Apache Httpd < 2.4.52 : Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint Server Side Request Forgery...

tdengine:sql-fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4949968215998464 Project: tdengine Fuzzing Engine: libFuzzer Fuzz Target: sql-fuzzer Job Type: libfuzzerubsantdengine Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000002cb10e9 Crash State: NULL Sanitizer: undefined UBSAN Recommend...

PT-2021-27011

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15 through v5.15.5 Description The issue is related to a potential NULL dereference in the ethtool set coalesce function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

vitess:fuzz_replication_engine: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5739612113338368 Project: vitess Fuzzing Engine: libFuzzer Fuzz Target: fuzzreplicationengine Job Type: libfuzzerasanvitess Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address AS...

CLSA-2021-1639681846 Fix CVE(s): CVE-2020-7071, CVE-2020-7068, CVE-2021-21705, CVE-2021-21704, CVE-2021-21703, CVE-2021-21702

SECURITY UPDATE: Process crash and information disclosure - debian/patches/CVE-2020-7068.patch: fix access-after-free for actualalias pointer - CVE-2020-7068 SECURITY UPDATE: logic error due to invalid input validation - debian/patches/CVE-2020-7071.patch: add validation fo url-user field -...

CLSA-2021-1639670584 Fixed 36 CVEs in binutils

CVE-2018-6323: Fix unsigned integer overflow - CVE-2018-19931: Fix heap-based buffer overflow in bfdelf32swapphdrin - CVE-2018-6543: Fix integer overflow - CVE-2018-20671: Fix integer overflow vulnerability - CVE-2018-6759: Fix segmentation fault - CVE-2018-7208: Fix segmentation fault -...

cryptofuzz:cryptofuzz-openssl: Null-dereference READ in ubsan_GetStackTrace

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6222499245850624 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl Job Type: libfuzzerubsancryptofuzz Platform Id: linux Crash Type: Null-dereference READ Crash...

tidb:fuzzMarshalJSON: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6746457154125824 Project: tidb Fuzzing Engine: libFuzzer Fuzz Target: fuzzMarshalJSON Job Type: libfuzzerasantidb Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

grpc-go:fuzz_helloserver: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5073298520670208 Project: grpc-go Fuzzing Engine: libFuzzer Fuzz Target: fuzzhelloserver Job Type: libfuzzerasangrpc-go Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c000190820 Crash State: NULL Sanitizer: address ASAN Recommende...

OSV-2021-1658 Null-dereference READ in istio.io/istio/security/pkg/util.ExtractJwtAud

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42142 Crash type: Null-dereference READ Crash state: istio.io/istio/security/pkg/util.ExtractJwtAud...

CLSA-2021-1638803819 Fix of 56 CVEs

CVE-2017-7223: Fix global buffer overflow of size 1 - CVE-2017-7224: Fix invalid write of size 1 while disassembling - CVE-2017-7225: Fix NULL pointer dereference and an invalid write - CVE-2017-7226: Fix heap-based buffer over-read of size 4049 - CVE-2017-7227: Fix heap-based buffer overflow -...

frr:zebra: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=6212789448867840 Project: frr Fuzzing Engine: libFuzzer Fuzz Target: zebra Job Type: libfuzzerubsanfrr Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer: undefined UBSAN...

caddy:fuzz-extract-front-matter: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5928310947840000 Project: caddy Fuzzing Engine: libFuzzer Fuzz Target: fuzz-extract-front-matter Job Type: libfuzzerasancaddy Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...

PT-2021-30743

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.82 Description The issue is related to a NULL dereference in the set hv tscchange cb function if Hyper-V setup fails. The actual impact and attack plausibility have not yet been proven. Recommendations For...

PT-2021-30774

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.5 Description The issue is related to a potential NULL dereference in the set hv tscchange cb function if Hyper-V setup fails. The actual impact and attack plausibility have not yet been proven...

PT-2021-26728

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.162 Description: The issue is related to a NULL dereference in the set hv tscchange cb function if Hyper-V setup fails. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

PT-2021-26748

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.82 Description: The issue is related to a NULL dereference in the set hv tscchange cb function if Hyper-V setup fails. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

PT-2021-26716

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.16 through 4.19.217 Description: A potential issue exists in the set hv tscchange cb function, which may lead to a NULL dereference if Hyper-V setup fails. The actual impact and attack plausibility have not yet been...

PT-2021-26779

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.5 Description: The issue is related to a NULL dereference in the set hv tscchange cb function if Hyper-V setup fails. The actual impact and attack plausibility have not yet been proven. Recommendations: Fo...

PT-2021-30711

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.16 through 4.19.217 Description A potential issue exists in the set hv tscchange cb function, which may lead to a NULL dereference if Hyper-V setup fails. The actual impact and attack plausibility have not yet been...