CVE-2020-25580

In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access5 rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored...

CVE-2020-25580

In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access5 rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored...

USN-3685-2 ruby2.0 regression

USN-3685-1 fixed a vulnerability in Ruby. The fix for CVE-2017-0903 introduced a regression in Ruby. This update fixes the problem. Original advisory details: Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discover...

USN-3685-2: Ruby regression

USN-3685-1 fixed a vulnerability in Ruby. The fix for CVE-2017-0903 introduced a regression in Ruby. This update fixes the problem. Original advisory details: Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discover...

jackson-dataformats-binary:SmileFuzzer: Uncaught exception in java.base/java.lang.ClassLoader.defineClass0

Project: https://github.com/FasterXML/jackson-dataformats-binary.git Detailed Report: https://oss-fuzz.com/testcase?key=4648970891689984 Project: jackson-dataformats-binary Fuzzing Engine: libFuzzer Fuzz Target: SmileFuzzer Job Type: libfuzzerasanjackson-dataformats-binary Platform Id: linux Cras...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Dnsmasq regression (USN-4698-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4698-2 advisory. USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced regressions in certain environments related to issues with multiple...

Ubuntu 16.04 LTS / 18.04 LTS : Python regression (USN-4754-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4754-2 advisory. USN-4754-1 fixed a vulnerability in Python. The fix for CVE-2021-3177 introduced a regression in Python 2.7. This update reverts the security fix...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU regression (USN-4467-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4467-3 advisory. USN-4467-1 fixed vulnerabilities in QEMU. The fix for CVE-2020-13754 introduced a regression in certain environments. This update fixes th...

[SECURITY] [DLA 2558-2] xterm regression update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2558-2 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 21, 2021 https://wiki.debian.org/LTS -...

DLA-2558-2 xterm - regression update

Bulletin has no description...

hostap:eap-sim-peer: Use-of-uninitialized-value in eap_sim_anonymous_username

Detailed Report: https://oss-fuzz.com/testcase?key=4575885245153280 Project: hostap Fuzzing Engine: libFuzzer Fuzz Target: eap-sim-peer Job Type: libfuzzermsanhostap Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: eapsimanonymoususername eapsimresponsestart...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in sc_pkcs15emu_oberthur_add_pubkey

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=6547732351287296 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

ffmpeg:ffmpeg_IO_DEMUXER_fuzzer: Heap-use-after-free in buffer_replace

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4512973109460992 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegIODEMUXERfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

undertow: Possible regression in fix for CVE-2020-10687

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

undertow: Possible regression in fix for CVE-2020-10687

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

undertow: Possible regression in fix for CVE-2020-10687

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

[SECURITY] [DLA 2589-2] mupdf regression update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2589-2 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 14, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2589-2 : mupdf regression update

DLA 2589-1 incorrectly fixed CVE-2020-26519 and also induced regression where opening a PDF document resulted in a SIGFPE crash, a floating point exception. For Debian 9 stretch, this problem has been fixed in version 1.9a+ds1-4+deb9u7. We recommend that you upgrade your mupdf packages. For the...

serenity:FuzzJs: Crash in _fini

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5137929572843520 Project: serenity Fuzzing Engine: honggfuzz Fuzz Target: FuzzJs Job Type: honggfuzzasanserenity Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000ca0a70 Crash...

CVE-2021-21378 JWT authentication bypass with unknown issuer token

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...