[SECURITY] Fedora 39 Update: redis-7.2.2-1.fc39

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

imagemagick:enhance_fuzzer: Use-of-uninitialized-value in LibRaw::getbithuff

Detailed Report: https://oss-fuzz.com/testcase?key=6043691271454720 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: enhancefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::getbithuff...

mupdf:pdf_fuzzer: Use-of-uninitialized-value in fz_drop_archive

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=4825341402939392 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2023-39050

An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

flac:fuzzer_tool_flac: Use-of-uninitialized-value in write_callback

Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=6109218488582144 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzertoolflac Job Type: libfuzzermsanflac Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Line Security Breach

Line is an instant messaging platform from Line Inc. A security vulnerability exists in Line, which stems from a vulnerability in Daily-value.Fukueten exists. An attacker can exploit the vulnerability to obtain a channel access token to send a crafted message...

Explaining the Business Value of Qualys Enterprise TruRisk Platform to Your Leadership

New IDC White Paper Reports Findings by Qualys Customers As a cybersecurity leader, you may struggle to help your C-suite see the business value of what your team does. Forget “speeds and feeds”; key decision-makers are solely focused on The Numbers. While reports from most security tools excel a...

Security Bulletin: IBM Financial Transaction Manager v3.2.x is vulnerable to XML External Entity Injection (XXE)

Summary An XML External Entity Injection XXE vulnerability in Java based XML parsers within IBM Financial Transaction Manager was addressed. Vulnerability Details CVEID:CVE-2023-35892 DESCRIPTION: IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity...

SUSE CVE-2019-10747

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads...

Default configuration

In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Tokens having Fee-On-Transfer are not considered which will make the protocol in retaining less value than expected.

Lines of code Vulnerability details Impact The balance of the custodian Addresses will be smaller than what is expected, making the protocol fail to maintain the delta neutral position. Proof of Concept The function EthenaMinting.sol/transferCollateral is sending the tokens using safeTransferFrom...

CVE-2023-21397: Improper Privilege Management

In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in void transform_idct_add<unsigned char>

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5220040284438528 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

flac:fuzzer_encoder_v2: Use-of-uninitialized-value in process_subframes_

Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=5684419798892544 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzerencoderv2 Job Type: libfuzzermsanflac Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Fedora: Security Advisory for redis (FEDORA-2023-77ed1e26a4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for redis (FEDORA-2023-8a9087f089)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace

Detailed Report: https://oss-fuzz.com/testcase?key=5483015947812864 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: OpYCbCrtoRGB::convertcolorspac...

[SECURITY] Fedora 37 Update: redis-7.0.14-1.fc37

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Denial of Service Vulnerability in Damon's New Cloud Cache Database (CNVD-2023-94386)

Damon New Cloud Cache Database DMCDM is a self-developed Key-Value database that is deeply compatible with native Redis. A denial of service vulnerability exists in DMCDM, which can be exploited by attackers to cause a denial of service...

Denial of Service Vulnerability in Damon's New Cloud Cache Database

Damon New Cloud Cache Database is a self-developed Key-Value database that is deeply compatible with native Redis. A denial of service vulnerability exists in Damon New Cloud Cache Database, which can be exploited by attackers to cause a program crash...