USN-3867-1: MySQL vulnerabilities

Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10 have been updated to MySQL 5.7.25. In addition to security fixes, the updated packages contain bug fixes, new features,...

libxls/fuzz_xls: Heap-buffer-overflow in xls_isCellTooSmall

Project: https://github.com/libxls/libxls.git Detailed report: https://oss-fuzz.com/testcase?key=5085850579238912 Project: libxls Fuzzer: afllibxlsfuzzxls Fuzz target binary: fuzzxls Job Type: aflasanlibxls Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x603000002008...

poppler/pdf_fuzzer: Use-of-uninitialized-value in SampledFunction::SampledFunction

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5742464911015936 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type:...

readstat/fuzz_format_dta: Stack-buffer-overflow in readstat_convert

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5730197242904576 Project: readstat Fuzzer: aflreadstatfuzzformatdta Fuzz target binary: fuzzformatdta Job Type: aflasanreadstat Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash...

readstat/fuzz_format_sav: Heap-buffer-overflow in rt_read_handler

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5656109291929600 Project: readstat Fuzzer: aflreadstatfuzzformatsav Fuzz target binary: fuzzformatsav Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

readstat/fuzz_format_por: Index-out-of-bounds in read_missing_value_record

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5652147318816768 Project: readstat Fuzzer: libFuzzerreadstatfuzzformatpor Fuzz target binary: fuzzformatpor Job Type: libfuzzerubsanreadstat Platform Id: linux Crash Type: Index-out-of-bounds Cra...

Security update for gitolite (moderate)

openSUSE Security Update: Security update for gitolite Announcement ID: openSUSE-SU-2019:0054-1 Rating: moderate References: 1121570 Cross-References: CVE-2018-20683 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 openSUSE Backports SLE-15 An update that fixes one vulnerability is now...

ALPINE-CVE-2017-3145

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1...

DEBIAN-CVE-2017-3145

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1...

CVE-2019-6462

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function arcerrornormalized in the file cairo-arc.c, related to arcmaxanglefortolerancenormalized...

CVE-2019-6461

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function cairoarcindirection in the file cairo-arc.c...

openthread/ip6-send-fuzzer: Index-out-of-bounds in ot::Coap::Message::ParseHeader

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5162663452082176 Project: openthread Fuzzer: libFuzzeropenthreadip6-send-fuzzer Fuzz target binary: ip6-send-fuzzer Job Type: libfuzzerubsanopenthread Platform Id: linux Crash Type:...

CVE-2019-2482

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: PS. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

Virtuozzo Linux Errata and Bugfix Advisory 2019:0063

Upstream security update. Follow RHBA-2019:0063 for details...

Information Disclosure

kernel-rt is vulnerable to information disclosure attacks. The vulnerability exists through an information disclosure vulnerability in the Upstream kernel encrypted-key...

Privilege Escalation

kernel is vulnerable to privilege escalation attacks. The vulnerability exists through a elevation of privilege vulnerability in the Upstream kernel skcipher...

Updated python-django packages fix security vulnerability

An upstream patch has been backported to fix a security vulnerability in python-django. CVE-2019-3498: Content spoofing possibility in the default 404 page An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the...

imagemagick/encoder_ept3_fuzzer: Use-of-uninitialized-value in WriteBlob

Detailed report: https://oss-fuzz.com/testcase?key=5085775568306176 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderept3fuzzer Fuzz target binary: encoderept3fuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Virtuozzo Linux Errata and Bugfix Advisory 2019:0037

Upstream security update. Follow RHBA-2019:0037 for details...

Moderate: Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update

Updates for rh-dotnet21-dotnet and rh-dotnet22-dotnet are now available for .NET Core on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...