ffmpeg:ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer: Index-out-of-bounds in decode_init

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4817404984688640 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDWMALOSSLESSfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

RHEL 8 : kernel (RHSA-2022:4829)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4829 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: buffer overflow in IPsec ESP...

RHEL 8 : kernel-rt (RHSA-2022:4835)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4835 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

ndpi:fuzz_process_packet: Stack-buffer-overflow in tlsCheckUncommonALPN

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4555895104733184 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7ffda36b6980...

USN-5395-2: networkd-dispatcher regression | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description USN-5395-1 fixed vulnerabilities in networkd-dispatcher. Unfortunately that update was incomplete and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Origina...

com.mtvi.plateng.hudson:ldapemail (0.8), org.jenkins-ci.main:jenkins-test-harness (1.436) +7 more potentially affected by CVE-2021-21671 via org.jenkins-ci.main:jenkins-core (1.436)

org.jenkins-ci.main:jenkins-core MAVEN version 1.436 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.mtvi.plateng.hudson:ldapemail 0.8 - org.jenkins-ci.main:jenkins-test-harness 1.436 -...

USN-5376-3: Git regression | Cloud Foundry

Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description USN-5376-1 fixed vulnerabilities in Git, some patches were missing to properly fix the issue. This update fixes the problem. Original advisory details: 俞晨东 discovered that Git incorrectly handled certain...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.15.41 and fixes at least the following security issues: A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel BPF subsystem due to the way a user loads BTF. This flaw allows a...

flac:fuzzer_decoder: Use-of-uninitialized-value in frame_sync_

Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=4767463432126464 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzerdecoder Job Type: libfuzzermsanflac Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

SUSE-SU-2022:1730-1 Security update for libslirp

This update for libslirp fixes the following issues: - CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure bootp bsc1187364. - CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure udp bsc1187367. - CVE-2021-3595: Fixed invalid...

clamav:clamav_dbload_PDB_fuzzer: Heap-buffer-overflow in add_hash

Project: https://github.com/Cisco-Talos/clamav.git Detailed Report: https://oss-fuzz.com/testcase?key=6505791147868160 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavdbloadPDBfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

USN-5311-2 containerd regression

USN-5311-1 released updates for contained. Unfortunately, a subsequent update reverted the fix for this CVE by mistake. This update corrects the problem. We apologize for the inconvenience. Original advisory details: It was discovered that containerd allows attackers to gain access to read- only...

com.mtvi.plateng.hudson:ldapemail (0.8), org.jenkins-ci.main:jenkins-test-harness (1.436) +7 more potentially affected by CVE-2017-1000395 via org.jenkins-ci.main:jenkins-core (1.436)

org.jenkins-ci.main:jenkins-core MAVEN version 1.436 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.mtvi.plateng.hudson:ldapemail 0.8 - org.jenkins-ci.main:jenkins-test-harness 1.436 -...

Expected Behavior Violation in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in t...

GHSA-9HG2-395J-83RM Expected Behavior Violation in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in t...

OpenStack Nova DoS by rebuilding the same instance with a new image multiple times

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was...

OpenStack Nova Filter Scheduler Bypass

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters for example, the ImagePropertiesFilter or the IsolatedHostsFilter. All setups using Nova Filter...

GHSA-Q4Q2-93PW-QWGF Issuer validation regression in Spring Cloud SSO Connector

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

Issuer validation regression in Spring Cloud SSO Connector

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

com.mtvi.plateng.hudson:ldapemail (0.8), org.jenkins-ci.main:jenkins-test-harness (1.436) +7 more potentially affected by CVE-2018-1999002 via org.jenkins-ci.main:jenkins-core (1.436)

org.jenkins-ci.main:jenkins-core MAVEN version 1.436 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.mtvi.plateng.hudson:ldapemail 0.8 - org.jenkins-ci.main:jenkins-test-harness 1.436 -...