in lavv17/lftp

✍️ Description Whilst testing lftp built from commit d67fc1 with Clang 13 +ASan on Ubuntu 20.04.2 LTS, we discovered a crafted file which triggers a null pointer dereference and segfault. 🕵️‍♂️ Proof of Concept echo "aiYgAQEBNA==" | base64 -d /tmp/file.fuzz && ./lftp -f /tmp/file.fuzz The above POC...

tidb:fuzzMarshalJSON: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5366779718270976 Project: tidb Fuzzing Engine: libFuzzer Fuzz Target: fuzzMarshalJSON Job Type: libfuzzerasantidb Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

SUSE-SU-2021:2007-1 Security update for caribou

This update for caribou fixes the following issues: Security issue fixed: - CVE-2021-3567: Fixed a segfault when attempting to use shifted characters bsc1186617...

Denial Of Service (DoS)

Rxvt is vulnerable to denial of service. An attacker is able to crash the application by passing the value -2^31 inside a terminal escape code which would result in a non-invertible integer that eventually leads to a segfault due to an out of bounds read...

SUSE: Security Advisory (SUSE-SU-2021:1943-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:1943-1 Security update for caribou

This update for caribou fixes the following issues: Security issue fixed: - CVE-2021-3567: Fixed a segfault when attempting to use shifted characters bsc1186617...

SUSE: Security Advisory (SUSE-SU-2020:1335-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:1892-1 Security update for libX11

This update for libX11 fixes the following issues: - Regression in the fix for CVE-2021-31535, causing segfaults for xforms applications like fdesign bsc1186643...

wolfssl:fuzzer-wolfssl-ocsp: Segv on unknown address in GetASNHeader_ex

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5641031927332864 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-ocsp Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Segv on unknown address Crash Address: Cras...

raptor2 security and bug fix update

2.0.15-16 - Resolves: rhbz1900904 CVE-2020-25713 raptor2: malformed input file can lead to a segfault 2.0.15-15 - Resolves: rhbz1896534 CVE-2017-18926 raptor: heap-based buffer overflow 2.0.15-14 - Resolves: rhbz1896340 Suppress documentation in Flatpak builds...

fio:fuzz_parseini: Segv on unknown address in add_file

Detailed Report: https://oss-fuzz.com/testcase?key=5887397356240896 Project: fio Fuzzing Engine: afl Fuzz Target: fuzzparseini Job Type: aflasanfio Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: addfile strfilenamecb handleoption Sanitizer: address ASAN Crash...

Segfault in `tf.raw_ops.SparseCountSparseOutput`

Impact Passing invalid arguments e.g., discovered via fuzzing to tf.rawops.SparseCountSparseOutput results in segfault. Patches We have patched the issue in GitHub commit 82e6203221865de4008445b13c69b6826d2b28d9. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on...

GHSA-WVJW-P9F5-VQ28 Segfault in `tf.raw_ops.SparseCountSparseOutput`

Impact Passing invalid arguments e.g., discovered via fuzzing to tf.rawops.SparseCountSparseOutput results in segfault. Patches We have patched the issue in GitHub commit 82e6203221865de4008445b13c69b6826d2b28d9. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on...

GHSA-4FG4-P75J-W5XJ Heap out of bounds in `QuantizedBatchNormWithGlobalNormalization`

Impact An attacker can cause a segfault and denial of service via accessing data outside of bounds in tf.rawops.QuantizedBatchNormWithGlobalNormalization: python import tensorflow as tf t = tf.constant1, shape=1, 1, 1, 1, dtype=tf.quint8 tmin = tf.constant, shape=0, dtype=tf.float32 tmax =...

GHSA-G4H2-GQM3-C9WQ Segfault in tf.raw_ops.ImmutableConst

Impact Calling tf.rawops.ImmutableConst with a dtype of tf.resource or tf.variant results in a segfault in the implementation as code assumes that the tensor contents are pure scalars. python import tensorflow as tf tf.rawops.ImmutableConstdtype=tf.resource, shape=, memoryregionname="/tmp/test.tx...

RHEL 8 : raptor2 (RHSA-2021:1842)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1842 advisory. Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples...

raptor2: malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common

A malformed input file can lead to a segfault due to an out of bounds array access in raptorxmlwriterstartelementcommon...

Moderate: raptor2 security and bug fix update

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fixes: raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer CVE-2017-18926 raptor2:...

ALSA-2021:1842 Moderate: raptor2 security and bug fix update

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fixes: raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer CVE-2017-18926 raptor2:...

raptor2 security and bug fix update

An update is available for raptor2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Raptor is the RDF Parser Toolkit for Redland that provides a set of standalon...