GHSA-25MX-2MXM-6343 @keystone-6/core's NODE_ENV defaults to development with esbuild

Impact @keystone-6/[email protected] || 3.0.1 users that use NODEENV in their own code not dependencies to trigger security-sensitive functionality in a production build are vulnerable to NODEENV being inlined to "development" for user code. If your dependencies use NODEENV to trigger particular...

jsign:AuthenticodeExeSignerFuzzer: Security exception in net.jsign.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/ebourg/jsign.git Detailed Report: https://oss-fuzz.com/testcase?key=6276093556686848 Project: jsign Fuzzing Engine: libFuzzer Fuzz Target: AuthenticodeExeSignerFuzzer Job Type: libfuzzerasanjsign Platform Id: linux Crash Type: Security exception Crash Address: Crash...

CVE-2022-39382 NODE_ENV in Keystone defaults to development with esbuild

Keystone is a headless CMS for Node.js — built with GraphQL and React.@keystone-6/[email protected] || 3.0.1 users that use NODEENV to trigger security-sensitive functionality in their production builds are vulnerable to NODEENV being inlined to "development" for user code, irrespective of what your...

libreoffice:fodtfuzzer: Bad-cast to SwXMLImport from SvXMLImport in XMLRedlineImportHelper::~XMLRedlineImportHelper

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5207260989358080 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: fodtfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address:...

javaparser:parseFuzzer: Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6445563742912512 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

wireshark:fuzzshark_ip: Heap-buffer-overflow in g_strchug

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed Report: https://oss-fuzz.com/testcase?key=6197332970700800 Project: wireshark Fuzzing Engine: afl Fuzz Target: fuzzsharkip Job Type: aflasanwireshark Platform Id: linux Crash Type:...

libraw:libraw_nef_fuzzer: Index-out-of-bounds in DHT::get_hv_rbg

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=5436677686689792 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawneffuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

clickhouse:codegen_select_fuzzer: Heap-buffer-overflow in DB::PositionLayer::getResult

Project: https://github.com/ClickHouse/ClickHouse.git Detailed Report: https://oss-fuzz.com/testcase?key=6666233642876928 Project: clickhouse Fuzzing Engine: libFuzzer Fuzz Target: codegenselectfuzzer Job Type: libfuzzerasanclickhouse Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Cra...

DL1 bug fix and enhancement update

An update is available for ipa, python-jwcrypto, custodia, bind-dyndb-ldap, python-qrcode, softhsm, slapi-nis, python-yubico, python-kdcproxy, opendnssec, ipa-healthcheck, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

jackson-databind:AdaLObjectReader3Fuzzer: Security exception in jaz.Zer.<clinit>

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6143851438145536 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: AdaLObjectReader3Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security...

libraw:libraw_nef_fuzzer: Heap-buffer-overflow in LibRaw::raw2image

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=4791870991761408 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawneffuzzer Job Type: libfuzzerasanlibraw Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

[SECURITY] [DSA 5257-2] linux regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-5257-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 23, 2022 https://www.debian.org/security/faq -...

DSA-5257-2 linux - regression update

Bulletin has no description...

libraw:libraw_nef_fuzzer: Use-of-uninitialized-value in LibRaw::copy_bayer

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=4847494261768192 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawneffuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

curl:curl_fuzzer_http: Stack-buffer-overflow in Curl_output_aws_sigv4

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5950791701889024 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerhttp Job Type: libfuzzerasani386curl Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0xffc44cc5...

fluent-bit:flb-it-fuzz-config_random_fuzzer_OSSFUZZ: Heap-buffer-overflow in flb_parser_create

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5432516900683776 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-configrandomfuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type:...

libucl:ucl_add_string_fuzzer: Heap-buffer-overflow in ucl_object_dtor_unref_single

Detailed Report: https://oss-fuzz.com/testcase?key=6392662953689088 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerasanlibucl Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6110000856c0 Crash State: uclobjectdtorunrefsingl...

binutils:fuzz_objdump_safe: Heap-buffer-overflow in bfd_getl32

Detailed Report: https://oss-fuzz.com/testcase?key=5277269610594304 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzobjdumpsafe Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000000f4 Crash State: bfdgetl32...

CVE-2022-3275

Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise...

sleuthkit:sleuthkit_fls_ntfs_fuzzer: Memcpy-param-overlap in tsk_fs_load_file_action

Detailed Report: https://oss-fuzz.com/testcase?key=5736382060691456 Project: sleuthkit Fuzzing Engine: afl Fuzz Target: sleuthkitflsntfsfuzzer Job Type: aflasansleuthkit Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address: 0x000000000000,0xffffffff00000080 and 0x621000003d00,...