grpc: Heap-use-after-free in post_batch_completion

Detailed report: https://oss-fuzz.com/testcase?key=5965570207907840 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6250000c21a0 Crash State: postbatchcompletion...

shopify-scripts: heap use-after-free in mrb_vm_exec()

The code bellow triggers a heap use-after-free vulnerability: class M def M.newr super new0 end end M.new0 ASAN report : ================================================================= ==25617==ERROR: AddressSanitizer: heap-use-after-free on address 0xf4103e50 at pc 0x080f7231 bp 0xffc69ab8 sp...

libreoffice: Container-overflow in sdr::table::TableLayouter::SetBorder

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5828472368791552 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Container-overflow...

shopify-scripts: Crash in ary_concat()

The code above raises a segmentation fault both in mruby and mruby-engine N case when nil -do end def eend end ASAN report : line 1:3: '' interpreted as argument prefix ASAN:SIGSEGV ================================================================= ==111090==ERROR: AddressSanitizer: SEGV on unknow...

libxml2: Heap-buffer-overflow in xmlFAParsePosCharGroup

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=6574081912602624 Project: libxml2 Fuzzer: afllibxml2xmlregexpcompilefuzzer Fuzz target binary: libxml2xmlregexpcompilefuzzer Job Type: aflasanlibxml2 Platform Id: linux Crash Type:...

freetype2: Heap-buffer-overflow in psh_glyph_init

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://oss-fuzz.com/testcase?key=6729909500116992 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow...

ffmpeg: Global-buffer-overflow in ff_h264_filter_mb_fast

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=6515070404132864 Project: ffmpeg Fuzzer: libFuzzerffmpegVIDEOAVCODECIDH264fuzzer Fuzz target binary: ffmpegVIDEOAVCODECIDH264fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

freetype2: Heap-buffer-overflow in t1_builder_add_point

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://oss-fuzz.com/testcase?key=5773760927891456 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=5036643692052480 Project: lcms Fuzzer: afllcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: aflasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Mozilla Firefox - table Use-After-Free

Mozilla Firefox - table Use-After-Free body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

Mozilla Firefox - 'table' Use-After-Free

body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line"; document.body.appenddocument.createElement"table"; freememory uZ1CqnaASOkr...

Mozilla Firefox - table Use-After-Free Exploit

Exploit for multiple platform in category dos / poc body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=4650371647537152 Project: lcms Fuzzer: libFuzzerlcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: libfuzzerasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4...

sqlite3: Global-buffer-overflow in sqlite3VdbeMemPrettyPrint

Detailed report: https://oss-fuzz.com/testcase?key=6749820112863232 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x000002b188a8 Crash State:...

libreoffice: Heap-buffer-overflow in PPTParagraphObj::UpdateBulletRelSize

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5540228271964160 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overfl...

libreoffice: Heap-buffer-overflow in null_convert

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5499799409262592 Project: libreoffice Fuzzer: libFuzzerlibreofficejpgfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

libreoffice: Heap-use-after-free in SvxMSDffManager::SolveSolver

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4611189466202112 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...

sqlite3: Global-buffer-overflow in sqlite3VdbeMemPrettyPrint

Detailed report: https://oss-fuzz.com/testcase?key=6475706777206784 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000000860150 Crash State:...

libreoffice: Heap-use-after-free in PPTParagraphObj::GetAttrib

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4842008323555328 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...

libreoffice: Stack-buffer-overflow in CreateTableRows

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5800055606870016 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...