Moderate: Red Hat Security Advisory: opensc security, bug fix, and enhancement update

An update for opensc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

aspell/aspell_fuzzer: Heap-buffer-overflow in acommon::DecodeDirect<unsigned short>::decode

Project: https://github.com/gnuaspell/aspell.git Detailed report: https://oss-fuzz.com/testcase?key=5704942551040000 Project: aspell Fuzzer: libFuzzeraspellfuzzer Fuzz target binary: aspellfuzzer Job Type: libfuzzerasanaspell Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Addres...

[ASA-201908-2] python-django: multiple issues

Arch Linux Security Advisory ASA-201908-2 ========================================= Severity: Medium Date : 2019-08-05 CVE-ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1015...

CVE-2019-5020

An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerabili...

Moderate: Red Hat Security Advisory: podman security, bug fix, and enhancement update

An update for podman is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

mpg123/decode_fuzzer: Use-of-uninitialized-value in INT123_parse_new_id3

Detailed report: https://oss-fuzz.com/testcase?key=5124907546968064 Project: mpg123 Fuzzer: libFuzzermpg123decodefuzzer Fuzz target binary: decodefuzzer Job Type: libfuzzermsanmpg123 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: INT123parsenewid3 handleid3v...

qpdf/dct_fuzzer: Use-of-uninitialized-value in ycck_cmyk_convert

Detailed report: https://oss-fuzz.com/testcase?key=5632990870241280 Project: qpdf Fuzzer: libFuzzerqpdfdctfuzzer Fuzz target binary: dctfuzzer Job Type: libfuzzermsanqpdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: ycckcmykconvert sepupsample...

Fedora 29 : firefox (2019-5e92985aee)

New upstream version 68.0 - Release notes at https://www.mozilla.org/en-US/firefox/68.0/releasenotes/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

lz4/compress_fuzzer: Heap-buffer-overflow in LZ4_write32

Project: https://github.com/lz4/lz4.git Detailed report: https://oss-fuzz.com/testcase?key=5726918013353984 Project: lz4 Fuzzer: afllz4compressfuzzer Fuzz target binary: compressfuzzer Job Type: aflasanlz4 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x61c00000075b...

imagemagick/ping_sfw_fuzzer: Use-of-uninitialized-value in LocaleNCompare

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5639053183025152 Project: imagemagick Fuzzer: libFuzzerimagemagickpingsfwfuzzer Fuzz target binary: pingsfwfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

freeimage/load_from_memory_fuzzer: Heap-buffer-overflow in _MemoryReadProc

Detailed report: https://oss-fuzz.com/testcase?key=5088386304442368 Project: freeimage Fuzzer: aflfreeimageloadfrommemoryfuzzer Fuzz target binary: loadfrommemoryfuzzer Job Type: aflasanfreeimage Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 6 Crash Address: 0x6140000001f8 Crash State...

jsonnet/convert_jsonnet_fuzzer: Crash in Interpreter::evaluate

Project: https://github.com/google/jsonnet.git Detailed report: https://oss-fuzz.com/testcase?key=5706027058593792 Project: jsonnet Fuzzer: libFuzzerjsonnetconvertjsonnetfuzzer Fuzz target binary: convertjsonnetfuzzer Job Type: libfuzzerubsanjsonnet Platform Id: linux Crash Type: UNKNOWN READ Cra...

libxslt/xslt: Use-of-uninitialized-value in xmlOutputBufferWriteEscape

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed report: https://oss-fuzz.com/testcase?key=5760846728265728 Project: libxslt Fuzzer: libFuzzerlibxsltxslt Fuzz target binary: xslt Job Type: libfuzzermsanlibxslt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Virtuozzo Linux Errata and Security Advisory 2019:1763 Critical

Upstream security update. Follow RHSA-2019:1763 for details...

qpdf/qpdf_fuzzer: Use-of-uninitialized-value in deflate_slow

Detailed report: https://oss-fuzz.com/testcase?key=5710136049401856 Project: qpdf Fuzzer: libFuzzerqpdffuzzer Fuzz target binary: qpdffuzzer Job Type: libfuzzermsanqpdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: deflateslow deflate PlFlate::handleData...

Virtuozzo Linux Errata and Security Advisory 2019:1726 Important

Upstream security update. Follow RHSA-2019:1726 for details...

CVE-2017-7189

main/streams/xpsocket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen'127.0.0.1:80', 443 as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number i.e...

njs/njs_process_script_fuzzer: Use-of-uninitialized-value in njs_regexp_exec_result

Project: http://hg.nginx.org/njs Detailed report: https://oss-fuzz.com/testcase?key=5127028405174272 Project: njs Fuzzer: libFuzzernjsprocessscriptfuzzer Fuzz target binary: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Moderate: Red Hat Security Advisory: ansible security and bug fix update

An update for ansible is now available for Ansible Engine 2.8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

njs/njs_process_script_fuzzer: Crash in njs_object_prop_alloc

Project: http://hg.nginx.org/njs Detailed report: https://oss-fuzz.com/testcase?key=5688604573040640 Project: njs Fuzzer: libFuzzernjsprocessscriptfuzzer Fuzz target binary: njsprocessscriptfuzzer Job Type: libfuzzerubsannjs Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x001002c33f2...