net-snmp/agentx_parse_fuzzer: Stack-buffer-overflow in agentx_parse_string

Project: git://git.code.sf.net/p/net-snmp/code Detailed report: https://oss-fuzz.com/testcase?key=5727267801006080 Project: net-snmp Fuzzer: libFuzzernet-snmpagentxparsefuzzer Fuzz target binary: agentxparsefuzzer Job Type: libfuzzerasannet-snmp Platform Id: linux Crash Type: Stack-buffer-overflo...

Debian DSA-4157-1 : openssl - security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-3738 David Benjamin of Google reported an overflow bug in the AVX2 Montgomery multiplication procedure used in...

Revert libxml2 behavior in Nokogiri gem that could cause XSS

MRI Behavior in libxml2 has been reverted which caused CVE-2018-8048 loofah gem, CVE-2018-3740 sanitize gem, and CVE-2018-3741 rails-html-sanitizer gem. The commit in question is here: https://github.com/GNOME/libxml2/commit/960f0e2 and more information is available about this commit and its impa...

librawspeed/Cr2DecompressorFuzzer: Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5174454507274240 Project: librawspeed Fuzzer: libFuzzerlibrawspeedCr2DecompressorFuzzer Fuzz target binary: Cr2DecompressorFuzzer Job Type: libfuzzermsanlibrawspeed Platform Id: linux Crash...

DLA-1324-1 libdatetime-timezone-perl - new upstream version

Bulletin has no description...

libreoffice/fodsfuzzer: Heap-use-after-free in ScXMLDatabaseRangeContext::endFastElement

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6030863839002624 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in jbig2_arith_decode

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5829721259507712 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

imagemagick/encoder_ptif_fuzzer: Crash in put1bitbwtile

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4777363809239040 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderptiffuzzer Fuzz target binary: encoderptiffuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

gdal/gdal_vector_translate_fuzzer: Heap-buffer-overflow in OGRPolygonLabelPoint

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6284277042905088 Project: gdal Fuzzer: aflgdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash...

imagemagick/ping_ptif_fuzzer: Use-of-uninitialized-value in ReadTIFFImage

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5660528941727744 Project: imagemagick Fuzzer: libFuzzerimagemagickpingptiffuzzer Fuzz target binary: pingptiffuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

graphicsmagick/enhance_fuzzer: Use-of-uninitialized-value in InsertRow

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6546207443779584 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickenhancefuzzer Fuzz target binary: enhancefuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

libreoffice/lwpfuzzer: Heap-use-after-free in rtl::OUString::getLength

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6697184394215424 Project: libreoffice Fuzzer: afllibreofficelwpfuzzer Fuzz target binary: lwpfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Cra...

systemd/fuzz-unit-file: Use-of-uninitialized-value in streq_ptr

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=5546208027213824 Project: systemd Fuzzer: libFuzzersystemdfuzz-unit-file Fuzz target binary: fuzz-unit-file Job Type: libfuzzermsansystemd Platform Id: linux Crash Type: Use-of-uninitialized-value...

graphicsmagick/coder_WBMP_fuzzer: Use-of-uninitialized-value in ReadWBMPImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=4905768575827968 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderWBMPfuzzer Fuzz target binary: coderWBMPfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

imagemagick/enhance_fuzzer: Use-of-uninitialized-value in LocaleNCompare

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4815946653892608 Project: imagemagick Fuzzer: libFuzzerimagemagickenhancefuzzer Fuzz target binary: enhancefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

CVE-2018-1000135

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure CWE-200 vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed,...

CVE-2018-1000135

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure CWE-200 vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed,...

UBUNTU-CVE-2018-1000135

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure CWE-200 vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed,...

CVE-2018-1000135

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure CWE-200 vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed,...

imagemagick/encoder_pict_fuzzer: Use-of-uninitialized-value in ScaleQuantumToChar

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=6572860567977984 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpictfuzzer Fuzz target binary: encoderpictfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...