CVE-2021-20325

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be...

CVE-2021-20325: Improper Restriction of Operations within the Bounds of a Memory Buffer

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be...

icu:ucasemap_fuzzer: Heap-buffer-overflow in ucasemap_internalUTF8ToTitle_70

Project: https://github.com/unicode-org/icu.git Detailed Report: https://oss-fuzz.com/testcase?key=6265389456162816 Project: icu Fuzzing Engine: libFuzzer Fuzz Target: ucasemapfuzzer Job Type: libfuzzerasanicu Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000000f...

[SECURITY] [DLA-2925-1] drupal7 security update

Package : drupal7 Version : 7.52-2+deb9u18 This security updates includes two fixes, backported respectively from Drupal version 7.87 and 7.88: - Fix a regression caused by Query ui position backport in version 7.86 backported as 7.52-2+deb9u17: was not checking for possible "undefined" value in...

dnsmasq:fuzz_dhcp6: Heap-use-after-free in dhcp6_no_relay

Detailed Report: https://oss-fuzz.com/testcase?key=6579355701608448 Project: dnsmasq Fuzzing Engine: honggfuzz Fuzz Target: fuzzdhcp6 Job Type: honggfuzzasandnsmasq Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address: 0x60600000029a Crash State: dhcp6norelay dhcp6mayberelay...

USN-5267-2 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4 regression

USN-5267-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a regression that caused the kernel to freeze when accessing CIFS shares in some situations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered...

USN-5267-2: Linux kernel regression

USN-5267-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a regression that caused the kernel to freeze when accessing CIFS shares in some situations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered...

GHSA-WQFH-9M4G-7X6X Remote code execution in Apache ActiveMQ

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a...

USN-4754-5: Python vulnerability

USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a subsequent update removed the fix for CVE-2021-3177. This update reinstates the security fix for CVE-2021-3177 in Ubuntu 14.04 ESM. Original advisory details: It was discovered that Python incorrectly handled certain inputs. A...

USN-4754-5 python2.7 vulnerability

USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a subsequent update removed the fix for CVE-2021-3177. This update reinstates the security fix for CVE-2021-3177 in Ubuntu 14.04 ESM. Original advisory details: It was discovered that Python incorrectly handled certain inputs. A...

rdkit:mol_data_stream_to_mol_fuzzer: Bad-cast to RDKit::Atom from invalid vptr in RDKit::ROMol::initFromOther

Project: https://github.com/rdkit/rdkit.git Detailed Report: https://oss-fuzz.com/testcase?key=6370621397794816 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzerubsanrdkit Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000027f4a50 Crash...

CLSA-2022-1643747448 Fix of CVE: CVE-2021-26690, CVE-2021-30641, CVE-2021-40438

CVE-2021-40438: modproxy: SSRF via a crafted request uri-path - CVE-2021-30641: MergeSlashes regression - CVE-2021-26690: modsession NULL pointer dereference in parser...

SUSE-SU-2022:0286-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2022-22818: Fixed possible XSS via % debug % template tag bsc1195086 - CVE-2022-23833: Fixed denial-of-service possibility in file uploads. bsc1195088 A regression in the fix for CVE-2021-45452 was fixed bsc1194116...

harfbuzz:hb-subset-fuzzer: Heap-use-after-free in hb_bit_set_invertible_t::next

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5751353601818624 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x618000146f...

Unbreakable Enterprise kernel security update

4.1.12-124.60.1 - xfs: map unwritten blocks in XFSIOCALLOC,FREESP just like fallocate Darrick J. Wong Orabug: 33699627 Orabug: 33762471 CVE-2021-4155 - fix regression in 'epoll: Keep a reference on files added to the check list' Al Viro Orabug: 33679854 Orabug: 33762505 CVE-2021-1048 CVE-2021-104...

RLSA-2022:0332 Critical: samba security and bug fix update

Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fixes: samba: Out-of-bounds heap read/write vulnerability in VF...

ALSA-2022:0332 Critical: samba security and bug fix update

Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fixes: samba: Out-of-bounds heap read/write vulnerability in VF...

DSA-5047-2 prosody - regression update

Bulletin has no description...

unicorn:fuzz_emu_arm_arm: Crash in helper_shl_cc_arm

Project: https://github.com/unicorn-engine/unicorn.git Detailed Report: https://oss-fuzz.com/testcase?key=6106953024143360 Project: unicorn Fuzzing Engine: libFuzzer Fuzz Target: fuzzemuarmarm Job Type: libfuzzerasanunicorn Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x000049fd768...

xpdf:fuzz_pdfload: Heap-buffer-overflow in Catalog::getPage

Detailed Report: https://oss-fuzz.com/testcase?key=6735595475435520 Project: xpdf Fuzzing Engine: honggfuzz Fuzz Target: fuzzpdfload Job Type: honggfuzzasanxpdf Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60200001e648 Crash State: Catalog::getPage PDFDoc::getLinks...