CVE-2018-16150

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

CVE-2018-16150

In axTLS 2.1.3 and earlier, the PKCS#1 v1.5 signature verification in sig_verify() fails to reject excess data after the hash, enabling signature forgery when small public exponents are used. This can lead to impersonation via forged X.509 certificates. This CVE-2018-16150 is a variant of CVE-200...

keystone/fuzz_asm_arm_thumbv8be: Use-of-uninitialized-value in llvm_ks::MCAssembler::computeFragmentSize

Detailed report: https://oss-fuzz.com/testcase?key=5632277325807616 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmarmthumbv8be Fuzz target binary: fuzzasmarmthumbv8be Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

lighttpd 1.4.31 http_request_split_value Function Header Handling DoS

According to its banner, the version of lighttpd running on the remote host is 1.4.31. It is, therefore, affected by a denial of service vulnerability. An error in the httprequestsplitvalue function in 'src/request.c' can cause the application to enter an endless loop when handling specially...

krb5 security, bug fix, and enhancement update

1.15.1-34 - In FIPS mode, add plaintext fallback for RC4 usages and taint - Resolves: 1570600 1.15.1-33 - Use SHA-256 instead of MD5 for audit ticket IDs - Resolves: 1570600 1.15.1-32 - Include preauth name in trace output if possible - Update cert generation scripts to work on modern openssl - F...

poppler/pdf_fuzzer: Use-of-uninitialized-value in Parser::makeStream

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5732071763345408 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz targ...

graphicsmagick/coder_MVG_fuzzer: Use-of-uninitialized-value in DrawPolygonPrimitive

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5667792141942784 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderMVGfuzzer Fuzz target binary: coderMVGfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

imagemagick/encoder_mvg_fuzzer: Use-of-uninitialized-value in RenderMVGContent

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5631587849338880 Project: imagemagick Fuzzer: libFuzzerimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

glib/fuzz_markup: Use-of-uninitialized-value in g_utf8_get_char_extended

Detailed report: https://oss-fuzz.com/testcase?key=6336979020021760 Project: glib Fuzzer: libFuzzerglibfuzzmarkup Fuzz target binary: fuzzmarkup Job Type: libfuzzermsanglib Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gutf8getcharextended...

libpcap/fuzz_both: Use-of-uninitialized-value in pcap_nametonetaddr

Detailed report: https://oss-fuzz.com/testcase?key=5754994205130752 Project: libpcap Fuzzer: libFuzzerlibpcapfuzzboth Fuzz target binary: fuzzboth Job Type: libfuzzermsanlibpcap Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: pcapnametonetaddr genscode...

Linux systemd Line Splitting

systemd: reexec state injection: fgets on overlong lines leads to line splitting CVE-2018-15686 I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When system...

Linux systemd Line Splitting Exploit

Linux has an issue with systemd where overlong input to fgets during reexec state injection can lead to line splitting. systemd: reexec state injection: fgets on overlong lines leads to line splitting CVE-2018-15686 I am sending this bug report to Ubuntu, even though it's an upstream bug, as...

Xpdf Denial of Service Vulnerability (CNVD-2019-17487)

Xpdf is a free PDF viewer and toolkit that includes a text extractor, image converter, HTML converter and more. A denial of service vulnerability exists in XRef::readXRefStream in XRef.cc in Xpdf 4.00. An attacker can exploit this vulnerability to cause a denial of service integer overflow via a...

UBUNTU-CVE-2018-18650

An issue was discovered in Xpdf 4.00. XRef::readXRefStream in XRef.cc allows attackers to launch a denial of service Integer Overflow via a crafted /Size value in a pdf file, as demonstrated by pdftohtml. This is mainly caused by the program attempting a malloc operation for a large amount of...

CVE-2018-18650

An issue was discovered in Xpdf 4.00. XRef::readXRefStream in XRef.cc allows attackers to launch a denial of service Integer Overflow via a crafted /Size value in a pdf file, as demonstrated by pdftohtml. This is mainly caused by the program attempting a malloc operation for a large amount of...

UBUNTU-CVE-2018-18651

An issue was discovered in Xpdf 4.00. catalog-getNumPages in AcroForm.cc allows attackers to launch a denial of service hang caused by large loop via a specific pdf file, as demonstrated by pdftohtml. This is mainly caused by a large number after the /Count field in the file...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in jbig2_arith_decode

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5674434795405312 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

skia/android_codec: Use-of-uninitialized-value in swizzle_index_to_n32

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5767443453050880 Project: skia Fuzzer: libFuzzerskiaandroidcodec Fuzz target binary: androidcodec Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Code injection

A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize function to prevent a malicious contract from being called, but the attacker can bypass it by writing t...

CVE-2018-17877

A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize function to prevent a malicious contract from being called, but the attacker can bypass it by writing t...