USN-4165-2 firefox regressions

USN-4165-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafte...

python-requests bug fix update

An update is available for python-requests. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The python-requests package contains a library designed to make HTTP...

python-requests bug fix update

The python-requests package contains a library designed to make HTTP requests easy for developers. Bug fix: The fix CVE-2018-18074 leads to a regression BZ1758261...

OPENSUSE-SU-2019:2438-1 Security update for python3

This update for python3 to 3.6.9 fixes the following issues: Security issues fixed: - CVE-2019-16056: Fixed a parser issue in the email module. bsc1149955 - CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py bsc1153238. Non-security issues fixed: - Fixed regression of OpenSSL...

USN-4171-3 apport regression

USN-4171-1 fixed vulnerabilities in Apport. The update caused a regression in the Python Apport library. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Kevin Backhouse discovered Apport would read its user-controlled settings file as the root user...

USN-4171-3: Apport regression

USN-4171-1 fixed vulnerabilities in Apport. The update caused a regression in the Python Apport library. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Kevin Backhouse discovered Apport would read its user-controlled settings file as the root user...

openh264:decoder_fuzzer: Heap-use-after-free in WelsDec::CWelsDecoder::SetOption

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5693903391162368 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzerasani386openh264 Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address:...

Information Disclosure

play-ws is vulnerable to information disclosure. The vulnerability exists through a regression caused by async-http-client that causes HTTP CONNECT requests set to an outbound HTTPS requests when using an authenticated proxy server...

qpdf:qpdf_fuzzer: Use-of-uninitialized-value in deflate_slow

Project: https://github.com/qpdf/qpdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5667600474570752 Project: qpdf Fuzzing Engine: libFuzzer Fuzz Target: qpdffuzzer Job Type: libfuzzermsanqpdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: deflatesl...

openh264:decoder_fuzzer: Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5169716859764736 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzermsanopenh264 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

openh264:decoder_fuzzer: Heap-use-after-free in WelsDec::SetUnRef

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5746521706594304 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzerasanopenh264 Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address:...

USN-4170-3: Whoopsie regression

USN-4170-1 fixed a vulnerability in Whoopsie and USN-4170-2 fixed a subsequent regression. That update was incomplete and could still result in Whoopsie potentially crashing when uploading crash reports on some architectures. This update fixes the problem. We apologize for the inconvenience...

USN-4170-3 whoopsie regression

USN-4170-1 fixed a vulnerability in Whoopsie and USN-4170-2 fixed a subsequent regression. That update was incomplete and could still result in Whoopsie potentially crashing when uploading crash reports on some architectures. This update fixes the problem. We apologize for the inconvenience...

Security update for python3 (moderate)

openSUSE Security Update: Security update for python3 Announcement ID: openSUSE-SU-2019:2438-1 Rating: moderate References: 1149121 1149792 1149955 1151490 1153238 Cross-References: CVE-2019-16056 CVE-2019-16935 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and h...

ffmpeg:ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer: Index-out-of-bounds in decodeplane8

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5651995784642560 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDIFFILBMfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

cryptofuzz:cryptofuzz-boringssl: Heap-buffer-overflow in DesSetKey

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5689068197511168 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

ffmpeg:ffmpeg_AV_CODEC_ID_AGM_fuzzer: Heap-buffer-overflow in decode_inter_plane

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5659333417500672 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAGMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

imagemagick:crop_fuzzer: Index-out-of-bounds in LibRaw::adobe_coeff

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5684491775639552 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: cropfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

flac:fuzzer_encoder: Crash in FLAC__bitwriter_write_raw_uint32_nocheck

Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=5697199728230400 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzerencoder Job Type: libfuzzerasani386flac Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0xb61fb820 Crash State:...

osquery:osqueryfuzz-sqlquery: Heap-buffer-overflow in sqlite3VdbeMemSetStr

Project: https://github.com/osquery/osquery.git Detailed Report: https://oss-fuzz.com/testcase?key=5657577178529792 Project: osquery Fuzzing Engine: libFuzzer Fuzz Target: osqueryfuzz-sqlquery Job Type: libfuzzerasanosquery Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...