clamav/clamav_scanfile_PE_fuzzer: Heap-buffer-overflow in unaspack

Detailed report: https://oss-fuzz.com/testcase?key=5673520888020992 Project: clamav Fuzzer: aflclamavscanfilePEfuzzer Fuzz target binary: clamavscanfilePEfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60200000700d Crash State: unaspack...

ASAN/SUID - Local Privilege Escalation

!/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a vulnerable system. Supply your own targe...

ASANSUID - Local Privilege Escalation

ASANSUID - Local Privilege Escalation !/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a...

libarchive/libarchive_fuzzer: Stack-buffer-overflow in parse_tables

Project: https://github.com/libarchive/libarchive.git Detailed report: https://oss-fuzz.com/testcase?key=5700900719427584 Project: libarchive Fuzzer: afllibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: aflasanlibarchive Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 7...

ffmpeg/ffmpeg_AV_CODEC_ID_HYMT_fuzzer: Heap-buffer-overflow in decode_422_bitstream

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5705567736168448 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDHYMTfuzzer Fuzz target binary: ffmpegAVCODECIDHYMTfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Cras...

Internet Bug Bounty: Heap Buffer Overflow (READ: 4) in phar_parse_pharfile

Phar files with HALTCOMPILER; in unexpected places can lead to a buffer overrun. This is something I found while fuzzing with AFL using an ASAN instrumented PHP. The issue can be observed by disabling the ZEND allocator and using ASAN or valgrind/etc? with a crafted phar as input. I have prepared...

Wireshark - get_t61_string Heap Out-of-Bounds Read

Wireshark - gett61string Heap Out-of-Bounds Read The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of Wireshark, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file". --- cut ---...

Wireshark - 'get_t61_string' Heap Out-of-Bounds Read

The following crash due to a heap-based out-of-bounds memory read can be observed in an ASAN build of Wireshark, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file". --- cut --- ================================================================= ==16936==ERROR: AddressSanitizer:...

Internet Bug Bounty: Buffer over-write in finfo_open with malformed magic file.

https://bugs.php.net/bug.php?id=71527 This bug causes a segfault when running with environment variable USEZENDALLOC set to 0, and also when compiled with ASAN with USEZENDALLOC set and unset. To reproduce, run the following PHP file, with the example magic file below. $ cat magic-open.php Magic...

yara/dex_fuzzer: Heap-buffer-overflow in read_uleb128

Detailed report: https://oss-fuzz.com/testcase?key=5664859499266048 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60d000000261 Crash State: readuleb128...

libidn2/libidn2_to_ascii_8z_fuzzer: Heap-buffer-overflow in idn2_to_ascii_4i

Project: https://gitlab.com/libidn/libidn2.git Detailed report: https://oss-fuzz.com/testcase?key=5644466457673728 Project: libidn2 Fuzzer: libFuzzerlibidn2toascii8zfuzzer Fuzz target binary: libidn2toascii8zfuzzer Job Type: libfuzzerasanlibidn2 Platform Id: linux Crash Type: Heap-buffer-overflow...

libxml2/libxml2_xml_reader_for_file_fuzzer: Heap-double-free in xmlFreeID

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=5633679915745280 Project: libxml2 Fuzzer: afllibxml2xmlreaderforfilefuzzer Fuzz target binary: libxml2xmlreaderforfilefuzzer Job Type: aflasanlibxml2 Platform Id: linux Crash Type:...

radare2/ia_fuzz: Heap-buffer-overflow in r_read_le32

Project: https://github.com/radare/radare2.git Detailed report: https://oss-fuzz.com/testcase?key=5741698980773888 Project: radare2 Fuzzer: aflradare2iafuzz Fuzz target binary: iafuzz Job Type: aflasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x629000027622...

ffmpeg/ffmpeg_AV_CODEC_ID_HYMT_fuzzer: Crash in ff_add_left_pred_unaligned_avx2

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5722087214284800 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDHYMTfuzzer Fuzz target binary: ffmpegAVCODECIDHYMTfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: UNKNOWN WRITE Crash...

ffmpeg/ffmpeg_AV_CODEC_ID_HYMT_fuzzer: Crash in ff_bswap32_buf_avx2

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5662313959391232 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDHYMTfuzzer Fuzz target binary: ffmpegAVCODECIDHYMTfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

gdal/gdal_translate_fuzzer: Heap-buffer-overflow in VSIMemHandle::Read

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5757307697233920 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Fuzz target binary: gdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

openvswitch/ofctl_parse_target: Heap-buffer-overflow in encode_LEARN

Project: https://github.com/openvswitch/ovs.git Detailed report: https://oss-fuzz.com/testcase?key=5651435740463104 Project: openvswitch Fuzzer: libFuzzeropenvswitchofctlparsetarget Fuzz target binary: ofctlparsetarget Job Type: libfuzzerasanopenvswitch Platform Id: linux Crash Type:...

harfbuzz/hb-shape-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5631444412530688 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow...

tidy-html5/tidy_fuzzer: Crash in GetSurrogatePair

Project: https://github.com/htacg/tidy-html5.git Detailed report: https://oss-fuzz.com/testcase?key=5123069669015552 Project: tidy-html5 Fuzzer: libFuzzertidy-html5tidyfuzzer Fuzz target binary: tidyfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

envoy/h1_capture_fuzz_test: Crash in Envoy::TestUtility::findCounter

Detailed report: https://oss-fuzz.com/testcase?key=5760304764420096 Project: envoy Fuzzer: libFuzzerenvoyh1capturefuzztest Fuzz target binary: h1capturefuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f23827ad980 Crash State:...