openssl/asn1: Heap-buffer-overflow in asn1_ex_i2c

Project: https://github.com/openssl/openssl.git Detailed report: https://oss-fuzz.com/testcase?key=5721463706353664 Project: openssl Fuzzer: aflopensslasn1 Fuzz target binary: asn1 Job Type: aflasanopenssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6030000029f1...

systemd/fuzz-unit-file: Use-of-uninitialized-value in streq_ptr

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=4908210742886400 Project: systemd Fuzzer: libFuzzersystemdfuzz-unit-file Fuzz target binary: fuzz-unit-file Job Type: libfuzzermsansystemd Platform Id: linux Crash Type: Use-of-uninitialized-value...

libtiff/tiff_read_rgba_fuzzer: Use-of-uninitialized-value in inflate

Project: https://gitlab.com/libtiff/libtiff.git Detailed report: https://oss-fuzz.com/testcase?key=5273368258412544 Project: libtiff Fuzzer: libFuzzerlibtifftiffreadrgbafuzzer Fuzz target binary: tiffreadrgbafuzzer Job Type: libfuzzermsanlibtiff Platform Id: linux Crash Type:...

imagemagick/ping_mng_fuzzer: Use-of-uninitialized-value in mng_minimum_box

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=6209869771177984 Project: imagemagick Fuzzer: libFuzzerimagemagickpingmngfuzzer Fuzz target binary: pingmngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

CVE-2018-6918

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able ...

graphicsmagick/coder_XCF_fuzzer: Use-of-uninitialized-value in AlphaCompositePixel

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5383447750115328 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderXCFfuzzer Fuzz target binary: coderXCFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

net-snmp/agentx_parse_fuzzer: Stack-buffer-overflow in agentx_parse_string

Project: git://git.code.sf.net/p/net-snmp/code Detailed report: https://oss-fuzz.com/testcase?key=5727267801006080 Project: net-snmp Fuzzer: libFuzzernet-snmpagentxparsefuzzer Fuzz target binary: agentxparsefuzzer Job Type: libfuzzerasannet-snmp Platform Id: linux Crash Type: Stack-buffer-overflo...

Debian: Security Advisory (DSA-4162-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4156-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4156-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 29, 2018 https://www.debian.org/security/faq -...

VulnCheck KEV: CVE-2017-20149

The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on...

Scilico I, Librarian 'id' Parameter Cross-Site Scripting Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. A cross-site scripting vulnerability exists in the 'id' parameter of the stable.php file in Scilico I, Librarian 4.8 and earlier versions. A remote attacker can exploit this vulnerability to...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in jbig2_arith_decode

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5829721259507712 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

graphicsmagick/enhance_fuzzer: Use-of-uninitialized-value in InsertRow

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6546207443779584 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickenhancefuzzer Fuzz target binary: enhancefuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

libreoffice/lwpfuzzer: Heap-use-after-free in rtl::OUString::getLength

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6697184394215424 Project: libreoffice Fuzzer: afllibreofficelwpfuzzer Fuzz target binary: lwpfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Cra...

MGASA-2018-0175 Updated leptonica packages fix security vulnerabilities

Package leptonica has been updated to the current stable version 1.75.3 which fixes: CVE-2018-7186 - multiple stack-based buffer overflows in gplotRead and ptaReadStream CVE-2018-7247 - a buffer overflow in src/viewfiles.c with unsanitized input rootname...

Debian DSA-4143-1 : firefox-esr - security update

Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

curl/curl_fuzzer_http: Stack-buffer-overflow in fuzz_handle_transfer

Detailed report: https://oss-fuzz.com/testcase?key=5569625854050304 Project: curl Fuzzer: libFuzzercurlfuzzerhttp Fuzz target binary: curlfuzzerhttp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Stack-buffer-overflow READ 8 Crash Address: 0x7fff6a3b0910 Crash State: fuzzhandletransfe...

imagemagick/ping_mvg_fuzzer: Heap-buffer-overflow in TracePoint

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4676100501274624 Project: imagemagick Fuzzer: aflimagemagickpingmvgfuzzer Fuzz target binary: pingmvgfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

Design/Logic Flaw

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...