SUSE SLES12 Security Update : krb5-appl (SUSE-SU-2021:0527-1)

This update for krb5-appl fixes the following issues : CVE-2019-25017: Check the filenames sent by the server match those requested by the client bsc1131109. CVE-2019-25018: Disallow empty incoming filename or ones that refer to the current directory bsc1131109. Note that Tenable Network Security...

usrsctp:fuzzer_connect: Heap-use-after-free with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5430338945941504 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerconnect Job Type: libfuzzerasanusrsctp Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6110006b9450 Crash State: NULL Sanitizer: address ASA...

libsass:data_context_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6200038860652544 Project: libsass Fuzzing Engine: libFuzzer Fuzz Target: datacontextfuzzer Job Type: libfuzzermsanlibsass Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory...

gonids:fuzz_parserule: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6284410775273472 Project: gonids Fuzzing Engine: libFuzzer Fuzz Target: fuzzparserule Job Type: libfuzzerasangonids Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7f8c0d3d190e Crash State: NULL Sanitizer: address ASAN Recommended...

Code injection

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

CVE-2021-26720

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

CVE-2021-26720

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

CVE-2021-26720

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

CVE-2021-26720: Improper Link Resolution Before File Access

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

tidb:fuzzMarshalJSON: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6153259200937984 Project: tidb Fuzzing Engine: libFuzzer Fuzz Target: fuzzMarshalJSON Job Type: libfuzzerasantidb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00002212190b Crash State: NULL Sanitizer: address ASAN Recommended...

EulerOS 2.0 SP9 : bind (EulerOS-SA-2021-1261)

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In ISC BIND9 versions BIND 9.11.14 - 9.11.19, BIND 9.14.9 - 9.14.12, BIND 9.16.0 - 9.16.3, BIND Supported Preview Edition 9.11.14-S1 - 9.11.19-S1:...

sudoers:fuzz_sudoers: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4875913579855872 Project: sudoers Fuzzing Engine: libFuzzer Fuzz Target: fuzzsudoers Job Type: libfuzzerubsansudoers Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f8b720ace60 Crash State: NULL Sanitizer: undefined UBSAN Recommende...

OPENSUSE-SU-2021:0231-1 Security update for segv_handler

This update for segvhandler fixes the following issues: - Replace by empty package with README explaining the removal for security reasons boo1180665. This update was imported from the openSUSE:Leap:15.2:Update update project...

libsass:data_context_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6666177491369984 Project: libsass Fuzzing Engine: libFuzzer Fuzz Target: datacontextfuzzer Job Type: libfuzzermsanlibsass Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory...

fio:fuzz_parseini: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5523892754055168 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f7d7f41b0f0 Crash State: NULL Sanitizer: undefined UBSAN Recommended...

gdal:shape_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5631910711787520 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: shapefuzzer Job Type: libfuzzerasani386gdal Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00001000 Crash State: NULL Sanitizer: address ASAN Recommended Securit...

c-blosc2:decompress_frame_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6544529962434560 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzermsanc-blosc2 Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer:...

kubernetes:json_FuzzStrictDecode: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5068159449169920 Project: kubernetes Fuzzing Engine: libFuzzer Fuzz Target: jsonFuzzStrictDecode Job Type: libfuzzerasankubernetes Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00006004f63f Crash State: NULL Sanitizer: address ASAN...

grpc-go:fuzz_helloserver: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5930640874799104 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloserver Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000034150897 Crash State: NULL Sanitizer: address ASAN Recommende...

PT-2021-27590

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of "Use-of-uninitialized-value". The crash state includes functions such as evict, fz empty store, and fz drop store...