shopify-scripts: Null pointer dereference regression in parse.y

Hi, Just pulled the latest mruby code, and found that some of my fuzzing test cases now crash. Bisected it to commit 227daa881137d5251e03eea0883b9b574a1f064e. Reverting this change no longer causes a crash. The minimised file causing the crash is: f Also affects mruby-engine. Cheers, Hugh...

NTP.org ntpd contains multiple denial of service vulnerabilities

Overview NTP.org ntpd versions ntp-4.2.7p385 up to but not including ntp-4.2.8p9 and ntp-4.3.0 up to but not including ntp-4.3.94 contain multiple denial of service vulnerabilities. Description NTP.org's ntpd, versions ntp-4.2.7p385 up to but not including ntp-4.2.8p9 and ntp-4.3.0 up to but not...

openSUSE Security Update : ghostscript (openSUSE-2016-1330)

This update for ghostscript fixes the following issues : - bsc1006592: Fix a regression introduced in CVE-2013-5653 by which ps files couldn't be opened in okular/evince kde371887. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security,...

SUSE-SU-2016:2817-1 Security update for ghostscript

This update for ghostscript fixes the following issues: - bsc1006592: Fix a regression introduced in CVE-2013-5653 by which ps files couldn't be opened in okular/evince kde371887...

SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2016:2817-1)

This update for ghostscript fixes the following issues : - bsc1006592: Fix a regression introduced in CVE-2013-5653 by which ps files couldn't be opened in okular/evince kde371887. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

pcre2: Heap-buffer-overflow in parse_regex

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6709751601692672 Target: pcre2 Fuzzer: libFuzzerpcre2fuzzer Fuzzer binary: pcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash...

fontconfig security and bug fix update

2.10.95-10 - Fix a regression in the previous change. 1355930 2.10.95-9 - CVE-2016-5384: Validate offsets in cache files properly. 1355930 2.10.95-8 - Update 45-latin.conf to add some hints to fall back for Windows fonts 1073460...

util-linux security, bug fix, and enhancement update

2.23.2-33.0.1 - fix Oracle bug 23001516 - backport lscpu: correct the Virtualization type on Xen DomU PV guest - Reviewed-by: Joe Jin 2.23.2-33 - improve patch for 1007734 libblkid realpaths 2.23.2-32 - improve patch for chrt1 deadline support 1298384 - fix 1007734 - blkid shows devices as...

file: Crash in file_regexec

Project: https://github.com/file/file.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4753516539150336 Target: file Fuzzer: libFuzzerfilemagicfuzzer Fuzzer binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

pcre2: Heap-buffer-overflow in manage_callouts

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5299240024670208 Target: pcre2 Fuzzer: libFuzzerpcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x622000001458...

CVE-2016-9115

Heap Buffer Over-read in function imagetotga of convert.cjp2:942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file...

CVE-2016-6797

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was...

USN-3114-2: nginx regression

USN-3114-1 fixed a vulnerability in nginx. A packaging issue prevented nginx from being reinstalled or upgraded to a subsequent release. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Dawid Golunski discovered that the nginx package incorrectly handl...

Debian DLA-685-2 : libxi regression update

A regression was found in the previous libxi update. An uninitialized pointer could be freed, causing crashes. For Debian 7 'Wheezy', these problems have been fixed in version 2:1.6.1-1+deb7u3. We recommend that you upgrade your libxi packages. NOTE: Tenable Network Security has extracted the...

pcre2: Heap-buffer-overflow in first_significant_code

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5503331300540416 Fuzzer: libFuzzerpcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x614000002bf1 Crash State:...

Debian DLA-674-2 : ghostscript regression update

The update for ghostscript issued as DLA-674-1 caused regressions for certain Postscript document viewers evince, zathura. Updated packages are now available to address this problem. For reference, the original advisory text follows. Several vulnerabilities were discovered in Ghostscript, the GPL...

libchewing: Heap-buffer-overflow in _Inner_InternalSpecialSymbol

Project: https://github.com/chewing/libchewing.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4509892513628160 Fuzzer: libFuzzerchewingrandominitfuzzer Job Type: libfuzzerasanlibchewing Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

Debian DSA-3696-1 : linux - security update (Dirty COW)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2015-8956 It was discovered that missing input sanitising in RFCOMM Bluetooth socket handling may result in denial of service or information leak...

[SECURITY] [DSA 3696-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3696-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3696-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3696-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 19, 2016 https://www.debian.org/security/faq -...