USN-4049-4: GLib regression

USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibl...

USN-4049-4 glib2.0 regression

USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibl...

libspng/spng_read_fuzzer_structure_aware: Heap-use-after-free in read_chunks_before_idat

Project: https://gitlab.com/randy408/libspng.git https://github.com/randy408/libspng.git Detailed report: https://oss-fuzz.com/testcase?key=5759860653686784 Project: libspng Fuzzer: afllibspngspngreadfuzzerstructureaware Fuzz target binary: spngreadfuzzerstructureaware Job Type: aflasanlibspng...

SUSE-SU-2019:2053-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2019-10160: Fixed a regression in urlparse and urlsplit introduced by the fix for CVE-2019-9636 bsc1138459. - CVE-2018-14647: Fixed a denial of service vulnerability caused by a crafted XML document bsc1109847. - CVE-2018-1000802: Fixed a...

SUSE-SU-2019:14139-1 Security update for bzip2

This update for bzip2 fixes the following issues: - Fixed a regression with the fix for CVE-2019-12900, which caused incompatibilities with files that used many selectors bsc1139083...

aspell/aspell_fuzzer: Heap-buffer-overflow in acommon::DecodeDirect<unsigned short>::decode

Project: https://github.com/gnuaspell/aspell.git Detailed report: https://oss-fuzz.com/testcase?key=5704942551040000 Project: aspell Fuzzer: libFuzzeraspellfuzzer Fuzz target binary: aspellfuzzer Job Type: libfuzzerasanaspell Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Addres...

DLA-1866-2 glib2.0 - regression update

Bulletin has no description...

[SECURITY] [DLA 1866-2] glib2.0 regression update

Package : glib2.0 Version : 2.42.1-1+deb8u3 CVE ID : CVE-2019-13012 Debian Bug : 933877 Simon McVittie spotted a memory leak regression in the way CVE-2019-13012 had been resolved for glib2.0 in Debian jessie. For Debian 8 "Jessie", this problem has been fixed in version 2.42.1-1+deb8u3. We...

USN-4049-3: GLib regression

USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression in Ubuntu 16.04 LTS causing a possibly memory leak. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib created directories and files without properly...

imagemagick/ping_mng_fuzzer: Use-of-uninitialized-value in ScaleQuantumToChar

Detailed report: https://oss-fuzz.com/testcase?key=5724110990082048 Project: imagemagick Fuzzer: libFuzzerimagemagickpingmngfuzzer Fuzz target binary: pingmngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ffmpeg/ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer: Heap-buffer-overflow in oggpack_read

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5760920873074688 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDLIBVORBISfuzzer Fuzz target binary: ffmpegAVCODECIDLIBVORBISfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

CVE-2019-14492

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service...

cryptofuzz/cryptofuzz-openssl: Heap-buffer-overflow in aria_set_encrypt_key

Detailed report: https://oss-fuzz.com/testcase?key=5654646873391104 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-openssl Fuzz target binary: cryptofuzz-openssl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x603000000952...

CVE-2019-14463

An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUSFCWRITEMULTIPLEREGISTERS case, aka VD-1301...

ffmpeg/ffmpeg_DEMUXER_fuzzer: Crash in avio_read

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5649290914955264 Project: ffmpeg Fuzzer: libFuzzerffmpegDEMUXERfuzzer Fuzz target binary: ffmpegDEMUXERfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

CVE-2019-5020

An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerabili...

aspell/aspell_fuzzer: Dynamic-stack-buffer-overflow in acommon::unescape

Project: https://github.com/gnuaspell/aspell.git Detailed report: https://oss-fuzz.com/testcase?key=5678055552450560 Project: aspell Fuzzer: aflaspellfuzzer Fuzz target binary: aspellfuzzer Job Type: aflasanaspell Platform Id: linux Crash Type: Dynamic-stack-buffer-overflow READ 1 Crash Address:...

[SECURITY] [DLA 1730-4] libssh2 regression update

Package : libssh2 Version : 1.4.3-4.1+deb8u5 CVE ID : CVE-2019-3860 Several more boundary checks have been backported to libssh2s src/sftp.c. Furthermore, all boundary checks in src/sftp.c now result in an LIBSSH2ERRORBUFFERTOOSMALL error code, rather than a LIBSSH2ERROR OUTOFBOUNDARY error code...

DLA-1730-4 libssh2 - regression update

Bulletin has no description...

ghostscript security update

9.25-2.1 - Resolves: 1692798 - CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116 - Resolves: 1678170 - CVE-2019-3835 ghostscript: superexec operator is available 700585 - Resolves: 1691414 - CVE-2019-3838 ghostscript: forceput in DefineResource is still accessible...