imagemagick/encoder_epsi_fuzzer: Heap-use-after-free in DestroyXMLTreeAttributes

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4547399008649216 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderepsifuzzer Fuzz target binary: encoderepsifuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

dlplibs/wqfuzzer: Heap-buffer-overflow in QuattroSpreadsheet::updateCellWithUserFormat

Detailed report: https://oss-fuzz.com/testcase?key=4888370288263168 Project: dlplibs Fuzzer: libFuzzerdlplibswqfuzzer Fuzz target binary: wqfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x611000001510 Crash State:...

open62541/fuzz_binary_message: Heap-use-after-free in UA_SecureChannel_deleteMembersCleanup

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=6595691192254464 Project: open62541 Fuzzer: aflopen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: aflasanopen62541 Platform Id: linux Crash Type: Heap-use-after-free READ...

Microsoft Edge Chakra JIT Loop Analysis Bug

Microsoft Edge: Chakra: JIT: Loop analysis bug CVE-2018-0777 Here's the PoC demonstrating OOB write. function optarr, start, end for let i = start; i end; i++ if i === 10 i += 0; // -- a arri = 2.3023e-320; function main let arr = new Array100; arr.fill1.1; for let i = 0; i 1000; i++ optarr, 0, 3...

imagemagick/encoder_sixel_fuzzer: Heap-buffer-overflow in ResetMagickMemory

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4971915790778368 Project: imagemagick Fuzzer: aflimagemagickencodersixelfuzzer Fuzz target binary: encodersixelfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

Microsoft Edge Chakra JIT Incorrect Bounds Calculation

Microsoft Edge: Chakra: JIT: Incorrect bounds calculation CVE-2018-0769 Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method. // Track bounds for add or sub with a constant. For instance, consider b = a + 2. The value of 'b' should track // that it is equal to the...

imagemagick/encoder_xpm_fuzzer: Use-of-uninitialized-value in ParseCommandOption

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5459937892237312 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderxpmfuzzer Fuzz target binary: encoderxpmfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

dlplibs/marinerwrtfuzzer: Heap-buffer-overflow in WriterPlsParserInternal::WindowsInfo::getColumnLimitsFor

Detailed report: https://oss-fuzz.com/testcase?key=4712010408263680 Project: dlplibs Fuzzer: libFuzzerdlplibsmarinerwrtfuzzer Fuzz target binary: marinerwrtfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x603000000840 Crash State:...

libreoffice/htmlfuzzer: Heap-use-after-free in SwTextFootnote::GetTextNode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5183158522740736 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

Microsoft Edge Chakra JIT Op_MaxInAnArray / Op_MinInAnArray Misuse

Microsoft Edge: Chakra: JIT: OpMaxInAnArray and OpMinInAnArray can explicitly call user defined JavaScript functions CVE-2017-11893 1. Call patterns like "Math.max.applyMath, 1, 2, 3, 4, 5" and "Math.max.applyMath, arr" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" i...

libreoffice/fodsfuzzer: Heap-use-after-free in cppu::_destructData

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4963204691132416 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

gdal/cad_fuzzer: in CADHandle::getAsLong

Detailed report: https://oss-fuzz.com/testcase?key=6093626703609856 Project: gdal Fuzzer: aflgdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: READ 8 Crash Address: 0x6020000428dd Crash State: CADHandle::getAsLong DWGFileRNUMBER::GetNOD...

libreoffice/htmlfuzzer: Bad-cast to SwTableBox from SwClient in DelBoxNode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5494093451886592 Project: libreoffice Fuzzer: libFuzzerlibreofficehtmlfuzzer Fuzz target binary: htmlfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

gdal/gdal_fuzzer: Crash in extpdstemplate

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5287456308985856 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00002072b678 Crash...

wireshark/fuzzshark_ip: Crash in dissect_nbap_TransportFormatSet_NrOfTransportBlocks

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=5076896275496960 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerubsanwireshark Platform I...

unrar/unrar_fuzzer: NULL

Detailed report: https://oss-fuzz.com/testcase?key=6436091927199744 Project: unrar Fuzzer: libFuzzerunrarfuzzer Fuzz target binary: unrarfuzzer Job Type: libfuzzermsanunrar Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: NULL Sanitizer: memory MSAN Recommende...

unrar/unrar_fuzzer: Use-of-uninitialized-value in IsRelativeSymlinkSafe

Detailed report: https://oss-fuzz.com/testcase?key=5604229642190848 Project: unrar Fuzzer: libFuzzerunrarfuzzer Fuzz target binary: unrarfuzzer Job Type: libfuzzermsanunrar Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: IsRelativeSymlinkSafe ExtractUnixLink3...

yara/macho_fuzzer: Heap-buffer-overflow in macho_handle_segment_64_be

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5917108346028032 Project: yara Fuzzer: libFuzzeryaramachofuzzer Fuzz target binary: machofuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

wpantund/wpantund-fuzz: Heap-use-after-free in in6_addr_to_string

Detailed report: https://oss-fuzz.com/testcase?key=5971366667878400 Project: wpantund Fuzzer: libFuzzerwpantundwpantund-fuzz Fuzz target binary: wpantund-fuzz Job Type: libfuzzerasanwpantund Platform Id: linux Crash Type: Heap-use-after-free READ 16 Crash Address: 0x63100019f7f5 Crash State:...

open62541/fuzz_binary_decode: Heap-use-after-free in UA_Array_copy

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5212581976342528 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarydecode Fuzz target binary: fuzzbinarydecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type:...