llvm:clang-fuzzer: Segv on unknown address in clang::Sema::getCurBlock

Detailed Report: https://oss-fuzz.com/testcase?key=5718959311814656 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: clang::Sema::getCurBlock...

llvm:clang-fuzzer: Segv on unknown address in clang::Parser::ParseCXXAmbiguousParenExpression

Detailed Report: https://oss-fuzz.com/testcase?key=5663724107202560 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: clang::Parser::ParseCXXAmbiguousParenExpression...

Apple Opens Its Invite-Only Bug Bounty Program to All Researchers

As promised by Apple in August this year, the company today finally opened its bug bounty program to all security researchers, offering monetary rewards to anyone for reporting vulnerabilities in the iOS, macOS, watchOS, tvOS, iPadOS, and iCloud to the company. Since its launch three years ago,...

DLA-2043-2 gdk-pixbuf - regression update

Bulletin has no description...

xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)

It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...

yara:dotnet_fuzzer: Heap-buffer-overflow in dotnet_parse_tilde_2

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5648866552840192 Project: yara Fuzzing Engine: afl Fuzz Target: dotnetfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x613000005e50 Crash Stat...

binutils:fuzz_bfd: Heap-buffer-overflow in xcoff64_slurp_armap

Detailed Report: https://oss-fuzz.com/testcase?key=5127251264012288 Project: binutils Fuzzing Engine: afl Fuzz Target: fuzzbfd Job Type: aflasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x6210002f7ce0 Crash State: xcoff64slurparmap xcoff64archivep...

envoy:header_map_impl_fuzz_test: Stack-use-after-scope in Envoy::TrieLookupTable<Envoy::Http::HeaderMapImpl::StaticLookupResponse

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5746385563680768 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: headermapimplfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Stack-use-after-scope READ 1 Crash Address:...

USN-4182-3: Intel Microcode regression | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-4182-1 provided updated Intel Processor Microcode. A regression was discovered that caused some Skylake processors to hang after a warm reboot. This update reverts the microcode for that specific...

skia:api_skdescriptor: Heap-buffer-overflow in sse2::hash_fn

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5667544392531968 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: apiskdescriptor Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

libarchive:libarchive_fuzzer: Heap-use-after-free in copy_string

Project: https://github.com/libarchive/libarchive.git Detailed Report: https://oss-fuzz.com/testcase?key=5655329908195328 Project: libarchive Fuzzing Engine: libFuzzer Fuzz Target: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash...

binutils:fuzz_disassemble: Global-buffer-overflow in print_insn_score16

Detailed Report: https://oss-fuzz.com/testcase?key=5695456994918400 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisassemble Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000001e6a4d0 Crash State: printinsnscore16...

icu:collator_rulebased_fuzzer: Use-of-uninitialized-value in isMatchAtCPBoundary

Project: https://github.com/unicode-org/icu.git Detailed Report: https://oss-fuzz.com/testcase?key=5638982021152768 Project: icu Fuzzing Engine: libFuzzer Fuzz Target: collatorrulebasedfuzzer Job Type: libfuzzermsanicu Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

ots:ots-fuzzer: Heap-buffer-overflow in LZ4_read16

Project: https://github.com/khaledhosny/ots.git Detailed Report: https://oss-fuzz.com/testcase?key=6229453185482752 Project: ots Fuzzing Engine: libFuzzer Fuzz Target: ots-fuzzer Job Type: libfuzzerasanots Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6180000007ce...

njs:njs_process_script_fuzzer: Segv on unknown address in njs_chb_join

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5669544941322240 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: njschbjoin...

libvips:jpegsave_file_fuzzer: Crash in vips_region_copy

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5758791811596288 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavefilefuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x7fa704521000 Crash...

[SECURITY] [DSA 4565-2] intel-microcode security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4565-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 13, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4565-2] intel-microcode security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4565-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 13, 2019 https://www.debian.org/security/faq -...

njs:njs_process_script_fuzzer: Use-of-uninitialized-value in njs_string_prototype_split

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5712452738351104 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

wireshark:fuzzshark_ip: Heap-buffer-overflow in tvb_memcpy

Project: https://code.wireshark.org/review/wireshark Detailed Report: https://oss-fuzz.com/testcase?key=5661536303710208 Project: wireshark Fuzzing Engine: afl Fuzz Target: fuzzsharkip Job Type: aflasanwireshark Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x6310001788...