[SECURITY] Fedora 33 Update: libspf2-1.2.11-1.20210922git4915c308.fc33

libspf2 is an implementation of the SPF Sender Policy Framework specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is...

USN-5090-4: Apache HTTP Server regression

USN-5090-1 fixed vulnerabilities in Apache HTTP Server. One of the upstream fixes introduced a regression in UDS URIs. This update fixes the problem. Original advisory details: James Kettle discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain crafted methods. A remote...

USN-5090-4 apache2 regression

USN-5090-1 fixed vulnerabilities in Apache HTTP Server. One of the upstream fixes introduced a regression in UDS URIs. This update fixes the problem. Original advisory details: James Kettle discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain crafted methods. A remote...

matio:matio_fuzzer: Use-of-uninitialized-value in Mat_VarRead5

Project: git://git.code.sf.net/p/matio/matio Detailed Report: https://oss-fuzz.com/testcase?key=5931846061916160 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzermsanmatio Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

USN-5079-4: curl regression

USN-5079-2 fixed vulnerabilities in curl. One of the fixes introduced a regression. This update fixes the problem. Original advisory details: Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS. When receiving certain responses from servers, curl would continue without TLS...

USN-5079-4 curl regression

USN-5079-2 fixed vulnerabilities in curl. One of the fixes introduced a regression. This update fixes the problem. Original advisory details: Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS. When receiving certain responses from servers, curl would continue without TLS...

Ubuntu 16.04 ESM : curl regression (USN-5079-4)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5079-4 advisory. USN-5079-2 fixed vulnerabilities in curl. One of the fixes introduced a regression. This update fixes the problem. Tenable has extracted the preceding description...

Security update for php-composer (important)

openSUSE Security Update: Security update for php-composer Announcement ID: openSUSE-SU-2021:1289-1 Rating: important References: 1185376 1187416 Cross-References: CVE-2021-29472 CVSS scores: CVE-2021-29472 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15...

geos:fuzz_geo2: Heap-buffer-overflow in geos::operation::valid::PolygonNode::isInteriorSegment

Detailed Report: https://oss-fuzz.com/testcase?key=4556990727192576 Project: geos Fuzzing Engine: afl Fuzz Target: fuzzgeo2 Job Type: aflasangeos Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60d0000a1e40 Crash State:...

flatbuffers:parser_fuzzer: Use-of-uninitialized-value in std::__1::__tree_node_base<void*>*& std::__1::__tree<std::__1::__value_type<std:

Project: https://github.com/google/flatbuffers.git Detailed Report: https://oss-fuzz.com/testcase?key=5169016704991232 Project: flatbuffers Fuzzing Engine: libFuzzer Fuzz Target: parserfuzzer Job Type: libfuzzermsanflatbuffers Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Addres...

s2geometry:s2_fuzzer: Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

Project: https://github.com/google/s2geometry.git Detailed Report: https://oss-fuzz.com/testcase?key=4621152295714816 Project: s2geometry Fuzzing Engine: libFuzzer Fuzz Target: s2fuzzer Job Type: libfuzzermsans2geometry Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

libarchive:libarchive_fuzzer: Crash in liblzma.so.5

Project: https://github.com/libarchive/libarchive.git Detailed Report: https://oss-fuzz.com/testcase?key=6716998885703680 Project: libarchive Fuzzing Engine: libFuzzer Fuzz Target: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

Unbreakable Enterprise kernel-container security update

5.4.17-2102.205.7.2.el7 - btrfs: fix race between marking inode needs to be logged and log syncing Filipe Manana Orabug: 33349276 5.4.17-2102.205.7.1 - RDMA/cma: Revert INIT-INIT patch Mike Marciniszyn Orabug: 33306518 5.4.17-2102.205.7 - rds: ib: Set SENDSIGNALED on the last WR posted Hakon Bugg...

zxing:MultiFormatDecodeFuzzer: Uncaught exception with empty stacktrace

Project: https://github.com/zxing/zxing.git Detailed Report: https://oss-fuzz.com/testcase?key=6530044529344512 Project: zxing Fuzzing Engine: libFuzzer Fuzz Target: MultiFormatDecodeFuzzer Job Type: libfuzzerasanzxing Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

kimageformats:kimgio_heif_fuzzer: Index-out-of-bounds in video_usability_information::hrd_parameters

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=6088349555752960 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioheiffuzzer Job Type: libfuzzerubsankimageformats Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

zstd:simple_compress: Heap-buffer-overflow in FSE_writeNCount_generic

Project: https://github.com/facebook/zstd.git Detailed Report: https://oss-fuzz.com/testcase?key=5377998337998848 Project: zstd Fuzzing Engine: libFuzzer Fuzz Target: simplecompress Job Type: libfuzzerasanzstd Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x61b0000006...

libucl:ucl_add_string_fuzzer: Heap-buffer-overflow in ucl_object_dtor_unref_single

Detailed Report: https://oss-fuzz.com/testcase?key=5338829913980928 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerasanlibucl Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x603000000200 Crash State: uclobjectdtorunrefsingl...

[SECURITY] [DLA 2753-2] qemu regression update

Debian LTS Advisory DLA-2753-2 [email protected] https://www.debian.org/lts/security/ Markus Koschany September 11, 2021 https://wiki.debian.org/LTS Package : qemu Version : 1:2.8+dfsg-6+deb9u16 CVE ID : CVE-2021-3592 Debian Bug : 994080 It was found that the patch for CVE-2021-3592...

libavc:avc_dec_fuzzer: Heap-buffer-overflow in ih264d_parse_decode_slice

Project: https://android.googlesource.com/platform/external/libavc Detailed Report: https://oss-fuzz.com/testcase?key=5561011122339840 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: avcdecfuzzer Job Type: libfuzzerasani386libavc Platform Id: linux Crash Type: Heap-buffer-overflow READ 4...

wolfmqtt:wolfmqtt-fuzzer: Index-out-of-bounds in MqttEncode_Props

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=6008660036288512 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzerubsanwolfmqtt Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...