libssh2 security update

CentOS Errata and Security Advisory CESA-2019:0679 An update for libssh2 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

opencv/imdecode_fuzzer: Heap-buffer-overflow in LogLuv24toXYZ

Project: https://github.com/opencv/opencv.git Detailed report: https://oss-fuzz.com/testcase?key=5637208565874688 Project: opencv Fuzzer: libFuzzeropencvimdecodefuzzer Fuzz target binary: imdecodefuzzer Job Type: libfuzzerasanopencv Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Cras...

CVE-2019-3836

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages...

DLA-1745-1 libdatetime-timezone-perl - new upstream version

Bulletin has no description...

lzma/7z_fuzzer: Use-of-uninitialized-value in CrcUpdateT8

Detailed report: https://oss-fuzz.com/testcase?key=5695345578737664 Project: lzma Fuzzer: libFuzzerlzma7zfuzzer Fuzz target binary: 7zfuzzer Job Type: libfuzzermsanlzma Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: CrcUpdateT8 CrcCalc SzArExExtract Sanitize...

ffmpeg/ffmpeg_AV_CODEC_ID_RSCC_fuzzer: Heap-buffer-overflow in inflate

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5734128093233152 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDRSCCfuzzer Fuzz target binary: ffmpegAVCODECIDRSCCfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

php/php-fuzz-exif: Heap-buffer-overflow in exif_iif_add_value

Detailed report: https://oss-fuzz.com/testcase?key=5724097968865280 Project: php Fuzzer: aflphpphp-fuzz-exif Fuzz target binary: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60400002cbba Crash State: exifiifaddvalue exifiifaddtag...

Fedora 28 : firefox (2019-a0ccc78064)

Fixed popup issues on Wayland mozbz1423598 - Fixed rendering artifacts on Wayland mozbz1468911 ---- - New upstream version 66.0 - Details at https://www.mozilla.org/en-US/firefox/66.0/releasenotes/ Note that Tenable Network Security has extracted the preceding description block directly from the...

openSUSE Security Update : java-11-openjdk (openSUSE-2019-818)

This update for java-11-openjdk fixes the following issues : Update to upstream tag jdk-11.0.1+13 Oracle October 2018 CPU Security fixes : - S8202936, CVE-2018-3183, bsc1112148: Improve script engine support - S8199226, CVE-2018-3169, bsc1112146: Improve field accesses - S8199177, CVE-2018-3149,...

openSUSE Security Update : hylafax+ (openSUSE-2019-711)

This update for hylafax+ fixes the following issues : Security issues fixed in 5.6.1 : - CVE-2018-17141: multiple vulnerabilities affecting fax page reception in JPEG format Specially crafted input may have allowed remote execution of arbitrary code boo1109084 Additionally, this update also...

ghostscript security update

CentOS Errata and Security Advisory CESA-2019:0633 An update for ghostscript is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Fedora 29 : wordpress (2019-bf68d77a2c)

Upstream announcement: WordPress 5.1.1 Security and Maintenance Release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introduci...

systemd/fuzz-network-parser: Use-of-uninitialized-value in condition_test

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=5652461068484608 Project: systemd Fuzzer: libFuzzersystemdfuzz-network-parser Fuzz target binary: fuzz-network-parser Job Type: libfuzzermsansystemd Platform Id: linux Crash Type:...

OPENSUSE-SU-2019:0054-1 Security update for gitolite

This update for gitolite fixes the following security issue: - CVE-2018-20683: The rsync command line was not handled correctly, allow malicious rsync options boo1121570 The version update to 3.6.11 also contains a number of upstream bug fixes...

XSS vulnerability with double-encoded entities

An XSS vulnerability CVE-2019-10010 has been identified in all previous versions of this library 0.18.2 and below. The issue has been fixed in version 0.18.3. All users should upgrade to version 0.18.3 immediately. Additionally, if your application caches the resulting HTML, please purge and/or...

unicorn/fuzz_emu_mips_32be: Crash in mips_release_mips

Project: https://github.com/unicorn-engine/unicorn.git Detailed report: https://oss-fuzz.com/testcase?key=5663967185207296 Project: unicorn Fuzzer: libFuzzerunicornfuzzemumips32be Fuzz target binary: fuzzemumips32be Job Type: libfuzzerasanunicorn Platform Id: linux Crash Type: UNKNOWN WRITE Crash...

ffmpeg/ffmpeg_AV_CODEC_ID_TIFF_fuzzer: Heap-buffer-overflow in ff_lzw_decode

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5754570929602560 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDTIFFfuzzer Fuzz target binary: ffmpegAVCODECIDTIFFfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Cra...

imagemagick/encoder_gif_fuzzer: Heap-buffer-overflow in ParseEntities

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5678895015133184 Project: imagemagick Fuzzer: libFuzzerimagemagickencodergiffuzzer Fuzz target binary: encodergiffuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

picotls/fuzz-asn1: Heap-buffer-overflow in ptls_asn1_read_type

Project: https://github.com/h2o/picotls.git Detailed report: https://oss-fuzz.com/testcase?key=5687824386359296 Project: picotls Fuzzer: aflpicotlsfuzz-asn1 Fuzz target binary: fuzz-asn1 Job Type: aflasanpicotls Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

picotls/fuzz-asn1: Crash in ptls_asn1_validation_recursive

Project: https://github.com/h2o/picotls.git Detailed report: https://oss-fuzz.com/testcase?key=5688525536624640 Project: picotls Fuzzer: libFuzzerpicotlsfuzz-asn1 Fuzz target binary: fuzz-asn1 Job Type: libfuzzerasanpicotls Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6190bebebf97...