com/testcase?key=5728697516032000 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzermsanlibhevc Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: ihevcdfmtconv420sptorgb565 ihevcdfmtconv...

libssh2:ssh2_client_fuzzer: Crash in _libssh2_ntohu32

Project: https://github.com/cmeister2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5705819873607680 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerasanlibssh2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60200a000116...

libssh2:ssh2_client_fuzzer: Heap-buffer-overflow in _libssh2_ntohu32

Project: https://github.com/cmeister2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5651535966502912 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerasanlibssh2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

file:magic_fuzzer: Heap-buffer-overflow in cdf_read_property_info

Project: https://github.com/file/file.git Detailed Report: https://oss-fuzz.com/testcase?key=5687868487368704 Project: file Fuzzing Engine: libFuzzer Fuzz Target: magicfuzzer Job Type: libfuzzerasani386file Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0xef4dd848 Cras...

libvips:jpegsave_buffer_fuzzer: Heap-buffer-overflow in exif_entry_get_value

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5768110933540864 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavebufferfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

CVE-2019-15144

In DjVuLibre 3.5.27, the sorting functionality aka GArrayTemplate::sort allows attackers to cause a denial-of-service application crash due to an Uncontrolled Recursion by crafting a PBM image file that is mishandled in libdjvu/GContainer.h...

mpg123/decode_fuzzer: Heap-buffer-overflow in INT123_parse_new_id3

Detailed report: https://oss-fuzz.com/testcase?key=5081170552815616 Project: mpg123 Fuzzer: aflmpg123decodefuzzer Fuzz target binary: decodefuzzer Job Type: aflasanmpg123 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6040000000c0 Crash State: INT123parsenewid3...

freeimage/load_from_memory_fuzzer: Heap-buffer-overflow in LoadPixelDataRLE4

Detailed report: https://oss-fuzz.com/testcase?key=5116007367049216 Project: freeimage Fuzzer: aflloadfrommemoryfuzzer Fuzz target binary: loadfrommemoryfuzzer Job Type: aflasanfreeimage Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x7f0ea94779b0 Crash State:...

libxslt/xslt: Use-of-uninitialized-value in xmlStrlen

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed report: https://oss-fuzz.com/testcase?key=5669481868689408 Project: libxslt Fuzzer: libFuzzerlibxsltxslt Fuzz target binary: xslt Job Type: libfuzzermsanlibxslt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

njs/njs_process_script_fuzzer: Crash in njs_object_prop_alloc

Project: http://hg.nginx.org/njs Detailed report: https://oss-fuzz.com/testcase?key=5688604573040640 Project: njs Fuzzer: libFuzzernjsprocessscriptfuzzer Fuzz target binary: njsprocessscriptfuzzer Job Type: libfuzzerubsannjs Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x001002c33f2...

cryptofuzz/cryptofuzz-openssl-110-noasm: Stack-buffer-overflow in RC5_32_set_key

Project: https://github.com/guidovranken/cryptofuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5636104176271360 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-openssl-110-noasm Fuzz target binary: cryptofuzz-openssl-110-noasm Job Type: libfuzzerasancryptofuzz Platform Id:...

icu/collator_rulebased_fuzzer: Crash in icu_64::UCharsTrie::branchNext

Project: https://github.com/unicode-org/icu.git Detailed report: https://oss-fuzz.com/testcase?key=5649936613376000 Project: icu Fuzzer: libFuzzericucollatorrulebasedfuzzer Fuzz target binary: collatorrulebasedfuzzer Job Type: libfuzzerasanicu Platform Id: linux Crash Type: UNKNOWN READ Crash...

divinepets.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-871426 Security Researcher logindenied Helped patch 7927 vulnerabilities Received 8 Coordinated Disclosure badges Received 76 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting divinepets.com website...

wget2/wget_options_fuzzer: Stack-buffer-overflow in _compare_tag

Project: https://gitlab.com/gnuwget/wget2.git Detailed report: https://oss-fuzz.com/testcase?key=5670699290591232 Project: wget2 Fuzzer: libFuzzerwget2wgetoptionsfuzzer Fuzz target binary: wgetoptionsfuzzer Job Type: libfuzzerasanwget2 Platform Id: linux Crash Type: Stack-buffer-overflow READ 8...

imagemagick/encoder_pjpeg_fuzzer: Use-of-uninitialized-value in encode_mcu_DC_first

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5712832717389824 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpjpegfuzzer Fuzz target binary: encoderpjpegfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

CVE-2019-5827

Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2019-5829

Integer overflow in download manager in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...

CVE-2019-12972

An issue was discovered in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in bfddoprnt in bfd.c because elfobjectp in elfcode.h mishandles an eshstrndx section of type SHTGROUP by omitting a trailing '\0' character...