EUVD-2021-29358

Malicious code in bioql PyPI...

EUVD-2021-29359

Malicious code in bioql PyPI...

clickhouse:lz4_decompress_fuzzer: Use-of-uninitialized-value in DB::ICompressionCodec::~ICompressionCodec

Project: https://github.com/ClickHouse/ClickHouse.git Detailed Report: https://oss-fuzz.com/testcase?key=6349126845726720 Project: clickhouse Fuzzing Engine: libFuzzer Fuzz Target: lz4decompressfuzzer Job Type: libfuzzermsanclickhouse Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

DEBIAN-CVE-2021-42388

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl loop, a 16-bit unsigned user-supplied value 'offset' is read from the compressed data. The offset is later used in the length of a copy operation, without checking the...