CVE-2019-14872

The dtoar function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return value. This could result in NULL pointer dereference...

libfdk-aac:aacDecoder_ConfigRaw: Use-of-uninitialized-value in _skipEqInstructions

Detailed Report: https://oss-fuzz.com/testcase?key=5144868184915968 Project: libfdk-aac Fuzzing Engine: libFuzzer Fuzz Target: aacDecoderConfigRaw Job Type: libfuzzermsanlibfdk-aac Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: skipEqInstructions...

libspectre:spectre_read_fuzzer: Use-of-uninitialized-value in psscan

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5741466287865856 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzermsanlibspectre Platform Id: linux Crash Type:...

libspectre:spectre_read_fuzzer: Use-of-uninitialized-value in ps_read_doseps

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5710259223265280 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzermsanlibspectre Platform Id: linux Crash Type:...

binutils:fuzz_disassemble: Use-of-uninitialized-value in print_insn_metag

Detailed Report: https://oss-fuzz.com/testcase?key=5696334771519488 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisassemble Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: printinsnmetag fuzzdisassemble.c...

binutils:fuzz_disassemble: Use-of-uninitialized-value in htab_find_with_hash

Detailed Report: https://oss-fuzz.com/testcase?key=5189041990664192 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisassemble Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: htabfindwithhash printinsn32...

stb:stb_png_read_fuzzer: Use-of-uninitialized-value in stbi__paeth

Project: https://github.com/nothings/stb.git Detailed Report: https://oss-fuzz.com/testcase?key=5762719665094656 Project: stb Fuzzing Engine: libFuzzer Fuzz Target: stbpngreadfuzzer Job Type: libfuzzermsanstb Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

The Value and Ethics of Using Phone Data to Monitor Covid-19

Google and Facebook are discussing plans with the White House to share collective data on people's movements during the coronavirus pandemic...

DEBIAN-CVE-2020-6582

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call...

BSA-2020-937

Security Advisory ID : BSA-2020-937 Component : lldpd Revision : 1.0: Final Buffer overflow in the lldpdecode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via vectors involving large...

imagemagick:crop_fuzzer: Use-of-uninitialized-value in LibRaw::panasonic_load_raw

Detailed Report: https://oss-fuzz.com/testcase?key=5199241358344192 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: cropfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::panasonicloadraw LibRaw::unpa...

libsass:data_context_fuzzer: Use-of-uninitialized-value in std::__1::vector<std::__1::vector<Sass::Extension, std::__1::allocator<Sass::Ext

Detailed Report: https://oss-fuzz.com/testcase?key=5682028378062848 Project: libsass Fuzzing Engine: libFuzzer Fuzz Target: datacontextfuzzer Job Type: libfuzzermsanlibsass Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Friday Squid Blogging: New Report on Squid Markets

This report costs $2,000. Please don't buy it for me. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

CVE-2019-13193

Some Brother printers such as the HL-L8360CDW v1.20 were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device...

Stack overflow

Some Brother printers such as the HL-L8360CDW v1.20 were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device...

CVE-2019-13193

Some Brother printers such as the HL-L8360CDW v1.20 were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device...

EulerOS Virtualization for ARM 64 3.0.2.0 : unzip (EulerOS-SA-2020-1222)

According to the versions of the unzip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service infinite loop via empty bzip2 data in a ZIP...

DEBIAN-CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

Command injection

An issue was discovered in Poly formerly Polycom HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By...

CVE-2020-0551

Load value injection in some IntelR Processors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. The list of affected products is provided in intel-sa-00334:...