wireshark/fuzzshark_ip_proto-udp: Heap-buffer-overflow in decode_udvm_multitype_operand

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=6309871403139072 Project: wireshark Fuzzer: aflwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: aflasanwireshark Platform Id: linux Crash Type:...

imagemagick/encoder_miff_fuzzer: Use-of-uninitialized-value in ParseGeometry

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5690482123341824 Project: imagemagick Fuzzer: libFuzzerimagemagickencodermifffuzzer Fuzz target binary: encodermifffuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

skia/image_filter_deserialize: Stack-use-after-scope in SkDraw::drawVertices

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=6240157272375296 Project: skia Fuzzer: aflskiaimagefilterdeserialize Fuzz target binary: imagefilterdeserialize Job Type: aflasanskia Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Cras...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in jbig2_end_of_stripe

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5247757901103104 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

imagemagick/enhance_fuzzer: Use-of-uninitialized-value in EnhanceImage

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5403929488654336 Project: imagemagick Fuzzer: libFuzzerimagemagickenhancefuzzer Fuzz target binary: enhancefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

imagemagick/encoder_epsi_fuzzer: Heap-use-after-free in DestroyXMLTreeAttributes

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4547399008649216 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderepsifuzzer Fuzz target binary: encoderepsifuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

dlplibs/wqfuzzer: Heap-buffer-overflow in QuattroSpreadsheet::updateCellWithUserFormat

Detailed report: https://oss-fuzz.com/testcase?key=4888370288263168 Project: dlplibs Fuzzer: libFuzzerdlplibswqfuzzer Fuzz target binary: wqfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x611000001510 Crash State:...

open62541/fuzz_binary_message: Heap-use-after-free in UA_SecureChannel_deleteMembersCleanup

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=6595691192254464 Project: open62541 Fuzzer: aflopen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: aflasanopen62541 Platform Id: linux Crash Type: Heap-use-after-free READ...

Microsoft Edge Chakra JIT Loop Analysis Bug

Microsoft Edge: Chakra: JIT: Loop analysis bug CVE-2018-0777 Here's the PoC demonstrating OOB write. function optarr, start, end for let i = start; i end; i++ if i === 10 i += 0; // -- a arri = 2.3023e-320; function main let arr = new Array100; arr.fill1.1; for let i = 0; i 1000; i++ optarr, 0, 3...

imagemagick/encoder_sixel_fuzzer: Heap-buffer-overflow in ResetMagickMemory

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4971915790778368 Project: imagemagick Fuzzer: aflimagemagickencodersixelfuzzer Fuzz target binary: encodersixelfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

Microsoft Edge Chakra JIT Incorrect Bounds Calculation

Microsoft Edge: Chakra: JIT: Incorrect bounds calculation CVE-2018-0769 Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method. // Track bounds for add or sub with a constant. For instance, consider b = a + 2. The value of 'b' should track // that it is equal to the...

imagemagick/encoder_xpm_fuzzer: Use-of-uninitialized-value in ParseCommandOption

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5459937892237312 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderxpmfuzzer Fuzz target binary: encoderxpmfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

dlplibs/marinerwrtfuzzer: Heap-buffer-overflow in WriterPlsParserInternal::WindowsInfo::getColumnLimitsFor

Detailed report: https://oss-fuzz.com/testcase?key=4712010408263680 Project: dlplibs Fuzzer: libFuzzerdlplibsmarinerwrtfuzzer Fuzz target binary: marinerwrtfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x603000000840 Crash State:...

libreoffice/htmlfuzzer: Heap-use-after-free in SwTextFootnote::GetTextNode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5183158522740736 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

Microsoft Edge Chakra JIT Op_MaxInAnArray / Op_MinInAnArray Misuse

Microsoft Edge: Chakra: JIT: OpMaxInAnArray and OpMinInAnArray can explicitly call user defined JavaScript functions CVE-2017-11893 1. Call patterns like "Math.max.applyMath, 1, 2, 3, 4, 5" and "Math.max.applyMath, arr" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" i...

libreoffice/fodsfuzzer: Heap-use-after-free in cppu::_destructData

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4963204691132416 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

gdal/cad_fuzzer: in CADHandle::getAsLong

Detailed report: https://oss-fuzz.com/testcase?key=6093626703609856 Project: gdal Fuzzer: aflgdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: READ 8 Crash Address: 0x6020000428dd Crash State: CADHandle::getAsLong DWGFileRNUMBER::GetNOD...

libreoffice/htmlfuzzer: Bad-cast to SwTableBox from SwClient in DelBoxNode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5494093451886592 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

gdal/gdal_fuzzer: Crash in extpdstemplate

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5287456308985856 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00002072b678 Crash...

wireshark/fuzzshark_ip: Crash in dissect_nbap_TransportFormatSet_NrOfTransportBlocks

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=5076896275496960 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerubsanwireshark Platform Id: linux Crash Type: UNKNOWN WRITE Crash...