[SECURITY] Fedora 29 Update: etcd-3.3.12-4.20190413gitf29b1ad.fc29

A highly-available key value store for shared configuration...

kimageformats/kimgio_tga_fuzzer: Use-of-uninitialized-value in LoadTGA

Project: git://anongit.kde.org/kimageformats Detailed report: https://oss-fuzz.com/testcase?key=5699912915746816 Project: kimageformats Fuzzer: libFuzzerkimageformatskimgiotgafuzzer Fuzz target binary: kimgiotgafuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type:...

CVE-2018-16988

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass account takeover exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a...

Denial Of Service (DOS)

Linux kernel is vulnerable to denial of service DOS attacks. The vulnerability exists because the pingunhash function in net/ipv4/ping.c in the Linux kernel is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe. Local attackers with access ...

Denial Of Service (DoS)

JasPer is vulnerable to denial of serviceDoS attacks. A user can exploit a flaw in the jpcpinextcprl function in jpct2cod.c. This allow remote attackers to cause unspecified impact via a crafted file, which triggers the use of an uninitialized value leading the application to crash...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of serviceDoS attacks. A race condition flaw occurs in the ioctlsendfib function in the Linux kernel's aacraid implementation. This allows a local user to cause out-of-bound access and crash the system by changing a certain size value...

Denial Of Service (DoS)

ntp is vulnerable to denial of service. An incomplete fix for CVE-2014-9750 resulted in improper value length checks in ntpcrypto.c. A packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially crafted...

Unchecked Return Value

It was discovered that JavasunmanagementGcInfoBuildergetLastGcInfo0 may return unexpected values. An untrusted Java application or applet could possibly use this flaw to impact the integrity of the Java Virtual Machine...

Credential Disclosure Through A Brute Force Attack

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...

Sensitive Information Disclosure

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...

Arbitrary Command Execution

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...

unicorn/fuzz_emu_arm64_arm: Use-of-uninitialized-value in float64_squash_input_denormal_aarch64

Project: https://github.com/unicorn-engine/unicorn.git Detailed report: https://oss-fuzz.com/testcase?key=5681075289849856 Project: unicorn Fuzzer: libFuzzerunicornfuzzemuarm64arm Fuzz target binary: fuzzemuarm64arm Job Type: libfuzzermsanunicorn Platform Id: linux Crash Type:...

libpcap/fuzz_filter: Use-of-uninitialized-value in fuzz_filter.c

Project: https://github.com/the-tcpdump-group/libpcap.git Detailed report: https://oss-fuzz.com/testcase?key=5735452293726208 Project: libpcap Fuzzer: libFuzzerlibpcapfuzzfilter Fuzz target binary: fuzzfilter Job Type: libfuzzermsanlibpcap Platform Id: linux Crash Type: Use-of-uninitialized-value...

libpcap/fuzz_both: Use-of-uninitialized-value in fuzz_both.c

Project: https://github.com/the-tcpdump-group/libpcap.git Detailed report: https://oss-fuzz.com/testcase?key=5674747897053184 Project: libpcap Fuzzer: libFuzzerlibpcapfuzzboth Fuzz target binary: fuzzboth Job Type: libfuzzermsanlibpcap Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

capstone/fuzz_disasmnext: Use-of-uninitialized-value in printUInt32

Detailed report: https://oss-fuzz.com/testcase?key=5720521745891328 Project: capstone Fuzzer: libFuzzercapstonefuzzdisasmnext Fuzz target binary: fuzzdisasmnext Job Type: libfuzzermsancapstone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: printUInt32...

Integer Overflow or Wraparound in Google TensorFlow

Issue Description Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent. The block size in meta file might contain a large int64 value which causes an integer overflow upon addition. Subsequent code using n as index may...

dlplibs/wqfuzzer: Use-of-uninitialized-value in std::__1::enable_if<

Detailed report: https://oss-fuzz.com/testcase?key=5717618784206848 Project: dlplibs Fuzzer: libFuzzerdlplibswqfuzzer Fuzz target binary: wqfuzzer Job Type: libfuzzermsandlplibs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: std::1::enableif...

ALPINE-CVE-2018-12384

When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3...

DEBIAN-CVE-2018-12384

When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3...

PT-2019-18331 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2019.010.20098 Description: This issue allows remote attackers to disclose sensitive information on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious...