openSUSE Security Update : proftpd (openSUSE-2020-31)

This update for proftpd fixes the following issues : - GeoIP has been discontinued by Maxmind boo1156210 This update removes module build for geoip see https://support.maxmind.com/geolite-legacy-discontinuati on-notice/ - CVE-2019-19269: Fixed a NULL pointer dereference may occur when validating...

libressl/asn1: Crash in asn1_item_print_ctx

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5653710820081664 Project: libressl Fuzzer: afllibresslasn1 Fuzz target binary: asn1 Job Type: aflasanlibressl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60a0018b0000 Cra...

cryptofuzz/cryptofuzz-libressl: Crash in aesni_ctr32_encrypt_blocks

Detailed report: https://oss-fuzz.com/testcase?key=5738110048010240 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-libressl Fuzz target binary: cryptofuzz-libressl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x617000010000 Crash State:...

cryptofuzz/cryptofuzz-libressl: Crash in aesni_encrypt

Detailed report: https://oss-fuzz.com/testcase?key=5751567346565120 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-libressl Fuzz target binary: cryptofuzz-libressl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x617000010000 Crash State:...

cryptofuzz/cryptofuzz-libressl: Bad-free in aes_gcm_cleanup

Project: https://github.com/guidovranken/cryptofuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5749345716011008 Project: cryptofuzz Fuzzer: aflcryptofuzzcryptofuzz-libressl Fuzz target binary: cryptofuzz-libressl Job Type: aflasancryptofuzz Platform Id: linux Crash Type: Bad-free Cras...

libressl/asn1: Heap-buffer-overflow in asn1_item_ex_d2i

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5666378322804736 Project: libressl Fuzzer: libFuzzerlibresslasn1 Fuzz target binary: asn1 Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

macOS < 10.14 Multiple Vulnerabilities

Binary data 700518.prm...

libressl/asn1: Heap-buffer-overflow in c2i_ASN1_INTEGER

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5723457666416640 Project: libressl Fuzzer: libFuzzerlibresslasn1 Fuzz target binary: asn1 Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

libressl/asn1: Crash in asn1_item_print_ctx

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5665138134220800 Project: libressl Fuzzer: libFuzzerlibresslasn1 Fuzz target binary: asn1 Job Type: libfuzzerubsanlibressl Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

libressl/asn1: Heap-buffer-overflow in do_print_ex

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5685609458302976 Project: libressl Fuzzer: libFuzzerlibresslasn1 Fuzz target binary: asn1 Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

openSUSE Security Update : libressl (openSUSE-2019-644)

This update for libressl to version 2.8.0 fixes the following issues : Security issues fixed : - CVE-2018-12434: Avoid a timing side-channel leak when generating DSA and ECDSA signatures. boo1097779 - Reject excessively large primes in DH key generation. Other bugs fixed : - Fixed a pair of 20+...

libressl/asn1: Heap-buffer-overflow in ASN1_get_object

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5740695165337600 Project: libressl Fuzzer: libFuzzerlibresslasn1 Fuzz target binary: asn1 Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

libressl/client: Global-buffer-overflow in ssl_sigalg

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5667522344386560 Project: libressl Fuzzer: libFuzzerlibresslclient Fuzz target binary: client Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: Global-buffer-overflow READ 2...

libressl/asn1: Crash in BN_bin2bn

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5661545494740992 Project: libressl Fuzzer: libFuzzerlibresslasn1 Fuzz target binary: asn1 Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

libressl/server: Global-buffer-overflow in ssl_sigalg

Project: https://github.com/libressl-portable/portable.git Detailed report: https://oss-fuzz.com/testcase?key=5658594446409728 Project: libressl Fuzzer: libFuzzerlibresslserver Fuzz target binary: server Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: Global-buffer-overflow READ 2...

openSUSE Security Update : nginx (openSUSE-2019-195)

This update for nginx fixes the following issues : nginx was updated to 1.14.2 : - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the 'http request...

openSUSE: Security Advisory for nginx (openSUSE-SU-2019:0195-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 28 : python-cryptography / python-cryptography-vectors (2018-a9fe5e183e)

New upstream release 2.3 Fixes possible tag truncation security bug in AEAD API, see RHBZ1602752 2.3 - 2018-07-18 - SECURITY ISSUE: finalizewithtag allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the mintaglength provided to the GCM constructor...

Fedora 29 : mongo-c-driver (2018-2f8f5f75f1)

libbson 1.13.0 Features: - New functions to save and restore progress of a bsonitert: bsoniterkeylen, bsoniteroffset, and soniterinitfromdataatoffset Additional functions bsoniteroverwritedatetime, bsoniteroverwriteoid, and bsoniteroverwritetimestamp. All fixed-length BSON values can now be updat...

Armor - Tool Designed To Create Encrypted macOS Payloads Capable Of Evading Antivirus Scanners

Armor is a simple Bash script designed to create encrypted macOS payloads capable of evading antivirus scanners. Below is an example gif of Armor being used with a simple Netcat payload. A Netcat listener is started on port 4444. The "payload.txt" file is read and shown to contain a simple Bash...