libredwg:llvmfuzz: Heap-double-free in dwg_free

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4929759633342464 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x604000000050 Cra...

Oracle Linux 8 : device-mapper-multipath (ELSA-2022-7928)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7928 advisory. 0.8.4-28.1 - Add 0111-multipathd-ignore-duplicated-multipathd-command-keys.patch - Resolves: bz 2133995 Tenable has extracted the preceding description block...

device-mapper-multipath: Regression of CVE-2022-41974 fix in Red Hat Enterprise Linux

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

GSD-2022-1007441 regulator: qcom_rpm: Fix circular deferral regression

regulator: qcomrpm: Fix circular deferral regression This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit...

GSD-2022-1006666 squashfs: fix read regression introduced in readahead code

squashfs: fix read regression introduced in readahead code This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.7 by commit...

device-mapper-multipath: Regression of CVE-2022-41974 fix in Red Hat Enterprise Linux

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

PT-2022-35168 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to a circular deferral regression in the qcom rpm regulator. It was introduced in version v4.1 and fixed in Linux Kernel version v6.0.3. The actual impact and attack...

PT-2022-35696 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.220 Description: The issue is related to a circular deferral regression in the qcom rpm regulator. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-34921

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.7 Description A read regression was introduced in the readahead code of squashfs. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v6.0.7...

PT-2022-35793 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.262 Description: The issue is related to a circular deferral regression in the qcom rpm regulator. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-35927

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.331 Description The issue is related to a circular deferral regression in the qcom rpm regulator. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-35399

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.1 through 5.15.74 Description The issue is related to a circular deferral regression in the qcom rpm regulator. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versio...

PT-2022-35087

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.3 Description The issue is related to the ASoC: wcd-mbhc-v2 component in the Linux Kernel. It involves the reverting of a change that used pm runtime resume and get. The actual impact and attack plausibility...

fluent-bit:flb-it-fuzz-filter_stdout_fuzzer_OSSFUZZ: Heap-use-after-free in output_thread

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=6379291046969344 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-filterstdoutfuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type: Heap-use-after-fr...

mruby:mruby_fuzzer: Index-out-of-bounds in str_init_embed

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=6279993986777088 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzerubsanmruby Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: strinitemb...

libraw:libraw_nef_fuzzer: Index-out-of-bounds in DHT::get_hv_rbg

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=5798324217446400 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawneffuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

clickhouse:codegen_select_fuzzer: Container-overflow in std::__1::shared_ptr<DB::ASTFunction> DB::makeASTFunction<std::__1::shared_ptr<D

Project: https://github.com/ClickHouse/ClickHouse.git Detailed Report: https://oss-fuzz.com/testcase?key=5496872961966080 Project: clickhouse Fuzzing Engine: libFuzzer Fuzz Target: codegenselectfuzzer Job Type: libfuzzerasanclickhouse Platform Id: linux Crash Type: Container-overflow READ 8 Crash...

javaparser:parseFuzzer: Security exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=5403484518481920 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

@keystone-6/core's NODE_ENV defaults to development with esbuild

Impact @keystone-6/[email protected] || 3.0.1 users that use NODEENV in their own code not dependencies to trigger security-sensitive functionality in a production build are vulnerable to NODEENV being inlined to "development" for user code. If your dependencies use NODEENV to trigger particular...

GHSA-25MX-2MXM-6343 @keystone-6/core's NODE_ENV defaults to development with esbuild

Impact @keystone-6/[email protected] || 3.0.1 users that use NODEENV in their own code not dependencies to trigger security-sensitive functionality in a production build are vulnerable to NODEENV being inlined to "development" for user code. If your dependencies use NODEENV to trigger particular...