freetype2/cidtype1: Heap-buffer-overflow in cff_parser_run

Detailed report: https://oss-fuzz.com/testcase?key=5663020483608576 Project: freetype2 Fuzzer: libFuzzerfreetype2cidtype1 Fuzz target binary: cidtype1 Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x60800000007a Crash State: cffparserr...

openvswitch/odp_target: Stack-buffer-overflow in nullable_memcpy

Project: https://github.com/openvswitch/ovs.git Detailed report: https://oss-fuzz.com/testcase?key=5734833108549632 Project: openvswitch Fuzzer: libFuzzeropenvswitchodptarget Fuzz target binary: odptarget Job Type: libfuzzerasanopenvswitch Platform Id: linux Crash Type: Stack-buffer-overflow READ...

wpantund/wpantund-fuzz: Heap-use-after-free in TunnelIPv6Interface::remove_address

Project: https://github.com/openthread/wpantund.git Detailed report: https://oss-fuzz.com/testcase?key=5656107263983616 Project: wpantund Fuzzer: aflwpantundwpantund-fuzz Fuzz target binary: wpantund-fuzz Job Type: aflasanwpantund Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash...

openvswitch/odp_target: Heap-buffer-overflow in format_generic_odp_key

Project: https://github.com/openvswitch/ovs.git Detailed report: https://oss-fuzz.com/testcase?key=5677587590807552 Project: openvswitch Fuzzer: libFuzzeropenvswitchodptarget Fuzz target binary: odptarget Job Type: libfuzzerasanopenvswitch Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

wireshark/fuzzshark_ip: Crash in do_throw

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=5729492048281600 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type: UNKNOWN READ Crash...

wireshark/fuzzshark_ip: Global-buffer-overflow in except_pop

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=5654078294589440 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkip Fuzz target binary: fuzzsharkip Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type: Global-buffer-overflow...

freetype2/bdf: Heap-buffer-overflow in bdf_cmap_char_index

Detailed report: https://oss-fuzz.com/testcase?key=5658441041838080 Project: freetype2 Fuzzer: libFuzzerfreetype2bdf Fuzz target binary: bdf Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6050000007d0 Crash State: bdfcmapcharindex...

ffmpeg/ffmpeg_AV_CODEC_ID_ILBC_fuzzer: Global-buffer-overflow in gain_dequantization

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5153255445757952 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDILBCfuzzer Fuzz target binary: ffmpegAVCODECIDILBCfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Global-buffer-overfl...

gdal/gdal_fuzzer: Crash in sqlite3VdbeExec

Detailed report: https://oss-fuzz.com/testcase?key=5755023447818240 Project: gdal Fuzzer: aflgdalfuzzer Fuzz target binary: gdalfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fe205898bdf Crash State: sqlite3VdbeExec sqlite3step sqlite3exec Sanitizer:...

systemd/fuzz-dhcp6-client: Heap-buffer-overflow in dhcp6_option_parse_status

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=5719574129934336 Project: systemd Fuzzer: aflsystemdfuzz-dhcp6-client Fuzz target binary: fuzz-dhcp6-client Job Type: aflasansystemd Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try htmlvar00028.autofocus = true; catche try...

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free Exploit

Exploit for multiple platform in category dos / poc tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit - WebCore::Node::ensureRareData Use-After-Free Exploit

Exploit for multiple platform in category dos / poc .class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche tr...

WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free Exploit

Exploit for multiple platform in category dos / poc htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001, .class1 1vmax; display:...

WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer: heap-use-after-free on address...

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free Exploit

Exploit for multiple platform in category dos / poc htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display: grid; 1s; function jsfuzzer ...

WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded

Exploit for multiple platform in category dos / poc ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try /...

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 = document.getElementById"htmlvar00049";...

open62541/fuzz_binary_message: Heap-use-after-free in UA_WorkQueue_cleanup

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5742300546727936 Project: open62541 Fuzzer: aflopen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: aflasanopen62541 Platform Id: linux Crash Type: Heap-use-after-free READ...