pcre2:pcre2_fuzzer_4l: Use-of-uninitialized-value in do_search_mark

Project: svn://vcs.exim.org/pcre2/code/trunk https://github.com/PCRE2Project/pcre2.git Detailed Report: https://oss-fuzz.com/testcase?key=5980008000585728 Project: pcre2 Fuzzing Engine: libFuzzer Fuzz Target: pcre2fuzzer4l Job Type: libfuzzermsanpcre2 Platform Id: linux Crash Type:...

CVE-2023-52461

In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drmschedentityinit--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the...

pcre2:pcre2_fuzzer: Use-of-uninitialized-value in fast_forward_first_n_chars

Project: svn://vcs.exim.org/pcre2/code/trunk https://github.com/PCRE2Project/pcre2.git Detailed Report: https://oss-fuzz.com/testcase?key=4593633133133824 Project: pcre2 Fuzzing Engine: libFuzzer Fuzz Target: pcre2fuzzer Job Type: libfuzzermsanpcre2 Platform Id: linux Crash Type:...

org.postgresql:postgresql vulnerable to SQL Injection via line comment generation

Impact SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default query mode. Users that do not overri...

GHSA-6VQW-3V5J-54X4 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

If pkcs12.serializekeyandcertificates is called with both: 1. A certificate whose public key did not match the provided private key 2. An encryptionalgorithm with hmachash set via PrivateFormat.PKCS12.encryptionbuilder.hmachash... Then a NULL pointer dereference would occur, crashing the Python...

UBUNTU-CVE-2024-26130

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if pkcs12.serializekeyandcertificates is called with both a certificate whose public key did not match the provided private key and an...

Missing Encryption

github.com/cilium/cilium is vulnerable to Missing Encryption between pods. The vulnerability is caused when external key-value store kvstore and Wireguard transparent encryption are enabled. If an attacker has access to the underlying cluster they can intercept sensitive traffic between pods,...

CVE-2024-1631 agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using...

CVE-2024-1631 agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using...

CVE-2023-52153

A SQL Injection vulnerability in /pmb/opaccss/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQL commands via the PmbOpac-LOGIN cookie value...

libavif:[email protected]: Use-of-uninitialized-value in SharpYuvGammaToLinear

Project: https://github.com/AOMediaCodec/libavif.git Detailed Report: https://oss-fuzz.com/testcase?key=6443913265086464 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: [email protected] Job Type: libfuzzermsanlibavif Platform Id: linux Crash Type:...

libavif:[email protected]: Use-of-uninitialized-value in avifImageRGBToYUV

Project: https://github.com/AOMediaCodec/libavif.git Detailed Report: https://oss-fuzz.com/testcase?key=5160955631697920 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: [email protected] Job Type: libfuzzermsanlibavif Platform Id: linux Crash Type:...

libavif:[email protected]: Use-of-uninitialized-value in avifImageRGBToYUV

Project: https://github.com/AOMediaCodec/libavif.git Detailed Report: https://oss-fuzz.com/testcase?key=4927644015591424 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: [email protected] Job Type: libfuzzermsanlibavif Platform Id: linux Crash Type:...

libavif:[email protected]: Use-of-uninitialized-value in avif::testutil::ComparePartialYuva

Project: https://github.com/AOMediaCodec/libavif.git Detailed Report: https://oss-fuzz.com/testcase?key=4680467104202752 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: [email protected] Job Type: libfuzzermsanlibavif Platform Id: linux Crash Type:...

CVE-2024-24794

A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable...

CVE-2024-24794: Use After Free

A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable...

CVE-2024-1633 FIP Header Integer Overflow

During the secure boot, bl2 the second stage of the bootloader loops over images defined in the table “bl2memparamsdescs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integ...

wolfssl:cryptofuzz-normal-math: Use-of-uninitialized-value in sp_radix_size

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6599903289606144 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-normal-math Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

wolfssl:cryptofuzz-heapmath: Use-of-uninitialized-value in mp_read_unsigned_bin

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4515959823990784 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-heapmath Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

PT-2024-7724 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the netlink component of the Linux kernel, where the validation code reads past a malformed attribute due to a missing size in the minlen array for NLA BE32. Th...