[SECURITY] [DSA 5734-2] bind9 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-5734-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 27, 2024 https://www.debian.org/security/faq -...

ffmpeg:ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer: Index-out-of-bounds in dequant_scalefactors

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4741427068731392 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAACLATMfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

DSA-5734-2 bind9 - regression update

Bulletin has no description...

Critical Docker Engine Flaw Allows Attackers to Bypass Authorization Plugins

Docker is warning of a critical flaw impacting certain versions of Docker Engine that could allow an attacker to sidestep authorization plugins AuthZ under specific circumstances. Tracked as CVE-2024-41110, the bypass and privilege escalation vulnerability carries a CVSS score of 10.0, indicating...

USN-6851-2: Netplan regression | Cloud Foundry

Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description USN-6851-1 fixed vulnerabilities in Netplan. The update lead to the discovery of a regression in netplan which caused systemctl enable to fail on systems where systemd is not running. This update fixes t...

UBUNTU-CVE-2024-41110

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins AuthZ under specific circumstances. The base likelihood of this being...

CVE-2024-41110 Moby authz zero length regression

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins AuthZ under specific circumstances. The base likelihood of this being...

CVE-2024-41110 Moby authz zero length regression

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins AuthZ under specific circumstances. The base likelihood of this being...

ffmpeg:ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer: Heap-buffer-overflow in adpcm_decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4814907107770368 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDADPCMDTKfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Addres...

matio:matio_fuzzer: Index-out-of-bounds in inflateCopy

Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=6239205672419328 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzerubsanmatio Platform Id: linux Crash Type: Index-out-of-bounds Cra...

SUSE-SU-2024:2574-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: Update to 20.15.1: - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass bsc1227560 - CVE-2024-22020: Fixed a bypass of network import restriction via data URL bsc1227554 - CVE-2024-22018: Fixed fs.lstat bypasses permission model bsc1227562 -...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::NflogLayer::parseNextLayer

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=4799975268089856 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_SNOW_fuzzer: Crash in ff_sad16_mmxext

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5751882631413760 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDSNOWfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x780b5e03d00a...

jackson-dataformats-text:DeserializerFuzzer: Security exception in com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize

Detailed Report: https://oss-fuzz.com/testcase?key=5141355676893184 Project: jackson-dataformats-text Fuzzing Engine: libFuzzer Fuzz Target: DeserializerFuzzer Job Type: libfuzzerasanjackson-dataformats-text Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

mupdf:pdf_fuzzer: Heap-buffer-overflow in pdf_show_path

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5331792253485056 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzerasanmupdf Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x51e000000a08...

inchi:inchi_input_fuzzer: Invalid-free in Create_INChI

Project: https://github.com/IUPAC-InChI/InChI.git Detailed Report: https://oss-fuzz.com/testcase?key=4573150998757376 Project: inchi Fuzzing Engine: libFuzzer Fuzz Target: inchiinputfuzzer Job Type: libfuzzerasaninchi Platform Id: linux Crash Type: Invalid-free Crash Address: 0x5070000003a1 Crash...

SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2024:2496-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2496-1 advisory. Update to 18.20.4: - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass bsc1227560 - CVE-2024-22020: Fixed a bypass of network import...

SUSE CVE-2024-40992

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently droppe...

SUSE-SU-2024:2463-1 Security update for squashfs

This update for squashfs fixes the following issues: - CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools bsc935380 - CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination bsc1189936 - CVE-2021-41072: Fixed an issu...

CVE-2024-40992

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently droppe...