libyal:libwrc_stream_fuzzer: Heap-double-free in libwrc_resource_node_entry_free

Detailed Report: https://oss-fuzz.com/testcase?key=4614184518680576 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libwrcstreamfuzzer Job Type: libfuzzerasanlibyal Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x621000002900 Crash State: libwrcresourcenodeentryfree...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=2.0.2, <=3.0.4) +41 more potentially affected by CVE-2021-34797 via org.apache.geode:geode-core (>=1.13.0, <=1.13.4)

org.apache.geode:geode-core MAVEN version =1.13.0, =2.0.2, =2.0.2, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.2, =1.13.2, =1.13.2, =1.13.0, =1.13.0, =1.13.4 and more Source cves: CVE-2021-34797 Source advisory: MEND:CVE-2021-34797...

envoy:codec_impl_fuzz_test: Crash in Envoy::Http::HttpStream::HttpStream

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=6708149317402624 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000a844f70 Cras...

PT-2021-28000

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the functions read xref, pdfi read xref, and pdfi set...

CVE-2020-36512

An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::readexact may read from uninitialized memory locations...

PT-2021-27990

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as read xref stream entries, pdfi process xref stream, and pd...

PT-2021-27989

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack buffer overflow error, as indicated by a crash report. The crash occurs in the pdfi oc is ocg visible, pdfi op BDC, and pdf...

NetBSD security feature vulnerabilities

NetBSD is an open source Unix-like operating system from the NetBSD Netbsd Foundation. NetBSD suffers from a security vulnerability that stems from the use of a weak cryptographic PRNG for the IPv6 stream label generation algorithm in versions of NetBSD up to 9.2...

ghostscript:gstoraster_fuzzer: Crash in read_xref_stream_entries

Detailed Report: https://oss-fuzz.com/testcase?key=5891932457402368 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x63380006a598 Crash State: readxrefstreamentries...

ROS-2-524

2.524 Multiple vulnerabilities in ISC BIND CVE-2021-25216, CVE-2021-25215, CVE-2021-25214 1. Vulnerability Description: CVE-2021-25216 A vulnerability exists due to a boundary error in the GSS-TSIG extension. A remote attacker can send specially crafted requests to the server, trigger a buffer...

Apache Storm Code Execution

The vulnerability of the software platform services for distributed stream processing Apache Storm is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system remotely...

CVE-2021-23175

NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial...

PT-2021-26996

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15 through v5.15.5 Description A memory leak issue was discovered in the get file stream info function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions v5.1...

CVE-2021-1018

In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is...

CVE-2021-1003

In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product...

Security Bulletin: Vulnerability in RC4 stream cipher affects Multiple N-series Products (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Multiple N-series Products Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit thi...

CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

CVE-2021-40827

Clementine Music Player through 1.3.1 when a GLib 2.0.0 DLL is used is vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file parsing functionality at memcpy+0x265. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is...

CVE-2021-40827

Clementine Music Player through 1.3.1 when a GLib 2.0.0 DLL is used is vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file parsing functionality at memcpy+0x265. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is...

CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...