OESA-2023-1989 hdf5 security update

HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF...

ndpi:fuzz_ndpi_reader_alloc_fail: Heap-buffer-overflow in processClientServerHello

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4811039090737152 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireaderallocfail Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

ntopng:fuzz_dissect_packet: Heap-buffer-overflow in NetworkInterface::dissectPacket

Project: https://github.com/ntop/ntopng.git Detailed Report: https://oss-fuzz.com/testcase?key=4524187586723840 Project: ntopng Fuzzing Engine: libFuzzer Fuzz Target: fuzzdissectpacket Job Type: libfuzzerasanntopng Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

gpac:fuzz_probe_analyze: Stack-buffer-overflow in gf_strdup

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6154989789380608 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address: 0x7941193b0020 Crash State:...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in gf_xml_sax_parse_intern

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4720135033978880 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x622000011c89...

glibc security update

2.28-225.0.4.6 - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode. - CVE-2023-4806: potential use-after-free in getaddrinfo. - CVE-2023-4813: potential use-after-free in gaihinet RHEL-2435. - CVE-2023-4813: work around RHEL-8 limitation in test RHEL-2435. Reviewed by: Jose E...

libxslt:xslt: Global-buffer-overflow in xmlDictLookupInternal

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=5134452795506688 Project: libxslt Fuzzing Engine: libFuzzer Fuzz Target: xslt Job Type: libfuzzerasanlibxslt Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...

php:php-fuzz-tracing-jit: Global-buffer-overflow in pcre_get_compiled_regex_cache_ex

Detailed Report: https://oss-fuzz.com/testcase?key=6258265952223232 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-tracing-jit Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x0000014d13ed Crash State: pcregetcompiledregexcache...

binutils:fuzz_objdump: Heap-buffer-overflow in loongarch_split_args_by_comma

Detailed Report: https://oss-fuzz.com/testcase?key=5915160040308736 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzobjdump Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60200000022f Crash State: loongarchsplitargsbycomma...

matio:matio_fuzzer: Heap-buffer-overflow in H5T__bit_copy

Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=6181515062804480 Project: matio Fuzzing Engine: afl Fuzz Target: matiofuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

wolfssl:fuzzer-wolfssl-server-randomize: Heap-buffer-overflow in sp_clear

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5841038547484672 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-server-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Cra...

ntopng:fuzz_dissect_packet: Heap-buffer-overflow in NetworkInterface::dissectPacket

Project: https://github.com/ntop/ntopng.git Detailed Report: https://oss-fuzz.com/testcase?key=4551591101071360 Project: ntopng Fuzzing Engine: afl Fuzz Target: fuzzdissectpacket Job Type: aflasanntopng Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x611004be7f1e Crash...

serenity:FuzzICCProfile: Heap-buffer-overflow in Gfx::ICC::TextDescriptionTagData::from_bytes

Detailed Report: https://oss-fuzz.com/testcase?key=5566777933037568 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzICCProfile Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x615000000780 Crash State:...

ffmpeg:ffmpeg_DEMUXER_fuzzer: Heap-buffer-overflow in ff_jpegxl_parse_codestream_header

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6151006496620544 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegDEMUXERfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

libredwg:llvmfuzz: Stack-buffer-overflow in dynapi_set_helper

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5245326122156032 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address:...

wireshark:fuzzshark_ip_proto-udp: Global-buffer-overflow in dissect_rf4ce_profile_common

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed Report: https://oss-fuzz.com/testcase?key=6244305964236800 Project: wireshark Fuzzing Engine: libFuzzer Fuzz Target: fuzzsharkipproto-udp Job Type: libfuzzerasanwireshark Platform Id: linux...

glibc security update

2.34-60.0.3.7 - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode 2234716. - CVE-2203-4806: potential use-after-free in getaddrinfo. - CVE-2023-4813: potential use-after-free in gaihinet. Reviewed by: Jose E. Marchesi 2.34-60.0.3 - CVE-2023-4911: tunables: Terminate immediately if...

glibc security update

2.28-225.0.4.6 - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode. - CVE-2203-4806: potential use-after-free in getaddrinfo. - CVE-2023-4813: potential use-after-free in gaihinet RHEL-2435. - CVE-2023-4813: work around RHEL-8 limitation in test RHEL-2435. Reviewed by: Jose E...

libredwg:llvmfuzz: Heap-buffer-overflow in dxf_fixup_string

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4940101958107136 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

glibc security update

2.34-60.0.3.7 - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode 2234716. - CVE-2203-4806: potential use-after-free in getaddrinfo. - CVE-2023-4813: potential use-after-free in gaihinet. Reviewed by: Jose E. Marchesi...