Oracle Linux 8 : mysql:8.0 (ELSA-2020-3732)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3732 advisory. mysql 8.0.21-1 - Rebase to 8.0.21 - Use bundled libzstd and libevent for RHSCL and RHEL-8.0.0 - Check that we have correct versions in bundled Provides...

mysql:8.0 security update

mysql 8.0.21-1 - Rebase to 8.0.21 - Use bundled libzstd and libevent for RHSCL and RHEL-8.0.0 - Check that we have correct versions in bundled Provides - Remove re2 bundled dependency 8.0.20-1 - Rebase to 8.0.20 8.0.19-2 - Specify all perl dependencies 8.0.19-1 - Rebase to 8.0.19 8.0.18-1 - Rebas...

golang-protobuf:wirefuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5713763813294080 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000002215c2e Crash State: NULL Sanitizer: address ASAN...

Updated mysql-connector-python packages fix security vulnerability

Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion o...

golang-protobuf:wirefuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5641960472444928 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000014ba Crash State: NULL Sanitizer: address ASAN...

PT-2020-6441

Name of the Vulnerable Software and Affected Versions GoGo Protobuf versions prior to 1.3.2 Description The issue is related to improper index validation in the unmarshal.go file of the GoGo Protobuf library, which can lead to an out-of-bounds panic when parsing maliciously crafted input. This ma...

golang-protobuf:textfuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4719499044192256 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: textfuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000055da Crash State: NULL Sanitizer: address ASAN...

golang-protobuf:textfuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5636435612008448 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: textfuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000004c00 Crash State: NULL Sanitizer: address ASAN...

Valve: Signedness issue in ClassInfo message handler leads to RCE on CS:GO client

Title: Signedness issue in ClassInfo message handler leads to RCE on CS:GO client Scope: csgo.exe Weakness: Array Index Underflow Severity: Critical 9.6 Link: https://hackerone.com/reports/876719 Date: 2020-05-17 20:31:35 +0000 By: @chaynik Details: Vulnerability ------------- CSVCMsgClassInfo...

golang-protobuf:wirefuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5652073511387136 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000059044a4 Crash State: NULL Sanitizer: address ASAN...

golang-protobuf:jsonfuzz: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5153923757506560 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: jsonfuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: addre...

actix-protobuf (>=0.4.0, <=0.4.1), arc-cli (0.1.0) +106 more potentially affected by CVE-2020-35858 via prost (>=0.1.0, <=0.5.0)

prost CARGO version =0.1.0, =0.4.0, =0.8.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0-alpha, =0.1.0, =0.1.0, =0.8.0, =0.1.0-alpha.1, =0.1.0-alpha.2 and more Source cves: CVE-2020-35858 Source advisory: OSV:RUSTSEC-2020-0002...

SockPuppet: A Walkthrough of a Kernel Exploit for iOS 12.4

Posted by Ned Williamson, 20% on Project Zero Introduction I have a somewhat unique opportunity in this writeup to highlight my experience as an iOS research newcomer. Many high quality iOS kernel exploitation writeups have been published, but those often feature weaker initial primitives combine...

CVE-2019-15544

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

Design/Logic Flaw

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

CVE-2019-15544

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

CVE-2019-15544

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

CVE-2019-15544

The CVE-2019-15544 issue affects the protobuf crate for Rust (pre-2.6.0). The vulnerability arises from Vec::reserve being fed by user-supplied input, enabling memory exhaustion. Documented impact: Out-of-Memory conditions, potentially affecting affected Rust crates that rely on this protobuf imp...

CVE-2019-15544: Allocation of Resources Without Limits or Throttling

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls...

auth (0.1.0), dat-network-protocol (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2019-15544 via protobuf (>=1.0.24, <=1.7.4)

protobuf CARGO version =1.0.24, =0.1.3, =0.3.1, =0.3.1, =1.7.2, =0.3.1, =0.0.1, =0.1.0, =0.1.2, =0.1.4 and more Source cves: CVE-2019-15544 Source advisory: OSV:RUSTSEC-2019-0003...