PT-2021-28073

Name of the Vulnerable Software and Affected Versions HDF5 affected versions not specified Description A heap buffer overflow read issue has been identified. The crash state indicates the involvement of functions such as H5MM memcpy, H5VM memcpyvv, and H5D compact readvv. No information is...

CVE-2021-26843

An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the dedotdot function may cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy. This can triggered with an HTTP GET request for a crafted...

PT-2021-17159

Name of the Vulnerable Software and Affected Versions: sthttpd versions prior to 2.27.1 Description: An issue in the de dotdot function can cause a Denial-of-Service daemon crash due to overlapping memory ranges being passed to memcpy when the strcpy function is implemented with memcpy. This can ...

OSV-2021-274 Memcpy-param-overlap in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30253 Crash type: Memcpy-param-overlap Crash state: framegetmetalayers blosc2frametoschunk fuzzdecompressframe.c...

PT-2021-28047

Name of the Vulnerable Software and Affected Versions HDF5 affected versions not specified Description A heap buffer overflow read issue has been identified. The crash state indicates involvement of functions such as H5MM memcpy, H5VM memcpyvv, and H5D compact readvv. No information is available...

PT-2021-28045

Name of the Vulnerable Software and Affected Versions blosc versions affected versions not specified Description The issue is related to a crash caused by a memcpy parameter overlap. Technical details include the crash type being Memcpy-param-overlap, and the crash state involves functions such a...

glibc security and bug fix update

2.17-322.0.2 - merge RH el7 u9 errata patches with Oracle patches Review-exception: Simple merge - merge RH el7 u9 patches with Oracle patches Review-exception: Simple merge - Four patches to match 3rd patch bundle from Marvell - modify MIPS values in elf/elf.h - add sysdeps/aarch64/sys/ifunc.h -...

c-blosc2:decompress_frame_fuzzer: Memcpy-param-overlap in frame_get_metalayers

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=4538322313674752 Project: c-blosc2 Fuzzing Engine: afl Fuzz Target: decompressframefuzzer Job Type: aflasanc-blosc2 Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...

CVE-2020-25855

The function AESUnWRAP in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 up to and excluding 2.08 does not validate the size parameter for a memcpy operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An...

OSV-2021-246 Memcpy-param-overlap in frame_get_usermeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29973 Crash type: Memcpy-param-overlap Crash state: framegetusermeta blosc2frametoschunk blosc2schunkopensframe...

PT-2021-28031

Name of the Vulnerable Software and Affected Versions blosc2 affected versions not specified Description The issue is related to a crash type known as Memcpy-param-overlap. Technical details about the crash state include the involvement of specific functions: frame get usermeta, blosc2 frame to...

c-blosc2:decompress_frame_fuzzer: Memcpy-param-overlap in frame_get_usermeta

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5035219092635648 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...

WS-2021-0189

c-blosc2 in versions v2.0.0-beta.1 to v2.0.0-beta.4 is vulnerable to Memcpy-param-overlap in framegetusermeta, related to blosc/frame.c...

openSUSE Security Update : gcc7 (openSUSE-2020-2301)

This update for gcc7 fixes the following issues : - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instruction...

openSUSE Security Update : gcc7 (openSUSE-2020-2300)

This update for gcc7 fixes the following issues : - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instruction...

Updated glibc packages fix security vulnerability

Security fixes: - fix buffer overrun in EUC-KR conversion module bz 2497 CVE-2019-25013 - arm: CVE-2020-6096: Fix multiarch memcpy for negative length BZ 25620 - arm: CVE-2020-6096: fix memcpy and memmove for negative length BZ 25620 - iconv: Fix incorrect UCS4 inner loop bounds BZ 26923...

MGASA-2021-0053 Updated glibc packages fix security vulnerability

Security fixes: - fix buffer overrun in EUC-KR conversion module bz 2497 CVE-2019-25013 - arm: CVE-2020-6096: Fix multiarch memcpy for negative length BZ 25620 - arm: CVE-2020-6096: fix memcpy and memmove for negative length BZ 25620 - iconv: Fix incorrect UCS4 inner loop bounds BZ 26923...

CVE-2020-25687

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory...

Arbitrary Code Execution

dnsmasq is vulnerable to arbitrary code execution. A heap-based buffer overflow in rfc1035.c:extractname due to the lack of length checks, which could be abused occurs when DNSSEC is enabled and before the receiving DNS entries are validated. A remote attacker who can create valid DNS replies is...

CVE-2020-25687

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory...