2990 matches found
Heap-based Buffer Overflow in hoene/libmysofa
Description system : ubuntu 20.04 build command cd libmysofa mkdir build cd build CC=clang CXX=clang++ CFLAGS="-fsanitize=address -g" CXXFLAGS="-fsanitize=address -g" cmake ../ make all run cmd ./mysofa2json -c ./heapoobreadmemcpy ./mysofa2json -c ./heapoobread Proof of Concept poc 1 :...
Heap-based Buffer Overflow in vim/vim
When fuzzing vim commit 56858e4ed works with latest build with clang 12 and ASan, I discovered a heap buffer overflow. Proof of Concept Here is minimized poc sh /%.v 5/ c Extract then run crafted file with this command vim -u NONE -X -Z -e -s -S vimpoc1 -c :qa! ASan stack trace: bash...
Heap-based Buffer Overflow in squell/id3
✍️ Description Hello! We compiled id3 from commit 857ac8 with Clang-13 + ASan, and we discovered a crafted file which triggers a heap-buffer-overflow, WRITE of size 1. This and the previous bug were discovered with the help of honggfuzz. 🕵️♂️ Proof of Concept echo...
Heap-based Buffer Overflow in squell/id3
✍️ Description Hello! We compiled id3 from commit 857ac8 with Clang-13 + ASan, and we discovered a crafted file which triggers a negative-size-param and a heap-buffer-overflow with a READ of size 40987248. But for the purposes of this report, we are going to look at the heap-buffer-overflow, as it...
in lavv17/lftp
✍️ Description Whilst testing lftp built from commit d67fc1 with Clang 13 +ASan on Ubuntu 20.04.2 LTS, we discovered a crafted file which triggers a null pointer dereference and segfault. 🕵️♂️ Proof of Concept echo "aiYgAQEBNA==" | base64 -d /tmp/file.fuzz && ./lftp -f /tmp/file.fuzz The above POC...
Heap-based Buffer Overflow in squell/id3
✍️ Description While testing id3 built from commit 0de713 with Clang 13 +ASan on Ubuntu 20.04.2, we discovered a POC which triggers a heap-buffer-overflow in tag::unbinarize. This particular flaw was discovered with the help of honggfuzz. 🕵️♂️ Proof of Concept echo...
Heap-based Buffer Overflow in squell/id3
✍️ Description Archive.org is a worthy cause to support. 👍 During testing of id3 compiled from commit a899ea with Clang 13+ASan on Ubuntu 20.04.2, we discovered a payload which triggers a heap-buffer-overflow in ID3put. This particular bug was found using the AFL fuzzer. 🕵️♂️ Proof of Concept echo...
in squell/id3
✍️ Description Archive.org is a worthy cause to support. 👍 During testing of id3 compiled from commit a899ea with Clang 13+ASan on Ubuntu 20.04.2, we discovered a payload which triggers a negative-size-param: size=-4 error when calling memcpy. This particular bug was discovered with the AFL fuzzer...
Heap-based Buffer Overflow in squell/id3
✍️ Description When running the id3 app built from commit 51e738 with Clang 13 +ASan on Ubuntu 20.04.2 against the test data file encoding.tag, a heap-buffer-overflow is triggered at https://github.com/squell/id3/blob/51e738e7575c54fd7fdd54c931a155b25c3f2d30/id3v2.cL104. static ulong ul4uchar n4...
in mcfriend99/bird
✍️ Description Heap-based 1-byte write violation. Certain programs can cause the parser/syntax-checker to write out of bounds. The below program writes a single byte out of bounds. 🕵️♂️ Proof of Concept Program: var a = 'outer' def test var a = 'inner' echo 'It works! $a' echo a echo test test def...
Stack-based Buffer Overflow in codeplea/tinyexpr
✍️ Description Whilst experimenting with repl built from commit 61af1d, with Clang 10 +ASan on Ubuntu 20.04.2 LTS, we discovered an expression containing 4 null characters after a newline which, due to insufficient bounds checking, triggers a stack-buffer-overflow. 🕵️♂️ Proof of Concept echo...
Heap-based Buffer Overflow in croatiacontrolltd/asterix
✍️ Description Whilst experimenting with asterix, built from commit f44cfea, compiled with Clang 10 + ASan on Ubuntu 20.04.2 LTS, we are able to induce a heap-buffer-overflow in DataItemBits::getBits asterix/src/asterix/DataItemBits.cpp:125. Since there is no bounds checking, when the software...
Security update for neomutt (moderate)
openSUSE Security Update: Security update for neomutt Announcement ID: openSUSE-SU-2020:2158-1 Rating: moderate References: 1172906 1172935 1173197 1179035 1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Backports SLE-15-SP2 An...
serenity:FuzzGIFLoader: Global-buffer-overflow in Gfx::decode_frame
Detailed Report: https://oss-fuzz.com/testcase?key=6281737226944512 Project: serenity Fuzzing Engine: afl Fuzz Target: FuzzGIFLoader Job Type: aflasanserenity Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000000784fb0 Crash State: Gfx::decodeframe...
serenity:FuzzPNGLoader: Heap-buffer-overflow in decode
Detailed Report: https://oss-fuzz.com/testcase?key=6265409137016832 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzPNGLoader Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x604000000100 Crash State: decode codes fixed...
serenity:FuzzBMPLoader: Heap-buffer-overflow in Gfx::Streamer::read_u8
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=6281654599155712 Project: serenity Fuzzing Engine: afl Fuzz Target: FuzzBMPLoader Job Type: aflasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6110000002...
serenity:FuzzICOLoader: Stack-use-after-return in AK::Vector<unsigned char, 0ul>::clear_with_capacity
Detailed Report: https://oss-fuzz.com/testcase?key=4888328016756736 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzICOLoader Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address: 0x7f38f034ea70 Crash State:...
llvm:llvm-dwarfdump-fuzzer: Heap-buffer-overflow in llvm::StringMapImpl::LookupBucketFor
Detailed Report: https://oss-fuzz.com/testcase?key=5071836601384960 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x607000000148 Crash State:...
llvm:llvm-opt-fuzzer--x86_64-guard_widening: Heap-use-after-free in llvm::Value::setValueName
Detailed Report: https://oss-fuzz.com/testcase?key=5720028133195776 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-opt-fuzzer--x8664-guardwidening Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6210000094b0 Crash State:...
serenity:FuzzBMP: Heap-buffer-overflow in Gfx::decode_bmp_pixel_data
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5380810148151296 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzBMP Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...