wasm3:fuzzer: Crash in v_FindFunction

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=5932604363767808 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerubsanwasm3 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff7 Crash State:...

Advisory ROSA-SA-2021-1924

Software: mpfr 3.1.1 OS: Cobalt 7.9 CVE-ID: CVE-2014-9474 CVE-Crit: CRITICAL CVE-DESC: Buffer overflow in mpfrstrtofr function in GNU MPFR before 3.1.2-p11 allows context-sensitive attackers to have undefined impact via vectors associated with incorrect documentation for mpnsetstr. CVE-STATUS:...

Advisory ROSA-SA-2021-1880

Software: libnotify 0.7.7 OS: Cobalt 7.9 CVE-ID: CVE-2013-7381 CVE-Crit: CRITICAL CVE-DESC: libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands using undefined characters when libnotify.notify is called. CVE-STATUS: default CVE-REV: default...

CVE-2021-21671: Undefined Security Weakness

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login...

CVE-2021-35502: Undefined Security Weakness

app/View/Elements/genericElements/IndexTable/Fields/genericfield.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index...

Race condition

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox 88.0.1 and Firefox for Android 88.1.3...

CVE-2021-29952

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox 88.0.1 and Firefox for Android 88.1.3...

CVE-2021-29952

Summary: CVE-2021-29952 affects Mozilla Firefox and Firefox for Android. A race condition during the destruction of Web Render components could cause undefined behavior and, with sufficient effort, potentially be exploited to run arbitrary code. Affected versions: Firefox < 88.0.1 and Firefox ...

CVE-2021-29952

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox 88.0.1 and Firefox for Android 88.1.3...

Privilege escalation

In onReceive of NetInitiatedActivity.java, there is a possible way to supply an attacker-controlled value to a GPS HAL handler due to a missing permission check. This could lead to local escalation of privilege that may result in undefined behavior in some HAL implementations with no additional...

UBUNTU-CVE-2021-3608

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMAREGDSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The...

PT-2021-7332

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 6.1.0 Description The issue is related to a flaw in the QEMU implementation of VMWare's paravirtual RDMA device, which may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized...

Ubuntu 18.04 LTS / 20.04 LTS : ImageMagick vulnerabilities (USN-4988-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4988-1 advisory. It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were...

CVE-2021-0324: Undefined Security Weakness

Product: AndroidVersions: Android SoCAndroid ID: A-175402462...

CVE-2021-30641: Undefined Security Weakness

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'...

PUB-A-174151048

In onReceive of NetInitiatedActivity.java, there is a possible way to supply an attacker-controlled value to a GPS HAL handler due to a missing permission check. This could lead to local escalation of privilege that may result in undefined behavior in some HAL implementations with no additional...

PT-2021-28744

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.4 Description The issue is related to the btrfs file system in the Linux Kernel, specifically with the zoned mode. It involves a potential problem with input validation in the btrfs alloc chunk function,...

OESA-2021-1198 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

Google TensorFlow code issue vulnerability (CNVD-2021-48868)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A code issue vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which stems from tf.rawops.FusedBatchNorm demonstrating undefined behavior by dereferencing null pointers to...

wasm3:fuzzer: Index-out-of-bounds in Pop

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=6211848046247936 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerubsanwasm3 Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: Pop...