CVE-2023-34981 Apache Tomcat: AJP response header mix-up

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy modproxyajp would use the response heade...

CVE-2023-34981

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy modproxyajp would use the response heade...

Apache Tomcat 10.1.0 < 10.1.9

The version of Tomcat installed on the remote host is prior to 10.1.9. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.9security-10 advisory. - A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a...

CVE-2023-34981: Incorrect Permission Assignment for Critical Resource

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy modproxyajp would use the response heade...

SUSE-SU-2023:29171-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers bsc1211430. - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a...

imagemagick:encoder_psd_fuzzer: Use-of-uninitialized-value in WritePixelCachePixels

Detailed Report: https://oss-fuzz.com/testcase?key=5121250708815872 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderpsdfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: WritePixelCachePixels...

mysql-server:fuzz_initfile: Heap-buffer-overflow in my_casedn_str_utf8mb3

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=4523836947955712 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzinitfile Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=6161718817193984 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

Ubuntu 20.04 LTS : SSSD regression (USN-6156-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6156-2 advisory. USN-6156-1 fixed a vulnerability in SSSD. In certain environments, not all packages ended up being upgraded at the same time, resulting in authentication failures...

USN-6143-2 firefox regressions

USN-6143-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted...

javaparser:parseFuzzer: Security exception in com.github.javaparser.CommentsInserter.insertComments

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=5593402016923648 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

wolfssl:fuzzer-wolfssl-server-randomize: Use-of-uninitialized-value in fuzzer_send

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5869516822544384 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-server-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (GKE) regression (USN-6152-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6152-1 advisory. It was discovered that NFS client's access cache implementation in the Linux kernel caused a severe NFS performance degradation in certain conditions...

USN-6152-1 linux-gke regression

It was discovered that NFS client's access cache implementation in the Linux kernel caused a severe NFS performance degradation in certain conditions. This updated makes the NFS file-access stale cache behavior to be optional...

libxslt:xslt: Global-buffer-overflow in xmlDictLookup

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=5172704131809280 Project: libxslt Fuzzing Engine: honggfuzz Fuzz Target: xslt Job Type: honggfuzzasanlibxslt Platform Id: linux Crash Type: Global-buffer-overflow READ Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer: Heap-buffer-overflow in jpegNUMBER_decode_tile

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5142077915398144 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDJPEG2000fuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer: Crash in ff_put_h264_chroma_mc4_ssse3

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4993004566609920 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDMPEG1VIDEOfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000003c08 Crash...

ffmpeg:ffmpeg_DEMUXER_fuzzer: Crash in jpegxl_anim_probe

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6360142686584832 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegDEMUXERfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xf24e32ac Crash...

binutils:fuzz_nm: Heap-buffer-overflow in _bfd_ecoff_slurp_symbol_table

Detailed Report: https://oss-fuzz.com/testcase?key=5148773215764480 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzznm Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x624000006008 Crash State: bfdecoffslurpsymboltable...

libdwarf:fuzz_set_frame_all: Heap-buffer-overflow in _dwarf_gnu_aug_encodings

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=5867083595120640 Project: libdwarf Fuzzing Engine: afl Fuzz Target: fuzzsetframeall Job Type: aflasanlibdwarf Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...