libvips:jpegsave_file_fuzzer: Crash in colr_color

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5662041322291200 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavefilefuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x7f22a2c12000 Crash...

USN-4038-3: bzip2 regression | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description USN-4038-1 fixed a vulnerability in bzip2. The update introduced a regression causing bzip2 to incorrect raises CRC errors for some files. We apologize for the inconvenience. Origin...

Debian DLA-1900-2 : apache2 regression update

The update of apache2 released as DLA-1900-1 contained an incomplete fix for CVE-2019-10092, a limited cross-site scripting issue affecting the modproxy error page. The old patch rather introduced a new CSRF protection which also caused a regression, an inability to dynamically change the status ...

In-the-wild iOS Exploit Chain 3

Posted by Ian Beer, Project Zero TL;DR This chain targeted iOS 11-11.4.1, spanning almost 10 months. This is the first chain we observed which had a separate sandbox escape exploit. The sandbox escape vulnerability was a severe security regression in libxpc, where refactoring lead to a bounds che...

USN-4038-4: bzip2 regression | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-4038-1 fixed a vulnerability in bzip2. The update introduced a regression causing bzip2 to incorrect raises CRC errors for some files. This update provides the corresponding update for Ubuntu 12.04 ES...

Ubuntu 16.04 LTS / 18.04 LTS : Dovecot regression (USN-4110-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4110-3 advisory. USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem. We apologize for...

USN-4049-4: GLib regression | Cloud Foundry

Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib...

USN-4110-4 dovecot regression

USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. We apologize for the inconvenience. Original advisory details: Nick Roessler and Rafi Rubin discovered that Dovecot...

USN-4110-4: Dovecot regression

USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. We apologize for the inconvenience. Original advisory details: Nick Roessler and Rafi Rubin discovered that Dovecot...

libspng:spng_read_fuzzer: Heap-buffer-overflow in spng_decode_image

Project: https://gitlab.com/randy408/libspng.git https://github.com/randy408/libspng.git Detailed Report: https://oss-fuzz.com/testcase?key=5750326069559296 Project: libspng Fuzzing Engine: libFuzzer Fuzz Target: spngreadfuzzer Job Type: libfuzzerasanlibspng Platform Id: linux Crash Type:...

USN-4110-3: Dovecot regression

USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker...

USN-4110-3 Dovecot regression

USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a regression causing a wrong check. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly handled certain data. An attacker...

libvips:jpegsave_file_fuzzer: Index-out-of-bounds in make_hI

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5651968818675712 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavefilefuzzer Job Type: libfuzzerubsanlibvips Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

libvips:jpegsave_file_fuzzer: Crash in vips_rad2float_line

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5682293519155200 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavefilefuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x7f8e216e0000 Crash...

Debian DSA-4506-1 : qemu - security update

Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or bypass of ACLs. In addition this update fixes a regression which could cause NBD connections to hang. C Tenable Network Security, Inc. The...

graphicsmagick:coder_MNG_fuzzer: Unknown signal in MagickMallocAligned

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5126582330458112 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderMNGfuzzer Job Type: libfuzzerubsangraphicsmagick Platform Id: linux Crash Type: Unknown signal Crash Address...

[SECURITY] [DSA 4506-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4506-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 24, 2019 https://www.debian.org/security/faq -...

libvips:jpegsave_file_fuzzer: Crash in vips__foreign_convert_saveable

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5688033944272896 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavefilefuzzer Job Type: libfuzzerubsanlibvips Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_PNG_fuzzer: Crash in av_freep

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5768418552184832 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDPNGfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00000045dfd0...

curl:curl_fuzzer: Use-of-uninitialized-value in getrn

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5703353153093632 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzer Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: getrn...