CVE-2018-17877

A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize function to prevent a malicious contract from being called, but the attacker can bypass it by writing t...

CVE-2018-17968

A gambling smart contract implementation for RuletkaIo, an Ethereum gambling game, generates a random value that is predictable by an external contract call. The developer wrote a random function that uses a block timestamp and block hash from the Ethereum blockchain. This can be predicted by...

librawspeed/VC5DecompressorFuzzer: Use-of-uninitialized-value in rawspeed::VC5Decompressor::parseLargeCodeblock

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5744163321020416 Project: librawspeed Fuzzer: libFuzzerlibrawspeedVC5DecompressorFuzzer Fuzz target binary: VC5DecompressorFuzzer Job Type: libfuzzermsanlibrawspeed Platform Id: linux Crash...

harfbuzz/hb-shape-fuzzer: Use-of-uninitialized-value in bool hb_sanitize_context_t::check_array<OT::IntType<unsigned char, 1u> >

Detailed report: https://oss-fuzz.com/testcase?key=5097734906839040 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: bool...

CVE-2018-18438

Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value...

CVE-2018-18438

Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value...

GHSA-CR6J-3JP9-RW65 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace...

CVE-2018-12366

An invalid grid size during QCMS color profile transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox ESR 52.9, and Firefox 61...

Cisco FXOS and NX-OS Denial of Service Vulnerabilities

Cisco FXOS is the Firepower extensible operating system.Cisco NX-OS is the network operating system for the Cisco Nexus family of Ethernet switches and the MDS family of Fibre Channel storage area network switches. A denial of service vulnerability exists in the implementation of Link Layer...

harfbuzz/hb-shape-fuzzer: Use-of-uninitialized-value in AAT::KerxSubTableFormat6::get_kerning

Detailed report: https://oss-fuzz.com/testcase?key=5634395566768128 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

GHSA-R9CH-M4FH-FC7Q Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in fz_unpack_tile

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5716394679730176 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

Incorrect value comparison in Ruby openssl

An issue was discovered in the OpenSSL library in Ruby when two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one...

foreman: Stored XSS in fact name or value

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

bouncycastle: Information exposure in DSA signature generation via timing attack

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

CVE-2018-18384

Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12...

harfbuzz/hb-shape-fuzzer: Use-of-uninitialized-value in AAT::LookupFormat0<OT::IntType<unsigned short, 2u> >::get_value

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5659641787187200 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type:...

unicorn/fuzz_emu_arm64_arm: Use-of-uninitialized-value in float64_squash_input_denormal_aarch64

Project: https://github.com/unicorn-engine/unicorn.git Detailed report: https://oss-fuzz.com/testcase?key=5747203419668480 Project: unicorn Fuzzer: libFuzzerunicornfuzzemuarm64arm Fuzz target binary: fuzzemuarm64arm Job Type: libfuzzermsanunicorn Platform Id: linux Crash Type:...

libpcap/fuzz_both: Use-of-uninitialized-value in pcap_filter_with_aux_data

Project: https://github.com/the-tcpdump-group/libpcap.git Detailed report: https://oss-fuzz.com/testcase?key=5699403956879360 Project: libpcap Fuzzer: libFuzzerlibpcapfuzzboth Fuzz target binary: fuzzboth Job Type: libfuzzermsanlibpcap Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

imagemagick/encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::identify

Detailed report: https://oss-fuzz.com/testcase?key=5071707965489152 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderdngfuzzer Fuzz target binary: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...