gnutls: Heap-buffer-overflow in cdk_pkt_read

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6104165726027776 Project: gnutls Fuzzer: libFuzzergnutlsopenpgpcertparserfuzzer Fuzz target binary: gnutlsopenpgpcertparserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux...

libreoffice: Heap-buffer-overflow in XPMReader::ImplGetColKey

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6533003043930112 Project: libreoffice Fuzzer: libFuzzerlibreofficexpmfuzzer Fuzz target binary: xpmfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

libreoffice: Heap-buffer-overflow in XBMReader::ParseDefine

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5027840210763776 Project: libreoffice Fuzzer: libFuzzerlibreofficexbmfuzzer Fuzz target binary: xbmfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

gnutls: Heap-buffer-overflow in read_attribute

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4915014171361280 Project: gnutls Fuzzer: libFuzzergnutlsopenpgpcertparserfuzzer Fuzz target binary: gnutlsopenpgpcertparserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux...

sqlite3: Heap-buffer-overflow in instrFunc

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5694101458518016 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x63400001dcc0 Crash State:...

shopify-scripts: Heap use-after-free during range creation

rangecheck can trigger a stack extension via mrbfuncall if there are many arguments passed to the equivalence test. The stack extension changes the address of the stack, though the old stack address is used when assigning the value of the range. This causes a write into the old heap allocation,...

json: Heap-buffer-overflow in nlohmann::basic_json<std::__1::map, std::__1::vector, std::__1::basic_string<cha

Project: https://github.com/nlohmann/json.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6040962799239168 Project: json Fuzzer: libFuzzerjsonfuzzer-parsemsgpack Fuzz target binary: fuzzer-parsemsgpack Job Type: libfuzzerasanjson Platform Id: linux Crash Type:...

gnutls: Heap-buffer-overflow in read_attribute

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6667435805507584 Project: gnutls Fuzzer: libFuzzergnutlsopenpgpcertparserfuzzer Fuzz target binary: gnutlsopenpgpcertparserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux...

shopify-scripts: heap-buffer-overflow on mruby

Test case: A = 'z' C = 'a','a','a','a','a','a','a','a','a','a' I = C,'a','a','a','a','a','a','a','a','a' J = I,'a','a','a','a','a','a','a','a','a' M = A,A,A,J for a in M do AA end IMPACT ASAN report this as heap-buffer-overflow, and it crashed on 0 memcpysse2unaligned at...

shopify-scripts: Read after free in mrb_vm_exec with OP_ARYCAT reading R(B)

Hi, Slightly different one, this is a use after free as reported by an ASAN compiled binary. This one doesn't affect mruby-engine with the current instruction limit and memory limit, but if they are increased then it does. The file is: class Klazz def $thing.name [email protected]@thing.name nil end...

libarchive: Heap-buffer-overflow in archive_le32dec

Project: https://github.com/libarchive/libarchive.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4591448766808064 Target: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzzer binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type:...

pcre2: Heap-buffer-overflow in read_repeat_counts

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4719096310530048 Fuzzer: libFuzzerpcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x603000000118 Crash State:...

Wireshark - erf_meta_read_tag SIGSEGV

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=803 The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file": --- cut --- ==28415==ERROR:...

Wireshark - erf_meta_read_tag SIGSEGV

Wireshark - erfmetareadtag SIGSEGV Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=803 The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr...

Wireshark - erf_meta_read_tag SIGSEGV

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=803 The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark...

Internet Bug Bounty: Integer underflow / arbitrary null write in fread/gzread

https://bugs.php.net/bug.php?id=72114 Integer underflow in the fread/gzread length parameter allows to write an arbitrary null byte on 64 bit platforms. This was identified with the help of ASAN and a custom fuzzer. gdb run gzread2.php Starting program: /home/operac/php/php-56/sapi/cli/php...

Graphite2 - GlyphCache::GlyphCache Heap Based Buffer Overflow

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=749 The following crash due to a heap-based buffer overflow can be observed in a slightly modified ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered wi...

Graphite2 - GlyphCache::Loader Heap Based Overreads

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=751 The following crashes due to two different heap-based buffer overreads can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with...

Graphite2 - TtfUtil::CheckCmapSubtable12 Heap Overread

Graphite2 - TtfUtil::CheckCmapSubtable12 Heap Overread Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=752 The following crash due to a heap-based buffer overread can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the followi...

Graphite2 - GlyphCache::GlyphCache Heap Buffer Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=749 The following crash due to a heap-based buffer overflow can be observed in a slightly modified ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the following command: $ ./gr2fonttest...