USN-5810-2 git regression

USN-5810-1 fixed vulnerabilities in Git. This update introduced a regression as it was missing some commit lines. This update fixes the problem. Original advisory details: Markus Vervier and Eric Sesterhenn discovered that Git incorrectly handled certain gitattributes. An attacker could possibly...

USN-5810-2: Git regression

USN-5810-1 fixed vulnerabilities in Git. This update introduced a regression as it was missing some commit lines. This update fixes the problem. Original advisory details: Markus Vervier and Eric Sesterhenn discovered that Git incorrectly handled certain gitattributes. An attacker could possibly...

USN-5745-2: shadow regression | Cloud Foundry

usn-5745-2 Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description USN-5745-1 fixed vulnerabilities in shadow. Unfortunately that update introduced a regression that caused useradd to behave incorrectly in Ubuntu 14.04 ESM, Ubuntu 16.04...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.0 packages and security update

Red Hat OpenShift Container Platform release 4.12.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

envoy:filter_fuzz_test: Heap-use-after-free in absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPoli

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5721117677715456 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: filterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 16 Crash Address:...

libplist:oplist_fuzzer: Heap-buffer-overflow in parse_skip_ws

Project: https://github.com/libimobiledevice/libplist.git Detailed Report: https://oss-fuzz.com/testcase?key=4503815405830144 Project: libplist Fuzzing Engine: afl Fuzz Target: oplistfuzzer Job Type: aflasanlibplist Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

kernel security and bug fix update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...

RXSA-2023:0101 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: memory corruption in AX88179178A based USB ethernet device. CVE-2022-2964 kernel: i915: Incorrect GPU TLB flush can lead to random memory access CVE-2022-4139 For more details about the...

systemd:fuzz-unit-file: Heap-double-free in open_file_parse

Project: https://github.com/systemd/systemd.git Detailed Report: https://oss-fuzz.com/testcase?key=6406146447769600 Project: systemd Fuzzing Engine: honggfuzz Fuzz Target: fuzz-unit-file Job Type: honggfuzzasansystemd Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x606000000560...

Ubuntu: Security Advisory (USN-5782-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AZL-12951 CVE-2022-2196 affecting package kernel for versions less than 5.15.102.1-1

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM L0 advertising eIBRS support to L1. An attacker at L2 with code...

clamav:clamav_dbload_CDB_fuzzer: Memcpy-param-overlap in repeat

Detailed Report: https://oss-fuzz.com/testcase?key=5048191626379264 Project: clamav Fuzzing Engine: libFuzzer Fuzz Target: clamavdbloadCDBfuzzer Job Type: libfuzzerasanclamav Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address: 0x7f95860aa728,0x7f958c333d68 and 0x7f957fe210f0,...

gstreamer:typefind: Heap-buffer-overflow in xml_check_first_element_from_data

Project: https://anongit.freedesktop.org/git/gstreamer/gstreamer https://gitlab.freedesktop.org/gstreamer/gstreamer.git Detailed Report: https://oss-fuzz.com/testcase?key=6728402927484928 Project: gstreamer Fuzzing Engine: libFuzzer Fuzz Target: typefind Job Type: libfuzzerasangstreamer Platform...

wireshark:fuzzshark_ip_proto-udp: Heap-buffer-overflow in get_utf_8_string

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed Report: https://oss-fuzz.com/testcase?key=5647364243456000 Project: wireshark Fuzzing Engine: libFuzzer Fuzz Target: fuzzsharkipproto-udp Job Type: libfuzzerasanwireshark Platform Id: linux...

cryptsetup:crypt2_load_ondisk_fuzz: Heap-buffer-overflow in BITLK_read_sb

Project: https://gitlab.com/cryptsetup/cryptsetup.git Detailed Report: https://oss-fuzz.com/testcase?key=5617030802046976 Project: cryptsetup Fuzzing Engine: afl Fuzz Target: crypt2loadondiskfuzz Job Type: aflasancryptsetup Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

pig-vector 安全漏洞

pig-vector is a library from the individual developer Ted Dunning. It provides the ability to encode data in Pig using Mahout's hash encoding capabilities. A security vulnerability exists in pig-vector that stems from the LogisticRegression function in its...

CVE-2022-4641 pig-vector LogisticRegression.java LogisticRegression temp file

A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. T...

SilverStripe Subsite weakens file permissions

The subsites module can weaken edit restrictions on some files and allow a malicious user to edit files they do not have edit rights to. This only affects projects with the subsites module installed. Regression testing should focus on custom file logic. Be advised that this is not a case of a use...

assimp:assimp_fuzzer: Heap-buffer-overflow in Assimp::ObjFileParser::getFace

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5781186265350144 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow READ 3 Crash Address:...

vlc:vlc-demux-dec-libfuzzer: Crash in var_GetChecked

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=5489427306905600 Project: vlc Fuzzing Engine: libFuzzer Fuzz Target: vlc-demux-dec-libfuzzer Job Type: libfuzzerubsanvlc Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffff00000008...