apache-commons-codec:PhoneticEngineFuzzer: Security exception in org.apache.commons.codec.language.bm.Rule$Phoneme.<init>

Detailed Report: https://oss-fuzz.com/testcase?key=4557039046557696 Project: apache-commons-codec Fuzzing Engine: libFuzzer Fuzz Target: PhoneticEngineFuzzer Job Type: libfuzzerasanapache-commons-codec Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

jq:jq_fuzz_execute: Heap-buffer-overflow in jv_string_vfmt

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=6491909097324544 Project: jq Fuzzing Engine: afl Fuzz Target: jqfuzzexecute Job Type: aflasanjq Platform Id: linux Crash Type: Heap-buffer-overflow READ 13 Crash Address: 0x503000258291 Crash State:...

httpd security update

2.4.62-1.0.1 - Replace index.html with Oracle's index page oracleindex.html. 2.4.62-1 - new version 2.4.62 - Resolves: RHEL-52724 - Regression introduced by CVE-2024-38474 fix 2.4.59-7 - Resolves: RHEL-49856: htcacheclean.service missing Install section 2.4.59-6 - modssl: restore SSLOPNORENEGOTIA...

xorg-x11-server security update

1.20.11-26 - Fix regression caused by the fix for CVE-2024-31083 1.20.11-25 - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Fix compilation error on i686...

4 bug fix and enhancement update

An update is available for module.squid, squid, libecap, module.libecap. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Squid is a high-performance proxy cachin...

qpdf:future_qpdf_crypt_insecure_fuzzer: Heap-buffer-overflow in rijndaelSetupEncrypt

Project: https://github.com/qpdf/qpdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5970853830918144 Project: qpdf Fuzzing Engine: libFuzzer Fuzz Target: futureqpdfcryptinsecurefuzzer Job Type: libfuzzerasanqpdf Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer: Index-out-of-bounds in read_sbr_invf

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5167109774049280 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAACLATMfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

USN-6882-2 cinder regression

USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to incorrect privilege handling. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Martin Kaesberger discovered that Cinder incorrectly handled QCOW2...

CVE-2024-50140 sched/core: Disable page allocation in task_tick_mm_cid()

In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in tasktickmmcid With KASAN and PREEMPTRT enabled, calling taskworkadd in tasktickmmcid may cause the following splat. 63.696416 BUG: sleeping function called from invalid context at...

CVE-2024-50140

CVE-2024-50140 involves a Linux kernel vulnerability in sched/core where page allocation is disabled during task_tick_mm_cid(). With KASAN and PREEMPT_RT enabled, a call to task_work_add() within task_tick_mm_cid() can sleep in an invalid context, triggering a BUG in stack/depot and related alloc...

CVE-2024-50140 sched/core: Disable page allocation in task_tick_mm_cid()

In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in tasktickmmcid With KASAN and PREEMPTRT enabled, calling taskworkadd in tasktickmmcid may cause the following splat. 63.696416 BUG: sleeping function called from invalid context at...

imagemagick:encoder_jxl_fuzzer: Use-of-uninitialized-value in GetPixelIntensity

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5162477567934464 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderjxlfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

llamacpp:fuzz_tokenizer_command_r: Crash in llama_output_reserve

Detailed Report: https://oss-fuzz.com/testcase?key=6195577928351744 Project: llamacpp Fuzzing Engine: libFuzzer Fuzz Target: fuzztokenizercommandr Job Type: libfuzzerubsanllamacpp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffdf8 Crash State: llamaoutputreserve...

pcre2:pcre2_fuzzer_16: Stack-buffer-overflow in _pcre2_compile_class_not_nested_16

Project: svn://vcs.exim.org/pcre2/code/trunk https://github.com/PCRE2Project/pcre2.git Detailed Report: https://oss-fuzz.com/testcase?key=5774225949917184 Project: pcre2 Fuzzing Engine: libFuzzer Fuzz Target: pcre2fuzzer16 Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type:...

file:magic_fuzzer_loaddb: Heap-buffer-overflow in load_1

Project: https://github.com/file/file.git Detailed Report: https://oss-fuzz.com/testcase?key=4840976908615680 Project: file Fuzzing Engine: libFuzzer Fuzz Target: magicfuzzerloaddb Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60c000000478...

ghostscript:gs_device_eps2write_fuzzer: Crash in s_DCTD_process

Detailed Report: https://oss-fuzz.com/testcase?key=4830647133732864 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdeviceeps2writefuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x50007fff8000 Crash State: sDCTDprocess sreadbuf...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in residual_coding

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5115519029542912 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

jackson-databind:ObjectReaderRandomClassFuzzer: Security exception in com.github.javaparser.GeneratedJavaParser.jj_3R_349

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=4887500345114624 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReaderRandomClassFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type:...

Fortinet FortiWeb OpenSSH regreSSHion Attack (CVE-2024-6387) (FG-IR-24-258)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-258 advisory. - A race condition in sshd affecting versions between 8.5p1 and 9.7p1 inclusive may allow arbitrary code execution with root...

Security update for python-pyOpenSSL

This update for python-pyOpenSSL fixes the following issues: Fixed error caused by a regression in fix for CVE-2018-1000807 bsc1231700 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run...