mupdf/pdf_fuzzer: Heap-use-after-free in fz_fin_cached_color_converter

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=4866555528609792 Project: mupdf Fuzzer: aflmupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: aflasanmupdf Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6060000005f8...

Threat Outbreak Alert RuleID31778: Email Messages Distributing Malicious Software on January 18, 2018

Medium Alert ID: 56494 First Published: 2018 January 18 18:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31778 may contain the following files: Name |...

Solaris 10 (x86) : 149176-13 (deprecated)

SunOS 5.10x86: qlc patch. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 149176 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12. Deprecated and...

imagemagick/encoder_psd_fuzzer: Use-of-uninitialized-value in ScaleQuantumToShort

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5941577940729856 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpsdfuzzer Fuzz target binary: encoderpsdfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

libreoffice/htmlfuzzer: Heap-use-after-free in HTMLAttr::GetNext

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5700230038159360 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

PyroBatchFTP Buffer Overflow

============================================= MGC ALERT 2018-001 - Original release date: December 22, 2017 - Last revised: January 12, 2018 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,5/10 CVSS Base Score ============================================= I. VULNERABILITY...

proj4/standard_fuzzer: Stack-use-after-return in forward_4d

Detailed report: https://oss-fuzz.com/testcase?key=5020564482686976 Project: proj4 Fuzzer: libFuzzerproj4standardfuzzer Fuzz target binary: standardfuzzer Job Type: libfuzzerasanproj4 Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address: 0x7fe98cc70c20 Crash State: forward4d...

OracleVM 3.4 : microcode_ctl (OVMSA-2018-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : - Enable early microcode load to allow updating Broadwell model 79 - Make sure 'modprobe microcode' is not executed on Broadwell model 79 - Run dracut upon microcode update - Update Intel CPU microde fo...

Threat Outbreak Alert RuleID31703: Email Messages Distributing Malicious Software on December 29, 2017

Medium Alert ID: 56337 First Published: 2018 January 2 14:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31703 may contain the following files: Name |...

Threat Outbreak Alert RuleID31680: Email Messages Distributing Malicious Software on December 25, 2017

Medium Alert ID: 56330 First Published: 2018 January 2 12:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31680 may contain the following files: Name |...

libreoffice/htmlfuzzer: Bad-cast to SwTable from invalid vptr in HTMLTable::MakeTable

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4587072460423168 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

Threat Outbreak Alert RuleID31600: Email Messages Distributing Malicious Software on December 20, 2017

Medium Alert ID: 56306 First Published: 2017 December 20 21:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31600 may contain the following files: Name |...

Phusion Passenger Arbitrary File Read Vulnerability

Phusion Passenger is an Apache module for deploying Ruby on Rails projects on Apache and Nginx web servers from Phusion Netherlands. A security vulnerability exists in the agent/Core/SpawningKit/Spawner.h file in Phusion Passenger version 5.1.10. The vulnerability can be exploited to read the...

boost/boost_regex_fuzzer: Bad-cast to boost::detail::sp_counted_baseboost::detail::shared_count::shared_count in boost::shared_ptr<boost::re_detail_NUMBER::named_subexpressions>::shared_ptr

Project: https://github.com/boostorg/boost.git Detailed report: https://oss-fuzz.com/testcase?key=6395263733202944 Project: boost Fuzzer: libFuzzerboostregexfuzzer Fuzz target binary: boostregexfuzzer Job Type: libfuzzerubsanboost Platform Id: linux Crash Type: Bad-cast Crash Address:...

UBUNTU-CVE-2017-16355

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10, if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root...

DEBIAN-CVE-2017-16355

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10, if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root...

Threat Outbreak Alert RuleID31624: Email Messages Distributing Malicious Software on December 14, 2017

Medium Alert ID: 56265 First Published: 2017 December 14 14:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31624 may contain the following files: Name |...

CVE-2017-16355: Exposure of Sensitive Information to an Unauthorized Actor

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10, if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root...

Fixed in Apache Tomcat 8.0.48

Low: Incorrectly documented CGI search algorithm CVE-2017-15706 As part of the fix for bug 61201, the description of the search algorithm used by the CGI Servlet to identify which script to execute was updated. The update was not correct. As a result, some scripts may have failed to execute as...

[SECURITY] Fedora 25 Update: git-2.9.5-3.fc25

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The git rpm installs common set of tools which are usually using with small amount of dependencies. To install all git packages,...