USN-5168-4 nss regression

USN-5168-3 fixed a vulnerability in NSS. Unfortunately that update introduced a regression that could break SSL connections. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS...

Security update for singularity (moderate)

openSUSE Security Update: Security update for singularity Announcement ID: openSUSE-SU-2021:1525-1 Rating: moderate References: 1193273 Cross-References: CVE-2021-41190 CVSS scores: CVE-2021-41190 NVD : 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in wc_AesFeedbackEncrypt

Detailed Report: https://oss-fuzz.com/testcase?key=6403335941390336 Project: wolfssl Fuzzing Engine: honggfuzz Fuzz Target: cryptofuzz-openssl-api Job Type: honggfuzzasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x7f44bc7f47f6 Crash State:...

assimp:assimp_fuzzer: Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5242673804476416 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x6080000006f...

wasm3:fuzzer: Index-out-of-bounds in Pop

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=6471071226789888 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerubsanwasm3 Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: Pop...

apache-httpd:fuzz_utils: Heap-buffer-overflow in ap_is_chunked

Detailed Report: https://oss-fuzz.com/testcase?key=5280754897125376 Project: apache-httpd Fuzzing Engine: afl Fuzz Target: fuzzutils Job Type: aflasanapache-httpd Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60700003b65f Crash State: apischunked fuzzutils.c Sanitize...

[SECURITY] [DLA 2823-2] salt regression update

Debian LTS Advisory DLA-2823-2 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 21, 2021 https://wiki.debian.org/LTS Package : salt Version : 2016.11.2+ds-1+deb9u9 CVE ID : CVE-2021-21996 Debian Bug : 1000265 The security update of Salt, a remote execution...

DLA-2823-2 salt - regression update

Bulletin has no description...

libvips:pngsave_buffer_fuzzer: Crash in void jxl::CopyImageTo<int>

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=4743583874285568 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: pngsavebufferfuzzer Job Type: libfuzzerubsanlibvips Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000005540050...

SUSE: Security Advisory (SUSE-SU-2021:3662-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openssl security and bug fix update

1:1.1.1k-4 - Fixes bugs in s390x AES code. - Uses the first detected address family if IPv6 is not available - Reverts the changes in https://github.com/openssl/openssl/pull/13305 as it introduces a regression if server has a DSA key pair, the handshake fails when the protocol is not explicitly s...

CVE-2021-42382

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvars function...

CVE-2021-42378

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvari function...

openSUSE: Security Advisory for the (openSUSE-SU-2021:3655-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

php:php-fuzz-tracing-jit: Heap-buffer-overflow in emit_live_range

Detailed Report: https://oss-fuzz.com/testcase?key=5389752107401216 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-tracing-jit Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61200001623d Crash State: emitliverange...

SUSE: Security Advisory (SUSE-SU-2021:3647-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Firefox Security Advisory (MFSA2012-89) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

httpd: Unexpected URL matching with 'MergeSlashes OFF'

A flaw was found in Apache httpd. A possible regression from an earlier security fix broke behavior of MergeSlashes. The highest threat from this vulnerability is to data integrity...

httpd: Unexpected URL matching with 'MergeSlashes OFF'

A flaw was found in Apache httpd. A possible regression from an earlier security fix broke behavior of MergeSlashes. The highest threat from this vulnerability is to data integrity...

httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be...