SUSE SLES15 Security Update : squid (SUSE-SU-2020:1769-1)

This update for squid fixes the following issues : squid was updated to version 4.12 Security issue fixed : CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed : Reverted to slow search for new SMP sh...

SUSE SLES12 Security Update : squid (SUSE-SU-2020:1770-1)

This update for squid fixes the following issues : squid was updated to version 4.12 Security issue fixed : CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed : Reverted to slow search for new SMP sh...

libraw:libraw_cr2_fuzzer: Use-of-uninitialized-value in LibRaw::init_fuji_block

Detailed Report: https://oss-fuzz.com/testcase?key=4762894621999104 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::initfujiblock...

binutils:fuzz_disassemble: Global-buffer-overflow in print_insn_arc

Detailed Report: https://oss-fuzz.com/testcase?key=6258025384640512 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisassemble Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000001427320 Crash State: printinsnarc...

opensc:fuzz_pkcs15_reader: Stack-use-after-scope in coolkey_apdu_io

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=6578720056541184 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerasanopensc Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address:...

GHSA-XQ5J-GW7F-JGJ8 CSRF Vulnerability in rails-ujs

There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ This is a regression of CVE-2015-1840. In the scenario where an attacker might be able to control the href attribute of an anchor tag...

CSRF Vulnerability in rails-ujs

There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ This is a regression of CVE-2015-1840. In the scenario where an attacker might be able to control the href attribute of an anchor tag...

systemd:fuzz-network-parser: Index-out-of-bounds in config_parse_ets_prio

Project: https://github.com/systemd/systemd.git Detailed Report: https://oss-fuzz.com/testcase?key=5756666201767936 Project: systemd Fuzzing Engine: libFuzzer Fuzz Target: fuzz-network-parser Job Type: libfuzzerubsansystemd Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

libreoffice:ww2fuzzer: Heap-buffer-overflow in rtl_uStringbuffer_newFromStr_WithLength

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4814047179177984 Project: libreoffice Fuzzing Engine: afl Fuzz Target: ww2fuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 14 Crash Address:...

leptonica:pageseg_fuzzer: Heap-buffer-overflow in rasteropGeneralLow

Detailed Report: https://oss-fuzz.com/testcase?key=6229214071357440 Project: leptonica Fuzzing Engine: afl Fuzz Target: pagesegfuzzer Job Type: aflasanleptonica Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x602000000478 Crash State: rasteropGeneralLow rasteropLow...

libspng:spng_read_fuzzer: Use-of-uninitialized-value in spng_read_fuzzer.c

Project: https://gitlab.com/randy408/libspng.git https://github.com/randy408/libspng.git Detailed Report: https://oss-fuzz.com/testcase?key=4859937025687552 Project: libspng Fuzzing Engine: libFuzzer Fuzz Target: spngreadfuzzer Job Type: libfuzzermsanlibspng Platform Id: linux Crash Type:...

cryptofuzz:cryptofuzz-nss: Heap-buffer-overflow in Hacl_Chacha20PolyNUMBER_256_aead_decrypt

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5091247321251840 Project: cryptofuzz Fuzzing Engine: afl Fuzz Target: cryptofuzz-nss Job Type: aflasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

arrow:arrow-ipc-stream-fuzz: Heap-buffer-overflow in arrow::Status arrow::ConcatenateOffsets<int>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6440533038989312 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-stream-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6190000009ac...

[SECURITY] [DSA 4714-2] chromium regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-4714-2 [email protected] https://www.debian.org/security/ Michael Gilbert July 04, 2020 https://www.debian.org/security/faq -...

leptonica:pageseg_fuzzer: Heap-buffer-overflow in rasteropGeneralLow

Detailed Report: https://oss-fuzz.com/testcase?key=4988284873998336 Project: leptonica Fuzzing Engine: afl Fuzz Target: pagesegfuzzer Job Type: aflasanleptonica Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x606000000418 Crash State: rasteropGeneralLow rasteropLow...

DSA-4714-2 chromium - regression update

Bulletin has no description...

matio:matio_fuzzer: Crash in H5T__bit_find

Detailed Report: https://oss-fuzz.com/testcase?key=5443759545516032 Project: matio Fuzzing Engine: afl Fuzz Target: matiofuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60200001003b Crash State: H5Tbitfind H5Tconvii H5Tconvert Sanitizer: address ASAN...

binutils:fuzz_readelf: Stack-buffer-overflow in print_dynamic_symbol

Detailed Report: https://oss-fuzz.com/testcase?key=5953247323095040 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzreadelf Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7f67ff9a3340 Crash State: printdynamicsymbol...

cascadia:fuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5653697917616128 Project: cascadia Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasancascadia Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000007e61 Crash State: NULL Sanitizer: address ASAN Recommended Securit...

libraw:libraw_cr2_fuzzer: Index-out-of-bounds in DHT::get_hv_rbg

Detailed Report: https://oss-fuzz.com/testcase?key=5647329419067392 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: DHT::gethvrbg DHT::makehvdline DHT::makehvdirs...