OPENSUSE-SU-2020:1042-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Mozilla Firefox 78.0.2 MFSA 2020-28 bsc1173948 MFSA-2020-0003 bmo1644076 X-Frame-Options bypass using object or embed tags - Firefox Extended Support Release 78.0.2esr ESR Fixed: Security fix Fixed: Fixed an accessibility regression in...

Security update for MozillaFirefox (moderate)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2020:1042-1 Rating: moderate References: 1173948 Affected Products: openSUSE Leap 15.1 An update that contains security fixes can now be installed. Description: This update for MozillaFirefox fixes the...

libyal:libfwnt_lzx_fuzzer: Use-of-uninitialized-value in libfwnt_huffman_tree_build

Detailed Report: https://oss-fuzz.com/testcase?key=5700197540429824 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libfwntlzxfuzzer Job Type: libfuzzermsanlibyal Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: libfwnthuffmantreebuild...

libyal:libfwnt_security_descriptor_fuzzer: Heap-buffer-overflow in libfwnt_access_control_entry_copy_from_byte_stream

Detailed Report: https://oss-fuzz.com/testcase?key=6301962723917824 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libfwntsecuritydescriptorfuzzer Job Type: libfuzzerasani386libyal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0xf5100b13 Crash State:...

libyal:libolecf_file_fuzzer: Use-of-uninitialized-value in libolecf_io_handle_read_directory_entries

Detailed Report: https://oss-fuzz.com/testcase?key=5080423911391232 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libolecffilefuzzer Job Type: libfuzzermsanlibyal Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: libolecfiohandlereaddirectoryentries...

Fedora 31 : php-horde-kronolith (2020-0fbd043bcf)

kronolith 4.2.29 - mjr Fix regresssion in event modification notifications Bug 15022. ---- kronolith 4.2.28 - mjr SECURITY: Don't leak private details when sending notifications for private events Bug 15011. - mjr Fix regression in display of clickable event URL property Bug 14941. Note that...

libvips:smartcrop_fuzzer: Segv on unknown address in vips_XYZ2Lab_line

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=4829562723368960 Project: libvips Fuzzing Engine: honggfuzz Fuzz Target: smartcropfuzzer Job Type: honggfuzzasanlibvips Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:1958-1)

This update for MozillaFirefox fixes the following issues : Mozilla Firefox 78.0.2 MFSA 2020-28 bsc1173948 - MFSA-2020-0003 bmo1644076 X-Frame-Options bypass using object or embed tags Firefox Extended Support Release 78.0.2esr ESR - Fixed: Security fix - Fixed: Fixed an accessibility regression ...

immer:flex-vector-gc: Crash in decltype

Project: https://github.com/arximboldi/immer.git Detailed Report: https://oss-fuzz.com/testcase?key=6017886557306880 Project: immer Fuzzing Engine: libFuzzer Fuzz Target: flex-vector-gc Job Type: libfuzzerasanimmer Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00018055f9f9 Crash...

SUSE-SU-2020:1958-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Mozilla Firefox 78.0.2 MFSA 2020-28 bsc1173948 MFSA-2020-0003 bmo1644076 X-Frame-Options bypass using object or embed tags - Firefox Extended Support Release 78.0.2esr ESR Fixed: Security fix Fixed: Fixed an accessibility regression in...

openSUSE Security Update : squid (openSUSE-2020-910)

This update for squid fixes the following issues : squid was updated to version 4.12 Security issue fixed : - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed : - Reverted to slow search for new SM...

openSUSE Security Update : squid (openSUSE-2020-914)

This update for squid fixes the following issues : squid was updated to version 4.12 Security issue fixed : - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed : - Reverted to slow search for new SM...

skia:image_filter_deserialize: Heap-buffer-overflow in SkVertices::Builder::init

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5443473612996608 Project: skia Fuzzing Engine: afl Fuzz Target: imagefilterdeserialize Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 9 Crash Address: 0x60e0000001c0...

php:php-fuzz-parser: Crash in _fini

Detailed Report: https://oss-fuzz.com/testcase?key=5630056790228992 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-parser Job Type: honggfuzzasanphp Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000012fabd4 Crash State: fini Sanitizer: address ASAN Recommended...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in asepcos_parse_sec_attr

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5734055866531840 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

leptonica:dewarp_fuzzer: Heap-buffer-overflow in rasteropGeneralLow

Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=5696549393530880 Project: leptonica Fuzzing Engine: afl Fuzz Target: dewarpfuzzer Job Type: aflasanleptonica Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

c-blosc2:decompress_fuzzer: Heap-use-after-free in ZSTD_DDict_dictContent

Detailed Report: https://oss-fuzz.com/testcase?key=6101295449767936 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressfuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x62b00000e208 Crash State: ZSTDDDictdictContent...

libreoffice:ww8fuzzer: Index-out-of-bounds in WW8ListManager::ReadLVL

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5733197544161280 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: ww8fuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

Debian DLA-2278-3 : squid3 regression update

The update of squid3 released as DLA-2278-2 introduced a regression due to the updated fix for CVE-2019-12529. The new Kerberos authentication code prevented base64 token negotiation. Updated squid3 packages are now available to correct this issue. For Debian 9 stretch, this problem has been fixe...

CVE-2020-14300

The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 https://access.redhat.com/errata/RHBA-2020:0053 included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in...