quickjs:fuzz_compile: Heap-buffer-overflow in js_is_live_code

Project: https://github.com/horhof/quickjs.git https://github.com/bellard/quickjs.git Detailed Report: https://oss-fuzz.com/testcase?key=5378245515935744 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzcompile Job Type: libfuzzerasanquickjs Platform Id: linux Crash Type:...

llvm:clang-objc-fuzzer: Heap-use-after-free in clang::TokenLexer::Lex

Detailed Report: https://oss-fuzz.com/testcase?key=5807734555279360 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-objc-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-use-after-free READ Crash Address: 0x628000005ff0 Crash State: clang::TokenLexer::Lex...

libavc:svc_dec_fuzzer: Segv on unknown address in isvcd_compute_bs_non_mbaff_target_lyr_no_inter_layer

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=5239743105073152 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: svcdecfuzzer Job Type: libfuzzermsanlibavc Platform Id: linux...

ruby:fuzz_ruby_gems: Use-after-poison in rb_obj_freeze_inline

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5691468706349056 Project: ruby Fuzzing Engine: honggfuzz Fuzz Target: fuzzrubygems Job Type: honggfuzzasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x7fffc3dada20 Crash...

mupdf:pdf_fuzzer: Use-of-uninitialized-value in svg_parse_viewbox

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5561869313900544 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

USN-6508-2 poppler regression

USN-6508-1 fixed vulnerabilities in poppler. The update introduced one minor regression in Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or a...

USN-6508-2: poppler regression

USN-6508-1 fixed vulnerabilities in poppler. The update introduced one minor regression in Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or a...

Ubuntu 18.04 ESM : poppler regression (USN-6508-2)

The remote Ubuntu 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6508-2 advisory. USN-6508-1 fixed vulnerabilities in poppler. The update introduced one minor regression in Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the...

libavc:svc_dec_fuzzer: Index-out-of-bounds in isvcd_interlyr_motion_mode_pred

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=6550615379279872 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: svcdecfuzzer Job Type: libfuzzerubsanlibavc Platform Id: linux...

USN-6449-2: FFmpeg regression

USN-6449-1 fixed vulnerabilities in FFmpeg. Unfortunately that update could introduce a regression in tools using an FFmpeg library, like VLC. This updated fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that FFmpeg incorrectly managed memory...

Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : FFmpeg regression (USN-6449-2)

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6449-2 advisory. USN-6449-1 fixed vulnerabilities in FFmpeg. Unfortunately that update could introduce a regression in tools using an FFmpeg library, like...

kernel: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsiunregisterconnectors" The recent commit 87d0e2f41b8c "usb: typec: ucsi: add a common function ucsiunregisterconnectors" introduced a regression that caused NULL dereference at...

njs:njs_process_script_fuzzer: Stack-buffer-overflow in njs_string_new

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5395491634151424 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7ffda3ce9de0 Cras...

pcs

0.11.6-3 - Refreshing any page in pcs-web-ui no longer causes it to display a blank page - Resolves: rhbz2222788 0.11.6-2 - Added BuildRequires: debugedit - for generating MiniDebugInfo - triggered by removing find-debuginfo.sh from rpm - Make use of filters when extracting tarballs to enhance...

libssh security update

0.10.4-11 - Fix loglevel regression - Related: rhbz2182252, rhbz2189740 0.10.4.10 - Fix null dereference issues found by covscan - Related: rhbz2182252, rhbz2189740 0.10.4-9 - Fix CVE-2023-1667 and CVE-2023-2283 - Fix issues found by cosvcan - Resolves: rhbz2182252, rhbz2189740...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=6681658295975936 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

Debian: Security Advisory (DLA-3647-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

apache-poi:POIHDGFFuzzer: Security exception in org.apache.poi.util.LZWDecompresser.decompress

Detailed Report: https://oss-fuzz.com/testcase?key=4610790942179328 Project: apache-poi Fuzzing Engine: libFuzzer Fuzz Target: POIHDGFFuzzer Job Type: libfuzzerasanapache-poi Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.poi.util.LZWDecompresser.decompre...

Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2021:1064)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1064 advisory. - It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 https://access.redhat.com/errata/RHSA-2020:4676 erratum released as part of Re...

SUSE CVE-2023-5625

A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products...