Fedora 31 : mosquitto (2019-4c69fb4cd7)

1.6.7 ===== Broker : - Add workaround for working with libwebsockets 3.2.0. - Fix potential crash when reloading config. Client library : - Don't use / in autogenerated client ids, to avoid confusing with topics. - Fix mosquittomaxinflightmessagesset and mosquittointoption..., MOSQOPTMAX,...

imagemagick:ping_mvg_fuzzer: Use-of-uninitialized-value in FindNeedleInHaystack

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5653360948019200 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: pingmvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

usrsctp:fuzzer_connect: Use-of-uninitialized-value in sctp_find_ifa_by_addr

Project: https://github.com/weinrank/usrsctp.git https://github.com/sctplab/usrsctp.git Detailed Report: https://oss-fuzz.com/testcase?key=5649242005176320 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerconnect Job Type: libfuzzermsanusrsctp Platform Id: linux Crash Type:...

ffmpeg:ffmpeg_AV_CODEC_ID_HCOM_fuzzer: Crash in hcom_decode

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5647235349479424 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHCOMfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000002f45db8...

imagemagick:ping_jpg_fuzzer: Use-of-uninitialized-value in LocaleNCompare

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5651751306264576 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: pingjpgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

php:php-fuzz-mbstring: Heap-buffer-overflow in match_at

Detailed Report: https://oss-fuzz.com/testcase?key=5192679935180800 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-mbstring Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60200000e6b7 Crash State: matchat searchinrange onigsearchwithparam...

freetype2:cidtype1: Heap-double-free in woff2_open_font

Detailed Report: https://oss-fuzz.com/testcase?key=5698158495006720 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: cidtype1 Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x624000002100 Crash State: woff2openfont sfntopenfont sfntinitfac...

php:php-fuzz-parser: Crash in zend_compile_array

Detailed Report: https://oss-fuzz.com/testcase?key=5697413519507456 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-parser Job Type: libfuzzerasanphp Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x61f000000a74 Crash State: zendcompilearray zendcompileassign...

curl:curl_fuzzer_http: Heap-use-after-free in seturl

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5168359280214016 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerhttp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x60300002cfbb Cra...

SUSE-SU-2019:2502-1 Security update for bind

This update for bind fixes the following issues: Security issues fixed: - CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones bsc1126069. - CVE-2019-6471: Fixed a reachable assert in dispatch.c. bsc1138687 - CVE-2018-5745: Fixe...

[SECURITY] [DLA 1900-2] apache2 regression update

Package : apache2 Version : 2.4.10-10+deb8u16 CVE ID : CVE-2019-10092 Debian Bug : 941202 The update of apache2 released as DLA-1900-1 contained an incomplete fix for CVE-2019-10092, a limited cross-site scripting issue affecting the modproxy error page. The old patch rather introduced a new CSRF...

USN-4115-2: Linux kernel regression | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update, a regression was introduced that caused a kernel crash when...

ffmpeg:ffmpeg_AV_CODEC_ID_HCOM_fuzzer: Heap-buffer-overflow in hcom_decode

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5634188581011456 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDHCOMfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x60c000000f1...

freetype2:type1: Crash in woff2_open_font

Detailed Report: https://oss-fuzz.com/testcase?key=5633873572003840 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: type1 Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00009fff8000 Crash State: woff2openfont sfntopenfont sfntinitface...

imagemagick:ping_mvg_fuzzer: Use-of-uninitialized-value in TraceArcPath

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5718991703638016 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: pingmvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

DLA-1900-2 apache2 - regression update

Bulletin has no description...

usrsctp:fuzzer_connect: Use-of-uninitialized-value in sctp_sha1_process_a_block

Project: https://github.com/weinrank/usrsctp.git https://github.com/sctplab/usrsctp.git Detailed Report: https://oss-fuzz.com/testcase?key=5645105154752512 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerconnect Job Type: libfuzzermsanusrsctp Platform Id: linux Crash Type:...

usrsctp:fuzzer_connect: Use-of-uninitialized-value in sctp_handle_asconf

Project: https://github.com/weinrank/usrsctp.git https://github.com/sctplab/usrsctp.git Detailed Report: https://oss-fuzz.com/testcase?key=5741506257747968 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerconnect Job Type: libfuzzermsanusrsctp Platform Id: linux Crash Type:...

kimageformats:kimgio_xcf_fuzzer: Use-of-uninitialized-value in comp_func_SourceOver_rgb64_avx2

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=5094974739185664 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioxcffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

openSUSE Security Update : nmap (openSUSE-2019-2200)

This update for nmap fixes the following issues : Security issue fixed : - CVE-2017-18594: Fixed a denial of service condition due to a double free when an SSH connection fails. bsc1148742 Non-security issue fixed : - Fixed a regression in the version scanner caused, by the fix for CVE-2018-15173...