strongswan/fuzz_certs: Crash in asn1_length

Detailed report: https://oss-fuzz.com/testcase?key=4842326636625920 Project: strongswan Fuzzer: aflstrongswanfuzzcerts Fuzz target binary: fuzzcerts Job Type: aflasanstrongswan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7ffc00000003 Crash State: asn1length iterate...

Default credentials

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was...

Debian DSA-4052-1 : bzr - security update

Adam Collard discovered that Bazaar, an easy to use distributed version control system, did not correctly handle maliciously constructed bzr+ssh URLs, allowing a remote attacker to run an arbitrary shell command. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

unrar/unrar_fuzzer: NULL

Detailed report: https://oss-fuzz.com/testcase?key=6436091927199744 Project: unrar Fuzzer: libFuzzerunrarfuzzer Fuzz target binary: unrarfuzzer Job Type: libfuzzermsanunrar Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: NULL Sanitizer: memory MSAN Recommende...

librawspeed/LJpegDecompressorFuzzer: Use-after-poison in rawspeed::unroll_loop_t<void rawspeed::LJpegDecompressor::decodeN<4>

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6127728576167936 Project: librawspeed Fuzzer: afllibrawspeedLJpegDecompressorFuzzer Fuzz target binary: LJpegDecompressorFuzzer Job Type: aflasanlibrawspeed Platform Id: linux Crash Type:...

Linux - mincore() Uninitialized Kernel Heap Page Disclosure Exploit

Linux mincore discloses uninitialized kernel heap pages. When walkpagerange is used on a VMHUGETLB VMA, callbacks from the mmwalk structure are only invoked for present pages. However, domincore assumes that it will always get callbacks for all pages in the range passed to walkpagerange, and when...

Linux Kernel - mincore() Uninitialized Kernel Heap Page Disclosure

Linux Kernel - mincore Uninitialized Kernel Heap Page Disclosure / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1431 I found the following bug with an AFL-based fuzzer: When walkpagerange is used on a VMHUGETLB VMA, callbacks from the mmwalk structure are only invoked for...

unrar/unrar_fuzzer: Use-of-uninitialized-value in IsRelativeSymlinkSafe

Detailed report: https://oss-fuzz.com/testcase?key=4800962913894400 Project: unrar Fuzzer: libFuzzerunrarfuzzer Fuzz target binary: unrarfuzzer Job Type: libfuzzermsanunrar Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: IsRelativeSymlinkSafe ExtractUnixLink3...

file/magic_fuzzer: Crash in file_getbuffer

Detailed report: https://oss-fuzz.com/testcase?key=6067315364855808 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzermsanfile Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x707000010000 Crash State: filegetbuffer magicbuffer start...

librawspeed/RawParserFuzzer-GetDecoder-Decode: Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6696296816574464 Project: librawspeed Fuzzer: libFuzzerlibrawspeedRawParserFuzzer-GetDecoder-Decode Fuzz target binary: RawParserFuzzer-GetDecoder-Decode Job Type: libfuzzermsanlibrawspeed...

Stack overflow

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, the kernel does not properly clear the memory of the kldfilestat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and...

CVE-2017-1087

CVE-2017-1087 affects FreeBSD 10.x where named POSIX shared memory objects are globally scoped across jails and host. According to sources, a process in one jail can read/modify shared memory created by another jail or host, enabling malicious content injection into memory regions trusted by appl...

Debian: Security Advisory (DSA-4035-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Stable Channel Update for Desktop

The stable channel has been updated to 62.0.3202.94 for Windows, Mac and Linux which will roll out over the coming days/weeks. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions...

[SECURITY] [DSA 4026-1] bchunk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4026-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 09, 2017 https://www.debian.org/security/faq -...

yara/rules_fuzzer: Use-of-uninitialized-value in _yr_atoms_choose

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5753694386651136 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

[SECURITY] [DSA 4022-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4022-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 07, 2017 https://www.debian.org/security/faq -...

chakra: Dynamic-stack-buffer-overflow in Js::JavascriptArray::NewInstance

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=6106023170408448 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: Dynamic-stack-buffer-overflow READ 8 Crash Address: 0x7ffd13bb0260 Crash State:...

gdal/gdal_translate_fuzzer: Global-buffer-overflow in GDALResampleChunk32R_Gauss

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4894972097593344 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Fuzz target binary: gdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash...

gstreamer/gst-discoverer: Heap-buffer-overflow in webvtt_type_find

Project: https://anongit.freedesktop.org/git/gstreamer/gstreamer https://gitlab.freedesktop.org/gstreamer/gstreamer.git Detailed report: https://oss-fuzz.com/testcase?key=6349101273710592 Project: gstreamer Fuzzer: libFuzzergstreamergst-discoverer Fuzz target binary: gst-discoverer Job Type:...