imagemagick:ping_ptif_fuzzer: Use-of-uninitialized-value in ConstantString

Detailed Report: https://oss-fuzz.com/testcase?key=5175716879794176 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: pingptiffuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: ConstantString SetImageProperty...

gnutls:gnutls_x509_crl_parser_fuzzer: Use-of-uninitialized-value in print_crl

Project: https://gitlab.com/gnutls/gnutls.git Detailed Report: https://oss-fuzz.com/testcase?key=5639123231834112 Project: gnutls Fuzzing Engine: libFuzzer Fuzz Target: gnutlsx509crlparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

systemd:fuzz-journal-remote: Use-of-uninitialized-value in strjoin_real

Project: https://github.com/systemd/systemd.git Detailed Report: https://oss-fuzz.com/testcase?key=5730988035670016 Project: systemd Fuzzing Engine: libFuzzer Fuzz Target: fuzz-journal-remote Job Type: libfuzzermsansystemd Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

llvm:clang-fuzzer: Segv on unknown address in clang::FunctionProtoType::FunctionProtoType

Detailed Report: https://oss-fuzz.com/testcase?key=5650857535471616 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: clang::FunctionProtoType::FunctionProtoType...

cras:rclient_message: Heap-use-after-free in surround51_to_stereo_downmix_mtx

Detailed Report: https://oss-fuzz.com/testcase?key=5699718794706944 Project: cras Fuzzing Engine: honggfuzz Fuzz Target: rclientmessage Job Type: honggfuzzasancras Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address: 0x60400001157c Crash State: surround51tostereodownmixmtx...

arrow:parquet-arrow-fuzz: Crash in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5674948678123520 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000048f8000 Crash...

libavif:avif_decode_fuzzer: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5645512985542656 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: avifdecodefuzzer Job Type: libfuzzerasanlibavif Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN...

llvm:clang-objc-fuzzer: Segv on unknown address in llvm::llvm_unreachable_internal

Detailed Report: https://oss-fuzz.com/testcase?key=5752309763276800 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-objc-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: llvm::llvmunreachableinternal...

Debian DLA-2133-1 : tomcat7 security update

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2019-17569 The refactoring in 7.0.98 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request...

openthread:ip6-send-fuzzer: Index-out-of-bounds in ot::EnergyScanServer::HandleScanResult

Project: https://github.com/openthread/openthread.git Detailed Report: https://oss-fuzz.com/testcase?key=5686760173731840 Project: openthread Fuzzing Engine: libFuzzer Fuzz Target: ip6-send-fuzzer Job Type: libfuzzerubsanopenthread Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)

It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...

openSUSE: Security Advisory for permissions (openSUSE-SU-2020:0302-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0302-1 Security update for permissions

This update for permissions fixes the following issues: Security issues fixed: - CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed bsc1148788 - CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities...

libarchive:libarchive_fuzzer: Heap-buffer-overflow in archive_read_format_cpio_read_header

Project: https://github.com/libarchive/libarchive.git Detailed Report: https://oss-fuzz.com/testcase?key=5688058864467968 Project: libarchive Fuzzing Engine: honggfuzz Fuzz Target: libarchivefuzzer Job Type: honggfuzzasanlibarchive Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

gdal:gdal_fuzzer: Heap-buffer-overflow in Fax3Decode2D

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5650429515137024 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x615000003c00 Cras...

arrow:arrow-ipc-stream-fuzz: Heap-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayVisitor>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5089431154589696 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-stream-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Security update for permissions (moderate)

openSUSE Security Update: Security update for permissions Announcement ID: openSUSE-SU-2020:0302-1 Rating: moderate References: 1148788 1160594 1160764 1161779 1163922 Cross-References: CVE-2019-3687 CVE-2020-8013 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and...

gdal:gdal_filesystem_fuzzer: Stack-buffer-overflow in NITFDataset::ScanJPEGQLevel

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5070558930927616 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gdalfilesystemfuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address:...

imagemagick:crop_fuzzer: Stack-buffer-overflow in ReadICCProfile

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5741266359025664 Project: imagemagick Fuzzing Engine: honggfuzz Fuzz Target: cropfuzzer Job Type: honggfuzzasanimagemagick Platform Id: linux Crash Type: Stack-buffer-overflow READ 13 Crash...

karchive:karchive_fuzzer: Stack-buffer-overflow in KTar::KTarPrivate::readHeader

Project: git://anongit.kde.org/karchive Detailed Report: https://oss-fuzz.com/testcase?key=5632739014606848 Project: karchive Fuzzing Engine: honggfuzz Fuzz Target: karchivefuzzer Job Type: honggfuzzasankarchive Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address: 0x7ffff7f75a...