SUSE-SU-2020:2346-1 Security update for graphviz

This update for graphviz fixes the following issues: - CVE-2018-10196: Fixed a null dereference in rebuildvlis bsc1093447...

Fedora 31 : libmetalink (2020-2a9b45c1f5)

Patched null ptr dereference Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

skia:sksl2spirv: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5806581326020608 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2spirv Job Type: libfuzzerubsanskia Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: undefined UBSAN Crash...

USN-4419-1 linux, linux-lts-xenial, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

It was discovered that a race condition existed in the Precision Time Protocol PTP implementation in the Linux kernel, leading to a use-after- free vulnerability. A local attacker could possibly use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-10690...

USN-4411-1 linux, linux-aws, inux-azure, linux-gcp, linux-kvm, linux-oracle, linux-raspi, linux-riscv vulnerabilities

It was discovered that the elf handling code in the Linux kernel did not initialize memory before using it in certain situations. A local attacker could use this to possibly expose sensitive information kernel memory. CVE-2020-10732 Matthew Sheets discovered that the SELinux network label handlin...

OSV-2020-569 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15388 Crash type: Null-dereference READ Crash state: NULL...

OSV-2020-280 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15458 Crash type: Null-dereference READ Crash state: NULL...

Open-Xchange: Null dereference or redundant null check in `mail_crypt_load_global_private_key` for plugin mail-crypt

In this function, we check once if errorr is not NULL in if enctype == DCRYPTKEYENCRYPTIONTYPEPASSWORD / Fail here if password is not set since openssl will prompt for it otherwise / if keypassword == NULL if errorr != NULL errorr = tstrdupprintf"%s: %s unset, no " "password to decrypt the key",...

Open-Xchange: Null dereference in mcht_relational_validate ext-relational-common.c:136

To reproduce, run test suite on following input : require "vnd.dovecot.testsuite"; require "relational"; require "comparator-i;ascii-numeric"; require "body"; / / testset "message" text: From: Whomever To: Someone Date: Sat, 10 Oct 2009 00:30:04 +0200 Subject: whatever . ; / RFC5173, Section 5.2:...

ipfs:ipfs_ds_flatfs: Null-dereference READ in _cgo_try_pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5714274837331968 Project: ipfs Fuzzing Engine: libFuzzer Fuzz Target: ipfsdsflatfs Job Type: libfuzzerasanipfs Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: cgotrypthreadcreate Sanitizer: address...

gnutls:gnutls_client_fuzzer: Null-dereference READ with empty stacktrace

Project: https://gitlab.com/gnutls/gnutls.git Detailed Report: https://oss-fuzz.com/testcase?key=5102053377703936 Project: gnutls Fuzzing Engine: afl Fuzz Target: gnutlsclientfuzzer Job Type: aflasangnutls Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash...

envoy:codec_impl_fuzz_test: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5176497475420160 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: undefined UBSAN...

systemd:fuzz-netdev-parser: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5142453635252224 Project: systemd Fuzzing Engine: libFuzzer Fuzz Target: fuzz-netdev-parser Job Type: libfuzzermsansystemd Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: memory MSAN...

suricata:fuzz_siginit: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5093448282800128 Project: suricata Fuzzing Engine: honggfuzz Fuzz Target: fuzzsiginit Job Type: honggfuzzasansuricata Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN Cra...

Red Hat newlib libc library code issue vulnerability (CNVD-2020-19541)

Red Hat is the world's leading provider of enterprise open source solutions using a community-supported approach to delivering high-performance Linux, cloud, container and Kubernetes technologies. A code issue vulnerability exists in the 'mdiff' function in newlib libc library versions prior to...

UBUNTU-CVE-2019-14878

In the d2b function of the newlib libc library, all versions prior to 3.3.0 see newlib/libc/stdlib/mprec.c, Balloc is used to allocate a big integer, however no check is performed to verify if the allocation succeeded or not. Accessing x will trigger a null pointer dereference bug in case of a...

libavif:avif_decode_fuzzer: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5645512985542656 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: avifdecodefuzzer Job Type: libfuzzerasanlibavif Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN...

dav1d:dav1d_fuzzer: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5687738131283968 Project: dav1d Fuzzing Engine: libFuzzer Fuzz Target: dav1dfuzzer Job Type: libfuzzerasani386dav1d Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x00000000 Crash State: NULL Sanitizer: address ASAN Crash...

gonids:fuzz_parserule: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5637363944652800 Project: gonids Fuzzing Engine: libFuzzer Fuzz Target: fuzzparserule Job Type: libfuzzerasangonids Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN Crash...

SUSE-SU-2020:0353-1 Security update for systemd

This update for systemd provides the following fixes: - CVE-2020-1712 bscbsc1162108 Fix a heap use-after-free vulnerability, when asynchronous Polkit queries were performed while handling Dbus messages. A local unprivileged attacker could have abused this flaw to crash systemd services or...