OPENSUSE-SU-2017:2978-1 Security update for ansible

This update for ansible to version 2.4.1.0 fixes the following vulnerabilities: - CVE-2017-7481: Security issue with lookup return not tainting the jinja2 environment bsc1038785 - CVE-2016-9587: host to controller command execution vulnerability bsc1019021 - CVE-2016-8628: Command injection by...

OPENSUSE-SU-2017:2984-1 Security update for redis

This update for redis to version 4.0.2 fixes the following issues: - CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability boo1002351 The following upstream changes are included: - SLOWLOG now logs the offending client name and address - The modules native data types R...

jsc: Heap-buffer-overflow in JSC::WeakSet::vm

Detailed report: https://oss-fuzz.com/testcase?key=6450936961564672 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6230000038f8 Crash State: JSC::WeakSet::vm JSC::JSCell::structure JSC::JSValue::dumpInContext Sanitizer:...

gdal/gtiff_fuzzer: Crash in TIFFFillTile

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6518095486124032 Project: gdal Fuzzer: libFuzzergdalgtifffuzzer Fuzz target binary: gtifffuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7ff53c4aaa40 Cras...

libreoffice/scrtffuzzer: Index-out-of-bounds in ScCompiler::IsReference

Detailed report: https://oss-fuzz.com/testcase?key=4565444439572480 Project: libreoffice Fuzzer: libFuzzerlibreofficescrtffuzzer Fuzz target binary: scrtffuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: ScCompiler::IsReferen...

yara/rules_fuzzer: Use-of-uninitialized-value in _yr_atoms_choose

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5753694386651136 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

gdal/cad_fuzzer: Stack-use-after-return in void SwapEndianness<long&, unsigned long>

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5152401112694784 Project: gdal Fuzzer: libFuzzergdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Stack-use-after-return READ 1 Crash Address:...

yara/rules_fuzzer: Heap-double-free in yara_yyparse

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=6474914958671872 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-double-free Crash Address:...

[ASA-201711-15] lib32-openssl: multiple issues

Arch Linux Security Advisory ASA-201711-15 ========================================== Severity: Medium Date : 2017-11-08 CVE-ID : CVE-2017-3735 CVE-2017-3736 Package : lib32-openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-478 Summary ======= The package...

chakra: Dynamic-stack-buffer-overflow in Js::JavascriptArray::NewInstance

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=6106023170408448 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: Dynamic-stack-buffer-overflow READ 8 Crash Address: 0x7ffd13bb0260 Crash State:...

open62541/fuzz_binary_message: Heap-use-after-free in UA_Subscription_answerPublishRequestsNoSubscription

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5179189410922496 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type:...

libreoffice/pngfuzzer: Container-overflow in BitmapColor::GetBlue

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5533260961546240 Project: libreoffice Fuzzer: libFuzzerlibreofficepngfuzzer Fuzz target binary: pngfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Container-overflow...

MGASA-2017-0401 Updated x11-server packages fix security vulnerabilities & bugs

The upstream 1.19.4 update we pushed as: http://advisories.mageia.org/MGASA-2017-0366.html introduced a regression in PRIME syncronization. Upstream released a 1.19.5 that fixes that and a lot of security fixes: CVE-2017-12176 to CVE-2017-12187 Also added a fix for "XShmGetImage: fix censoring"...

Debian DSA-4018-1 : openssl - security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-3735 It was discovered that OpenSSL is prone to a one-byte buffer overread while parsing a malformed...

Android Security Bulletin—November 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2017-11-06 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners were...

gdal/gdal_translate_fuzzer: Global-buffer-overflow in GDALResampleChunk32R_Gauss

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4894972097593344 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Fuzz target binary: gdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash...

CVE-2017-16516

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service...

gstreamer/gst-discoverer: Heap-buffer-overflow in webvtt_type_find

Project: https://anongit.freedesktop.org/git/gstreamer/gstreamer Detailed report: https://oss-fuzz.com/testcase?key=6349101273710592 Project: gstreamer Fuzzer: libFuzzergstreamergst-discoverer Fuzz target binary: gst-discoverer Job Type: libfuzzerasangstreamer Platform Id: linux Crash Type:...

tor/oss-fuzz-vrs: Use-of-uninitialized-value in tor_vsscanf

Project: https://git.torproject.org/tor.git Detailed report: https://oss-fuzz.com/testcase?key=5851887808020480 Project: tor Fuzzer: libFuzzertoross-fuzz-vrs Fuzz target binary: oss-fuzz-vrs Job Type: libfuzzermsantor Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

gstreamer/gst-discoverer: Stack-buffer-overflow in vorbis_handle_identification_packet

Project: https://anongit.freedesktop.org/git/gstreamer/gstreamer Detailed report: https://oss-fuzz.com/testcase?key=6419900319924224 Project: gstreamer Fuzzer: libFuzzergstreamergst-discoverer Fuzz target binary: gst-discoverer Job Type: libfuzzerasangstreamer Platform Id: linux Crash Type:...