Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2020-1927 DESCRIPTION: Apache HTTP Server could allow a remote attacker to conduct phishing attacks, caused by an open redirect...

imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::parse_fuji_compressed_header

Detailed Report: https://oss-fuzz.com/testcase?key=5634881263763456 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::parsefujicompressedhead...

libspectre:spectre_read_fuzzer: Use-of-uninitialized-value in psscan

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5678076710354944 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzermsanlibspectre Platform Id: linux Crash Type:...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in s_exD_process

Detailed Report: https://oss-fuzz.com/testcase?key=5645873112678400 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sexDprocess sreadbuf sgets...

leptonica:pix_rotate_shear_fuzzer: Use-of-uninitialized-value in putgreytile

Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=5644392036827136 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: pixrotateshearfuzzer Job Type: libfuzzermsanleptonica Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in c_pdf14trans_clist_read_update

Detailed Report: https://oss-fuzz.com/testcase?key=5733777335910400 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cpdf14transclistreadupdate...

libspectre:spectre_read_fuzzer: Use-of-uninitialized-value in readline

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5681684906508288 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzermsanlibspectre Platform Id: linux Crash Type:...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in gs_scan_token

Detailed Report: https://oss-fuzz.com/testcase?key=5109631614713856 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gsscantoken tokenexeccontinue...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in gs_scan_token

Detailed Report: https://oss-fuzz.com/testcase?key=6257668319870976 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gsscantoken interp gscallinterp...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in gp_pwrite_impl

Detailed Report: https://oss-fuzz.com/testcase?key=5730542504116224 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gppwriteimpl clistfwritechars...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in gx_dc_ht_colored_read

Detailed Report: https://oss-fuzz.com/testcase?key=5749745906876416 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gxdchtcoloredread...

ghostscript:gstoraster_fuzzer: Use-of-uninitialized-value in s_A85D_process

Detailed Report: https://oss-fuzz.com/testcase?key=5705537925939200 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzermsanghostscript Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sA85Dprocess gsscantoken interp...

Apache -- Multiple vulnerabilities

Apache Team reports: SECURITY: CVE-2020-1934 modproxyftp: Use of uninitialized value with malicious backend FTP server. SECURITY: CVE-2020-1927 rewrite, core: Set PCREDOTALL flag by default to avoid unpredictable matches and substitutions with encoded line break characters. The fix for...

ImageMagick: a "use of uninitialized value" vulnerability in the function ReadCUTImage leading to a crash and DoS

ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c...

imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c...

imagemagick: use of uninitialized value in function ReadPANGOImage in coders/pango.c

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c...

imagemagick:crop_fuzzer: Use-of-uninitialized-value in LibRaw::open_datastream

Detailed Report: https://oss-fuzz.com/testcase?key=5724383278792704 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: cropfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::opendatastream LibRaw::openfi...

sqlite3:ossfuzz: Use-of-uninitialized-value in sqlite3Atoi64

Detailed Report: https://oss-fuzz.com/testcase?key=5676952943067136 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sqlite3Atoi64 computeNumericType numericType...

openvswitch:odp_target: Use-of-uninitialized-value in format_u8x

Project: https://github.com/openvswitch/ovs.git Detailed Report: https://oss-fuzz.com/testcase?key=5717478543196160 Project: openvswitch Fuzzing Engine: libFuzzer Fuzz Target: odptarget Job Type: libfuzzermsanopenvswitch Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cra...

binutils:fuzz_bfd: Use-of-uninitialized-value in pass_over

Detailed Report: https://oss-fuzz.com/testcase?key=5162900487667712 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzbfd Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: passover tekhexobjectp bfdcheckformatmatches...