CLSA-2021-1637770725 Fixed 56 CVEs in binutils

CVE-2017-7223: Fix global buffer overflow of size 1 - CVE-2017-7224: Fix invalid write of size 1 while disassembling - CVE-2017-7225: Fix NULL pointer dereference and an invalid write - CVE-2017-7226: Fix heap-based buffer over-read of size 4049 - CVE-2017-7227: Fix heap-based buffer overflow -...

binutils:fuzz_dwarf: Null-dereference READ in load_separate_debug_files

Detailed Report: https://oss-fuzz.com/testcase?key=6117248264175616 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdwarf Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: loadseparatedebugfiles fuzzdwarf.c...

dgraph:parser_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5618729564635136 Project: dgraph Fuzzing Engine: libFuzzer Fuzz Target: parserfuzzer Job Type: libfuzzerasandgraph Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000205ce8 Crash State: NULL Sanitizer: address ASAN Recommended...

GSD-2021-1002174 mm/secretmem: fix NULL page->mapping dereference in page_is_secretmem()

mm/secretmem: fix NULL page-mapping dereference in pageissecretmem This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15 by commit...

PT-2021-26644

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15 Description: A potential security issue exists due to a NULL page-mapping dereference in the page is secretmem function. The actual impact and attack plausibility have not yet been proven. Recommendations:...

PT-2021-30639

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15 Description A potential security issue exists due to a NULL page-mapping dereference in the page is secretmem function. The actual impact and attack plausibility have not yet been proven. Recommendations Fo...

PT-2021-30664

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.7 through v5.15 Description A potential NULL dereference issue has been identified. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.7 and is fixed in version...

PT-2021-30530

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.77 Description A potential NULL dereference issue has been identified. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.7 and is fixed in Linux...

PT-2021-30596

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.14.16 Description A potential NULL dereference issue has been identified. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.7 and is fixed in Linux...

PT-2021-26535

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.77 Description A potential NULL dereference issue has been identified. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.7 and is fixed in Linux...

PT-2021-26601

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.7 through v5.14.15 Description A potential NULL dereference issue has been identified. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions v5.7 through v5.14.15...

PT-2021-26669

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.7 through v5.15 Description: A potential NULL dereference issue has been identified. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.7 and is fixed in versio...

vitess:fuzz_equals_sql_node: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6180113868259328 Project: vitess Fuzzing Engine: libFuzzer Fuzz Target: fuzzequalssqlnode Job Type: libfuzzerasanvitess Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN...

OESA-2021-1427 virglrenderer security update

The virgil3d rendering library is a library used by qemu to implement 3D GPU support for the virtio GPU. Security Fixes: An out-of-bounds read in the vrendblitneedswizzle function in vrendrenderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGLCCMDBLI...

GHSA-57WX-M983-2F88 Incomplete validation in boosted trees code

Impact The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding references to nullptrs. An attacker can also read and write from heap...

openssl: NULL pointer dereference in X509_issuer_and_serial_hash()

The OpenSSL public API function X509issuerandserialhash attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field which might occur if the...

netcdf:fuzz_open: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5265042598133760 Project: netcdf Fuzzing Engine: libFuzzer Fuzz Target: fuzzopen Job Type: libfuzzerubsannetcdf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer: undefine...

PYSEC-2021-815

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...

PYSEC-2021-617

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...

CVE-2021-41208

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...