Debian DLA-1792-2 : cups-filters regression update

The update for ghostscript released as DLA-1792-1 uncovered an issue in cups-filters which was using the undocumented Ghostscript internal 'pdfdict' now hidden in the ghostscript update. Updated cups-filters packages are now available to correct this issue. For Debian 8 'Jessie', this problem has...

harfbuzz/hb-subset-fuzzer: Use-of-uninitialized-value in OT::AxisValue::sanitize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5696825891225600 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type:...

sqlite3/ossfuzz: Use-of-uninitialized-value in accessPayload

Detailed report: https://oss-fuzz.com/testcase?key=5638835947438080 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: accessPayload vdbeMemFromBtreeResiz...

cryptofuzz/cryptofuzz-boringssl-noasm: Unknown signal in Hacl_Hash_Core_SHA1_update

Detailed report: https://oss-fuzz.com/testcase?key=5734860108333056 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-boringssl-noasm Fuzz target binary: cryptofuzz-boringssl-noasm Job Type: libfuzzerubsancryptofuzz Platform Id: linux Crash Type: Unknown signal Crash Address: 0x000000c285...

karchive/karchive_fuzzer: Heap-buffer-overflow in QByteArray::operator=

Project: git://anongit.kde.org/karchive Detailed report: https://oss-fuzz.com/testcase?key=5750712295751680 Project: karchive Fuzzer: aflkarchivefuzzer Fuzz target binary: karchivefuzzer Job Type: aflasankarchive Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

harfbuzz/hb-subset-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5160311461511168 Project: harfbuzz Fuzzer: aflharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Cra...

openthread/cli-uart-received-fuzzer: Stack-buffer-overflow in ot::Ip6::Address::FromString

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5661048276779008 Project: openthread Fuzzer: libFuzzeropenthreadcli-uart-received-fuzzer Fuzz target binary: cli-uart-received-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash...

[SECURITY] [DLA 1777-2] jquery regression update

Package : jquery Version : 1.7.2+dfsg-3.2+deb8u7 Debian Bug : 928827 The minified jquery library was broken in version 1.7.2+dfsg-3.2+deb8u6 due to an error during the build. This problem has now been fixed in version 1.7.2+dfsg-3.2+deb8u7 For Debian 8 "Jessie", this problem has been fixed in...

DLA-1777-2 jquery - regression update

Bulletin has no description...

harfbuzz/hb-subset-fuzzer: Stack-use-after-return in bool OT::Coverage::serialize<hb_map_iter_t<hb_map_iter_t<hb_filter_iter_t<OT::Co

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5634197349203968 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type:...

sqlite3/ossfuzz: Use-of-uninitialized-value in sqlite3VdbeMemValidStrRep

Detailed report: https://oss-fuzz.com/testcase?key=5678870243573760 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sqlite3VdbeMemValidStrRep...

gdal/mrf_fuzzer: Heap-buffer-overflow in ExpandPacked8ToByte1

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5645695916179456 Project: gdal Fuzzer: aflgdalmrffuzzer Fuzz target binary: mrffuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x7f4b21b43800 Crash...

Debian: Security Advisory (DSA-4444-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1787-1 : linux-4.9 security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures buffers. This flaw could allow an attacker controlling an unprivileged process to read sensitive...

[SECURITY] [DLA 1787-1] linux-4.9 security update

Package : linux-4.9 Version : 4.9.168-1+deb9u2deb8u1 CVE ID : CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 Debian Bug : 928125 Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into...

perfetto/trace_processor_fuzzer: Crash in perfetto::trace_processor::fuchsia_trace_utils::ReadTimestamp

Project: https://android.googlesource.com/platform/external/perfetto/ Detailed report: https://oss-fuzz.com/testcase?key=5197616339484672 Project: perfetto Fuzzer: libFuzzerperfettotraceprocessorfuzzer Fuzz target binary: traceprocessorfuzzer Job Type: libfuzzerasanperfetto Platform Id: linux Cra...

Debian DSA-4444-1 : linux - security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures buffers. This flaw could allow an attacker controlling an unprivileged process to read sensitive...

[SECURITY] [DSA 4444-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4444-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 14, 2019 https://www.debian.org/security/faq -...

libical/libical_fuzzer: Use-of-uninitialized-value in pvl_pop

Detailed report: https://oss-fuzz.com/testcase?key=5739308486492160 Project: libical Fuzzer: libFuzzerlibicalfuzzer Fuzz target binary: libicalfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: pvlpop icalcomponentfree...

perfetto/trace_processor_fuzzer: Heap-buffer-overflow in perfetto::trace_processor::FuchsiaTraceParser::ParseTracePacket

Project: https://android.googlesource.com/platform/external/perfetto/ Detailed report: https://oss-fuzz.com/testcase?key=5653558021586944 Project: perfetto Fuzzer: libFuzzerperfettotraceprocessorfuzzer Fuzz target binary: traceprocessorfuzzer Job Type: libfuzzerasanperfetto Platform Id: linux Cra...