skia/api_raster_n32_canvas: Use-of-uninitialized-value in SkTestTypeface::getPath

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5671307430068224 Project: skia Fuzzer: libFuzzerskiaapirastern32canvas Fuzz target binary: apirastern32canvas Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value...

openvswitch/ofctl_parse_target: Heap-buffer-overflow in learn_check

Project: https://github.com/openvswitch/ovs.git Detailed report: https://oss-fuzz.com/testcase?key=5640179956580352 Project: openvswitch Fuzzer: libFuzzeropenvswitchofctlparsetarget Fuzz target binary: ofctlparsetarget Job Type: libfuzzerasanopenvswitch Platform Id: linux Crash Type:...

[SECURITY] [DLA 1562-3] poppler regression update

Package : poppler Version : 0.26.5-2+deb8u7 CVE ID : CVE-2018-16646 Debian Bug : A second regression issue has been resolved in the poppler PDF rendering shared library this time introduced with version 0.26.5-2+deb8u6 see DLA 1562-2. CVE-2018-16646 In Poppler 0.68.0, the Parser::getObj function ...

skia/image_filter_deserialize: Heap-buffer-overflow in Convexicator::BySign

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5700664101961728 Project: skia Fuzzer: libFuzzerskiaimagefilterdeserialize Fuzz target binary: imagefilterdeserialize Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow...

dav1d/dav1d_fuzzer_mt: Use-of-uninitialized-value in iclip

Project: https://code.videolan.org/videolan/dav1d.git Detailed report: https://oss-fuzz.com/testcase?key=5746740678885376 Project: dav1d Fuzzer: libFuzzerdav1dfuzzermt Fuzz target binary: dav1dfuzzermt Job Type: libfuzzermsandav1d Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

imagemagick/encoder_wpg_fuzzer: Use-of-uninitialized-value in SetPixelViaPixelInfo

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5666208397918208 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderwpgfuzzer Fuzz target binary: encoderwpgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : poppler regression (USN-3837-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3837-2 advisory. USN-3837-1 fixed vulnerabilities in poppler. A regression was reported regarding the previous update. This update fixes the...

skia/image_decode: Use-of-uninitialized-value in sse2::blit_row_s32a_opaque

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5757448300789760 Project: skia Fuzzer: libFuzzerskiaimagedecode Fuzz target binary: imagedecode Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

USN-3837-2 poppler regression

USN-3837-1 fixed vulnerabilities in poppler. A regression was reported regarding the previous update. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use...

imagemagick/ping_mvg_fuzzer: Heap-buffer-overflow in CopyMagickString

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5763296301416448 Project: imagemagick Fuzzer: aflimagemagickpingmvgfuzzer Fuzz target binary: pingmvgfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow...

skia/api_mock_gpu_canvas: Heap-buffer-overflow in SkMatrix::setRSXform

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=6323754636935168 Project: skia Fuzzer: aflskiaapimockgpucanvas Fuzz target binary: apimockgpucanvas Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

skia/api_mock_gpu_canvas: Heap-use-after-free in SkGlyphRun::eachGlyphToGlyphRun

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5757635266084864 Project: skia Fuzzer: libFuzzerskiaapimockgpucanvas Fuzz target binary: apimockgpucanvas Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash...

skia/android_codec: Use-of-uninitialized-value in sse2::blit_row_s32a_opaque

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5690776718147584 Project: skia Fuzzer: libFuzzerskiaandroidcodec Fuzz target binary: androidcodec Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

USN-3831-2: Ghostscript regression

USN-3831-1 fixed vulnerabilities in Ghostscript. Ghostscript 9.26 introduced a regression when used with certain options. This update fixes the problem. Original advisory details: It was discovered that Ghostscript contained multiple security issues. If a user or automated system were tricked int...

USN-3831-2 ghostscript regression

USN-3831-1 fixed vulnerabilities in Ghostscript. Ghostscript 9.26 introduced a regression when used with certain options. This update fixes the problem. Original advisory details: It was discovered that Ghostscript contained multiple security issues. If a user or automated system were tricked int...

USN-3816-3: systemd regression | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-3816-1 fixed vulnerabilities in systemd. The fix for CVE-2018-6954 caused a regression in systemd-tmpfiles when running Ubuntu inside a container on some older kernels. This issue only affected Ubuntu...

skia/api_mock_gpu_canvas: Heap-buffer-overflow in make_fuzz_textblob

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5685340631728128 Project: skia Fuzzer: libFuzzerskiaapimockgpucanvas Fuzz target binary: apimockgpucanvas Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

yara/rules_fuzzer: Heap-use-after-free in yr_re_ast_split_at_chaining_point

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5732444007825408 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

harfbuzz/hb-shape-fuzzer: Use-of-uninitialized-value in CFF::Charset1_2<OT::IntType<unsigned char, 1u> >::get_glyph

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5632586529898496 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type:...

UBUNTU-CVE-2018-19854

An issue was discovered in the Linux kernel before 4.19.3. cryptoreportone and related functions in crypto/cryptouser.c the crypto user configuration API do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a...