The Bluetooth subsystem in QEMU mishandles negative values for length variables leading to memory corruption.

...

Avian JVM 1.2.0 Silent Return Exploit

Avian JVM version 1.2.0 suffers from a silent return issue in the vm::arrayCopy method defined in classpath-common.h, where multiple boundary checks are performed to prevent out-of-bounds memory read/write. One of these boundary checks makes the code return silently when a negative length is...

DEBIAN-CVE-2020-15694

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get.contentLength does not raise any error if a malicious server provides a negative Content-Length...

UBUNTU-CVE-2020-15694

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get.contentLength does not raise any error if a malicious server provides a negative Content-Length...

CVE-2020-15694

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get.contentLength does not raise any error if a malicious server provides a negative Content-Length...

arrow:arrow-ipc-stream-fuzz: Negative-size-param in arrow::IsEqualPrimitive

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6201516059525120 Project: arrow Fuzzing Engine: honggfuzz Fuzz Target: arrow-ipc-stream-fuzz Job Type: honggfuzzasanarrow Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

CVE-2020-17361

An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided instead of throwing an exception. This could result in data being lost during the copy, with varying consequences depending on the subsequen...

PT-2020-14923 · Readytalk · Readytalk Avian

Name of the Vulnerable Software and Affected Versions: ReadyTalk Avian version 1.2.0 Description: An issue was discovered in the vm::arrayCopy method defined in classpath-common.h, which returns silently when a negative length is provided, instead of throwing an exception. This could result in da...

Avian JVM 1.2.0 Silent Return

Vulnerability title: Avian JVM vm::arrayCopy silent return on negative length Author: Pietro Oliva CVE: CVE-2020-17361 Vendor: ReadyTalk Product: Avian JVM Affected version: 1.2.0 Description: The issue is located in the vm::arrayCopy method defined in classpath-common.h, where multiple boundary...

rnp:fuzz_dump: Negative-size-param in armored_src_read

Project: https://github.com/rnpgp/rnp.git Detailed Report: https://oss-fuzz.com/testcase?key=5105305323831296 Project: rnp Fuzzing Engine: libFuzzer Fuzz Target: fuzzdump Job Type: libfuzzerasanrnp Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State: armoredsrcread srcpe...

Secomea GateManager Code Issue Vulnerability

Secomea GateManager is a remote access server product from Secomea, Denmark. A code issue vulnerability exists in Secomea GateManager versions prior to 9.2c. The vulnerability stems from an improper design or implementation during code development for a network system or product. An attacker coul...

SUSE-SU-2020:2057-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues: - Add 0019-FLI-overflow-error-fix-and-testcase.patch Fixes CVE-2016-0775, bsc965582 - Add 0020-Fix-OOB-reads-in-FLI-decoding.patch Fixes CVE-2020-10177, bsc1173413 - Add 0021-Fix-bounds-overflow-in-JPEG-2000-decoding.patch Fixes...

OSV-2020-1347 Negative-size-param in fuzz_tlv_to_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16703 Crash type: Negative-size-param Crash state: fuzztlvtostring fuzzparsemimetlv fuzzaddmimepart...

OSV-2020-1260 Negative-size-param in heif::HeifPixelImage::fill_RGB_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13563 Crash type: Negative-size-param Crash state: heif::HeifPixelImage::fillRGB16bit heif::HeifContext::decodeoverlayimage heif::HeifContext::decodeimage...

OSV-2020-1080 Negative-size-param in fuzz_tlv_to_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16696 Crash type: Negative-size-param Crash state: fuzztlvtostring fuzzparsetlv curlfuzzer.cc...

Medium: cairo

Issue Overview: The fillxrgb32lerpopaquespans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a negative span length. CVE-2016-3190 Affected Packages: cairo Issue Correction: Run yum upda...

OSV-2020-776 Negative-size-param in arrow::ConcatenateBuffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24101 Crash type: Negative-size-param Crash state: arrow::ConcatenateBuffers arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

GoGhost - High Performance, Lightweight, Portable Open Source Tool For Mass SMBGhost Scan

GoGhost is a High Performance, lightweight, portable Open Source tool for mass SMBGhost Scan. Installation You can download Windows Binary or Linux Binary. Alternatively, GoGhost uses native Golang libraries so the line above would be fine to compile it: go build GoGhost.go Usage Options GoGhost...

Threat Source newsletter for June 25, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We recently decided to replace our use of the terms "blacklist" and "whitelist" with "block list" and "allow list.” Even though these terms are commonly in use in the security industry, we will not go along with casually assigning...

OSV-2020-322 Negative-size-param in parse_proxy_protocol_v2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14455 Crash type: Negative-size-param Crash state: parseproxyprotocolv2 parsehttprequest fuzzparsehttprequest...