USN-4170-3: Whoopsie regression

USN-4170-1 fixed a vulnerability in Whoopsie and USN-4170-2 fixed a subsequent regression. That update was incomplete and could still result in Whoopsie potentially crashing when uploading crash reports on some architectures. This update fixes the problem. We apologize for the inconvenience...

USN-4170-3 whoopsie regression

USN-4170-1 fixed a vulnerability in Whoopsie and USN-4170-2 fixed a subsequent regression. That update was incomplete and could still result in Whoopsie potentially crashing when uploading crash reports on some architectures. This update fixes the problem. We apologize for the inconvenience...

Security update for python3 (moderate)

openSUSE Security Update: Security update for python3 Announcement ID: openSUSE-SU-2019:2438-1 Rating: moderate References: 1149121 1149792 1149955 1151490 1153238 Cross-References: CVE-2019-16056 CVE-2019-16935 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and h...

ffmpeg:ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer: Index-out-of-bounds in decodeplane8

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5651995784642560 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDIFFILBMfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

cryptofuzz:cryptofuzz-boringssl: Heap-buffer-overflow in DesSetKey

Detailed Report: https://oss-fuzz.com/testcase?key=5689068197511168 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x602000000d27 Crash State: DesSetKey...

ffmpeg:ffmpeg_AV_CODEC_ID_AGM_fuzzer: Heap-buffer-overflow in decode_inter_plane

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5659333417500672 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAGMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

imagemagick:crop_fuzzer: Index-out-of-bounds in LibRaw::adobe_coeff

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5684491775639552 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: cropfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

flac:fuzzer_encoder: Crash in FLAC__bitwriter_write_raw_uint32_nocheck

Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=5697199728230400 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzerencoder Job Type: libfuzzerasani386flac Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0xb61fb820 Crash State:...

osquery:osqueryfuzz-sqlquery: Heap-buffer-overflow in sqlite3VdbeMemSetStr

Project: https://github.com/osquery/osquery.git Detailed Report: https://oss-fuzz.com/testcase?key=5657577178529792 Project: osquery Fuzzing Engine: libFuzzer Fuzz Target: osqueryfuzz-sqlquery Job Type: libfuzzerasanosquery Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

opensc:fuzz_pkcs15_reader: Crash in parse_sec_attr_44

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5681169970757632 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerubsanopensc Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000013a1000 Crash...

libreoffice:pptfuzzer: Heap-use-after-free in SvxMSDffManager::SolveSolver

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5718371501080576 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

gdal:gdal_filesystem_fuzzer: Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5701964726009856 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: gdalfilesystemfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

jsc: Stack-buffer-underflow in JSC::Register::pointer

Detailed Report: https://oss-fuzz.com/testcase?key=5763160024023040 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: Stack-buffer-underflow READ 8 Crash Address: 0x7ffcb1a355c8 Crash State: JSC::Register::pointer JSC::CallFrame::callee...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in bebytes2ulong

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5735919462383616 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

sqlite3:ossfuzz: Heap-use-after-free in sqlite3VdbeAddFunctionCall

Detailed Report: https://oss-fuzz.com/testcase?key=5707309678592000 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzerasani386sqlite3 Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address: 0xf4d37e80 Crash State: sqlite3VdbeAddFunctionCall...

opensc:fuzz_pkcs15_reader: Stack-buffer-overflow in cac_cac1_get_certificate

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5654449905467392 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerasanopensc Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address:...

qpdf:qpdf_fuzzer: Use-of-uninitialized-value in QPDFWriter::unparseObject

Detailed Report: https://oss-fuzz.com/testcase?key=5635403973656576 Project: qpdf Fuzzing Engine: libFuzzer Fuzz Target: qpdffuzzer Job Type: libfuzzermsanqpdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: QPDFWriter::unparseObject QPDFWriter::writeObject...

Ubuntu 16.04 LTS / 18.04 LTS : Whoopsie regression (USN-4170-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4170-2 advisory. USN-4170-1 fixed a vulnerability in Whoopsie. The update caused Whoopsie to crash when sending reports. This update fixes the problem. We apologize fo...

USN-4170-2 whoopsie regression

USN-4170-1 fixed a vulnerability in Whoopsie. The update caused Whoopsie to crash when sending reports. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Kevin Backhouse discovered Whoopsie incorrectly handled very large crash reports. A local attacker...

CVE-2019-10160

A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies,...