[SECURITY] [DSA 4444-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4444-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 14, 2019 https://www.debian.org/security/faq -...

libical/libical_fuzzer: Use-of-uninitialized-value in pvl_pop

Detailed report: https://oss-fuzz.com/testcase?key=5739308486492160 Project: libical Fuzzer: libFuzzerlibicalfuzzer Fuzz target binary: libicalfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: pvlpop icalcomponentfree...

perfetto/trace_processor_fuzzer: Heap-buffer-overflow in perfetto::trace_processor::FuchsiaTraceParser::ParseTracePacket

Project: https://android.googlesource.com/platform/external/perfetto/ Detailed report: https://oss-fuzz.com/testcase?key=5653558021586944 Project: perfetto Fuzzer: libFuzzerperfettotraceprocessorfuzzer Fuzz target binary: traceprocessorfuzzer Job Type: libfuzzerasanperfetto Platform Id: linux Cra...

libical/libical_fuzzer: Use-of-uninitialized-value in parser_get_next_char

Project: https://github.com/libical/libical.git Detailed report: https://oss-fuzz.com/testcase?key=5695048311635968 Project: libical Fuzzer: libFuzzerlibicalfuzzer Fuzz target binary: libicalfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

libical/libical_fuzzer: Use-of-uninitialized-value in icalcomponent_remove_component

Project: https://github.com/libical/libical.git Detailed report: https://oss-fuzz.com/testcase?key=5677236176289792 Project: libical Fuzzer: libFuzzerlibicalfuzzer Fuzz target binary: libicalfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

[SECURITY] [DSA 4442-2] cups-filters regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-4442-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 13, 2019 https://www.debian.org/security/faq -...

DSA-4442-2 cups-filters - regression update

Bulletin has no description...

keystone/fuzz_asm_sparc64be: Crash in llvm_ks::SmallVectorBase::grow_pod

Detailed report: https://oss-fuzz.com/testcase?key=5688354168897536 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmsparc64be Fuzz target binary: fuzzasmsparc64be Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7180004447e0 Crash State:...

imagemagick/encoder_ttf_fuzzer: Use-of-uninitialized-value in TT_Process_Simple_Glyph

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5769270614556672 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderttffuzzer Fuzz target binary: encoderttffuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

systemd/fuzz-varlink: Heap-buffer-overflow in varlink_enqueue_json

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=5692571826782208 Project: systemd Fuzzer: libFuzzersystemdfuzz-varlink Fuzz target binary: fuzz-varlink Job Type: libfuzzerasansystemd Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

karchive/karchive_fuzzer: Heap-buffer-overflow in KAr::openArchive

Project: git://anongit.kde.org/karchive Detailed report: https://oss-fuzz.com/testcase?key=5721807937601536 Project: karchive Fuzzer: aflkarchivefuzzer Fuzz target binary: karchivefuzzer Job Type: aflasankarchive Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

poppler/pdf_fuzzer: Use-of-uninitialized-value in TT_Process_Simple_Glyph

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5689090034368512 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type:...

freetype2/ftfuzzer: Crash in TT_Process_Simple_Glyph

Detailed report: https://oss-fuzz.com/testcase?key=5666646934421504 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerubsanfreetype2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fff00000009 Crash State: TTProcessSimpleGlyph...

radare2/ia_fuzz: Heap-buffer-overflow in r_core_lines_initcache

Project: https://github.com/radare/radare2.git Detailed report: https://oss-fuzz.com/testcase?key=5655993335152640 Project: radare2 Fuzzer: libFuzzerradare2iafuzz Fuzz target binary: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address:...

libarchive/libarchive_fuzzer: Heap-use-after-free in Ppmd7_DecodeSymbol

Project: https://github.com/libarchive/libarchive.git Detailed report: https://oss-fuzz.com/testcase?key=5754300750364672 Project: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type: Heap-use-after-free...

imagemagick/ping_dng_fuzzer: Use-of-uninitialized-value in LibRaw::open_datastream

Detailed report: https://oss-fuzz.com/testcase?key=5731129560137728 Project: imagemagick Fuzzer: libFuzzerimagemagickpingdngfuzzer Fuzz target binary: pingdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

karchive/karchive_fuzzer: Use-of-uninitialized-value in QByteArray::endsWith

Project: git://anongit.kde.org/karchive Detailed report: https://oss-fuzz.com/testcase?key=5699436728025088 Project: karchive Fuzzer: libFuzzerkarchivefuzzer Fuzz target binary: karchivefuzzer Job Type: libfuzzermsankarchive Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

CVE-2019-5021

Versions of the Official Alpine Linux Docker images since v3.3 contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux...

Authentication flaw

Versions of the Official Alpine Linux Docker images since v3.3 contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux...

CVE-2019-5021

CVE-2019-5021 affects Official Alpine Linux Docker images (from v3.3 onward). The root user password is NULL due to a regression introduced in December 2015, and systems using PAM or shadow-based authentication may accept a NULL root password. Affected component is the Alpine container image and ...