libwebp:advanced_api_fuzzer: Negative-size-param in WebPRescalerInit

Detailed Report: https://oss-fuzz.com/testcase?key=5193837222952960 Project: libwebp Fuzzing Engine: afl Fuzz Target: advancedapifuzzer Job Type: aflasanlibwebp Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State: WebPRescalerInit AllocateAndInitRescaler VP8LDecodeImage...

gdal:gdal_fuzzer: Heap-buffer-overflow in GDALTGARasterBand::IReadBlock

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5370967848255488 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000185f3 Crash...

MGASA-2021-0274 Updated gnome-autoar packages fix a security vulnerability

gnome-autoar: directory traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations CVE-2021-28650. Also the previous update Bug 28454 introduced a regression, fixed here...

Updated gnome-autoar packages fix a security vulnerability

gnome-autoar: directory traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations CVE-2021-28650. Also the previous update Bug 28454 introduced a regression, fixed here...

PT-2021-30852

Name of the Vulnerable Software and Affected Versions kernel-linus versions prior to 5.10.45 Description The kernel-linus update contained security fixes that caused regressions in some container and chroot setups. Upstream version 5.10.45 adds follow-up fixes to resolve these regressions and...

tidy-html5:tidy_fuzzer: Heap-buffer-overflow in prvTidyEncodeCharToUTF8Bytes

Detailed Report: https://oss-fuzz.com/testcase?key=5712187765555200 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidyfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x625000002100 Crash State:...

CVE-2021-32697

neos/forms is an open source framework to build web forms. By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form...

CVE-2021-32697 Form validation can be skipped

neos/forms is an open source framework to build web forms. By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form...

SUSE-SU-2021:2106-1 Security update for salt

This update for salt fixes the following issues: Update to Salt release version 3002.2 jscECO-3212, jscSLE-18033, jscSLE-18028 - Check if dpkgnotify is executable bsc1186674 - Drop support for Python2. Obsoletes python2-salt package jscSLE-18028 - virt module updates network: handle missing ipv4...

SUSE SLES15: caribou / caribou-common / caribou-devel / etc (SUSE-SU-2021:2007-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2007-1 advisory. Security issue fixed: - CVE-2021-3567: Fixed a segfault when attempting to use shifted characters bsc1186617. Tenable has extracted the...

imagemagick:encoder_ptif_fuzzer: Use-of-uninitialized-value in AcquireUniqueFileResource

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5738102189588480 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderptiffuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

SUSE: Security Advisory (SUSE-SU-2021:2026-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:2042-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

apache-commons:CompressSevenZFuzzer: Uncaught exception with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6551935141412864 Project: apache-commons Fuzzing Engine: libFuzzer Fuzz Target: CompressSevenZFuzzer Job Type: libfuzzerasanapache-commons Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: NULL Sanitizer: address ASAN...

php:php-fuzz-execute: Heap-use-after-free in zend_fetch_dimension_address_inner

Detailed Report: https://oss-fuzz.com/testcase?key=4890751648530432 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-execute Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x606000011248 Crash State: zendfetchdimensionaddressinner...

[SECURITY] [DLA 2687-2] prosody regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2687-2 [email protected] https://www.debian.org/lts/security/ Anton Gladky June 19, 2021 https://wiki.debian.org/LTS -...

DLA-2687-2 prosody - regression update

Bulletin has no description...

libvips:jpegsave_buffer_fuzzer: Container-overflow in jxl::DefaultSqueezeParameters

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5770078153998336 Project: libvips Fuzzing Engine: honggfuzz Fuzz Target: jpegsavebufferfuzzer Job Type: honggfuzzasanlibvips Platform Id: linux Crash Type: Container-overflow READ 8 Crash Address:...

SUSE-SU-2021:2042-1 Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94138 fixes several issues. The following issues were fixed: - CVE-2021-33034: Fixed a use-after-free when destroying an hcichan. This could lead to writing an arbitrary values bsc1186111. - CVE-2021-32399: Fixed a race condition when removing the HCI...

SUSE-SU-2021:2026-1 Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94144 fixes several issues. The following issues were fixed: - CVE-2021-33034: Fixed a use-after-free when destroying an hcichan. This could lead to writing an arbitrary values bsc1186111. - CVE-2021-28688: Fixed an issue introduced by XSA-365, leaving...