PT-2021-5823

Name of the Vulnerable Software and Affected Versions GNOME GLib versions prior to 2.66.8 Description An issue was discovered in GNOME GLib when the g file replace function is used with G FILE CREATE REPLACE DESTINATION to replace a path that is a dangling symlink. It incorrectly creates the targ...

grpc-gateway:fuzz: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5840342097199104 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

golang-protobuf:wirefuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6104386922217472 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c0000bc688 Crash State: NULL Sanitizer: address ASAN...

gcloud-go:fuzz_parse_query: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5145458130419712 Project: gcloud-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzparsequery Job Type: libfuzzerasangcloud-go Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f69b5cc8000 Crash State: NULL Sanitizer: address ASAN...

DEBIAN-CVE-2020-36254

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685...

ALPINE-CVE-2020-36254

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685...

UBUNTU-CVE-2020-36254

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685...

CVE-2020-36254

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685...

PT-2021-11987 · Dropbear +1 · Dropbear +1

Name of the Vulnerable Software and Affected Versions: Dropbear versions prior to 2020.79 Description: The issue is related to the handling of filenames in scp.c, specifically with . or an empty filename. This is a related issue to a previously known problem. Recommendations: For versions prior t...

Veeam Service Provider Console Plugin for ConnectWise Automate opens empty configuration in ConnectWise Automate Control Center

Challenge After successfully installing the Veeam Service Provider Console Plugin for ConnectWise Automate, the Integration tab for Veeam Service Provider Console displays no data. Cause Lack of permissions for account used to log in to ConnectWise Automate and coexistence of 2 plugins: Veeam...

Perth Dropbear Security Vulnerability

Perth Dropbear is a lightweight SSH server/client software from the University of Perth, Australia that is primarily used in embedded devices. A security vulnerability exists in Dropbear before 2020.79 that stems from incorrectly processed filenames, or empty filenames...

libpsl:libpsl_idn2_load_dafsa_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6059007069519872 Project: libpsl Fuzzing Engine: afl Fuzz Target: libpslidn2loaddafsafuzzer Job Type: aflasanlibpsl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60b00001a280 Crash State: NULL Sanitizer: address ASAN Recommended...

wolfmqtt:wolfmqtt-fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5639837786963968 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzerasanwolfmqtt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fa30000000c Crash State: NULL Sanitizer: address ASAN...

SUSE SLES12 Security Update : krb5-appl (SUSE-SU-2021:0527-1)

This update for krb5-appl fixes the following issues : CVE-2019-25017: Check the filenames sent by the server match those requested by the client bsc1131109. CVE-2019-25018: Disallow empty incoming filename or ones that refer to the current directory bsc1131109. Note that Tenable Network Security...

usrsctp:fuzzer_connect: Heap-use-after-free with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5430338945941504 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerconnect Job Type: libfuzzerasanusrsctp Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6110006b9450 Crash State: NULL Sanitizer: address ASA...

libsass:data_context_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6200038860652544 Project: libsass Fuzzing Engine: libFuzzer Fuzz Target: datacontextfuzzer Job Type: libfuzzermsanlibsass Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory...

gonids:fuzz_parserule: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6284410775273472 Project: gonids Fuzzing Engine: libFuzzer Fuzz Target: fuzzparserule Job Type: libfuzzerasangonids Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7f8c0d3d190e Crash State: NULL Sanitizer: address ASAN Recommended...

Code injection

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

CVE-2021-26720

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...

CVE-2021-26720

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects th...