net-snmp/agentx_parse_fuzzer: Stack-buffer-overflow in agentx_parse_string

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed report: https://oss-fuzz.com/testcase?key=5727267801006080 Project: net-snmp Fuzzer: libFuzzernet-snmpagentxparsefuzzer Fuzz target binary: agentxparsefuzzer Job Type: libfuzzerasannet-snmp Platform I...

Debian: Security Advisory (DSA-4162-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4156-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4156-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 29, 2018 https://www.debian.org/security/faq -...

VulnCheck KEV: CVE-2017-20149

The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on t...

Scilico I, Librarian 'id' Parameter Cross-Site Scripting Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. A cross-site scripting vulnerability exists in the 'id' parameter of the stable.php file in Scilico I, Librarian 4.8 and earlier versions. A remote attacker can exploit this vulnerability to...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in jbig2_arith_decode

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5829721259507712 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

graphicsmagick/enhance_fuzzer: Use-of-uninitialized-value in InsertRow

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6546207443779584 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickenhancefuzzer Fuzz target binary: enhancefuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

libreoffice/lwpfuzzer: Heap-use-after-free in rtl::OUString::getLength

Detailed report: https://oss-fuzz.com/testcase?key=6697184394215424 Project: libreoffice Fuzzer: afllibreofficelwpfuzzer Fuzz target binary: lwpfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x619005008128 Crash State:...

MGASA-2018-0175 Updated leptonica packages fix security vulnerabilities

Package leptonica has been updated to the current stable version 1.75.3 which fixes: CVE-2018-7186 - multiple stack-based buffer overflows in gplotRead and ptaReadStream CVE-2018-7247 - a buffer overflow in src/viewfiles.c with unsanitized input rootname...

Debian DSA-4143-1 : firefox-esr - security update

Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

curl/curl_fuzzer_http: Stack-buffer-overflow in fuzz_handle_transfer

Detailed report: https://oss-fuzz.com/testcase?key=5569625854050304 Project: curl Fuzzer: libFuzzercurlfuzzerhttp Fuzz target binary: curlfuzzerhttp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Stack-buffer-overflow READ 8 Crash Address: 0x7fff6a3b0910 Crash State: fuzzhandletransfe...

imagemagick/ping_mvg_fuzzer: Heap-buffer-overflow in TracePoint

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4676100501274624 Project: imagemagick Fuzzer: aflimagemagickpingmvgfuzzer Fuzz target binary: pingmvgfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow...

Design/Logic Flaw

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

CVE-2018-1000072

CVE-2018-1000072 affects iRedMail prior to commit f04b8ef, where the Roundcube Webmail component contains an insecure permissions flaw that can lead to exfiltration of sensitive data, including a user’s secret GPG key and other configuration files, via network access. The issue is documented acro...

[SECURITY] Fedora 27 Update: freexl-1.0.5-1.fc27

FreeXL is a library to extract valid data from within an Excel spreadsheet .xls Design goals: simple and lightweight stable, robust and efficient easily and universally portable completely ignore any GUI-related oddity...

resiprocate/fuzzStack: Heap-buffer-overflow in resip::ParseBuffer::qVal

Project: https://github.com/resiprocate/resiprocate.git Detailed report: https://oss-fuzz.com/testcase?key=6234261284716544 Project: resiprocate Fuzzer: aflresiprocatefuzzStack Fuzz target binary: fuzzStack Job Type: aflasanresiprocate Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

imagemagick/encoder_mvg_fuzzer: Crash in TracePoint

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5950563343663104 Project: imagemagick Fuzzer: libFuzzerimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Updated leptonica packages fix a security vulnerability

Package leptonica has been updated to the current stable version 1.75.2 which fixes a security issue potential injection attack using gplot rootdir reported in CVE-2018-3836...