freetype2: Heap-buffer-overflow in tt_size_reset

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6627871858622464 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type:...

shopify-scripts: Denial of service (segfault) due to null pointer dereference in mrb_obj_instance_eval

Introduction ============ Provided PoC segfaults at mrbobjinstanceeval due to null pointer dereference. Proof of concept ================ Attached the poc. Crash report ============ ./sandbox eval.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000003 ruby 2.3.1p112 2016-04-26 x8664-linux-gn...

Apple WebKit HTMLFormElement::reset() Use-After-Free

Apple WebKit: HTMLFormElement::reset use-after free. CVE-2017-2362 PoC: ================================================================= function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i f...

Apple WebKit - HTMLFormElement::reset() Use-After Free Exploit

Exploit for macOS platform in category dos / poc function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo associatedElement downcastassociatedElement.reset; The issue is that while...

libarchive: Heap-buffer-overflow in archive_read_format_cpio_read_header

Project: https://github.com/libarchive/libarchive.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5205694638718976 Project: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type:...

libarchive: Heap-buffer-overflow in lzx_make_huffman_table

Project: https://github.com/libarchive/libarchive.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4538351478636544 Project: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type:...

lcms: Heap-use-after-free in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5428245918908416 Project: lcms Fuzzer: libFuzzerlcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: libfuzzerasanlcms Platform Id: linux Crash Type:...

ffmpeg: Crash in ff_put_pixels16_sse2

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6020152642502656 Project: ffmpeg Fuzzer: libFuzzerffmpegVIDEOAVCODECIDH264fuzzer Fuzz target binary: ffmpegVIDEOAVCODECIDH264fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5333448038285312 Project: lcms Fuzzer: libFuzzerlcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: libfuzzerasanlcms Platform Id: linux Crash Type:...

libarchive: Heap-buffer-overflow in strtoi_lim

Project: https://github.com/libarchive/libarchive.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5730919075807232 Project: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type:...

ffmpeg: Heap-buffer-overflow in ipvideo_decode_block_opcode_0xA

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4850119698546688 Project: ffmpeg Fuzzer: libFuzzerffmpegVIDEOAVCODECIDINTERPLAYVIDEOfuzzer Fuzz target binary: ffmpegVIDEOAVCODECIDINTERPLAYVIDEOfuzzer Job Type: libfuzzerasanffmpeg...

libreoffice: Crash in WinMtfOutput::DrawText

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6116030539628544 Project: libreoffice Fuzzer: libFuzzerlibreofficewmffuzzer Fuzz target binary: wmffuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

icu: Heap-buffer-overflow in utf8TextAccess

Project: https://github.com/unicode-org/icu.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4645398303997952 Project: icu Fuzzer: libFuzzericuucasemapfuzzer Fuzz target binary: ucasemapfuzzer Job Type: libfuzzerasanicu Platform Id: linux Crash Type: Heap-buffer-overflow...

libass: Attempting free in process_info_line

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6313592492130304 Project: libass Fuzzer: libFuzzerlibassfuzzer Fuzz target binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Attempting free Crash...

file: Attempting free in apprentice_map

Project: https://github.com/file/file.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5095269284708352 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Attempting free Crash Address...

libass: Attempting free in ass_free_track

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6177355424858112 Project: libass Fuzzer: libFuzzerlibassfuzzer Fuzz target binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Attempting free Crash...

libass: Attempting free in ass_free_track

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5883308542001152 Project: libass Fuzzer: libFuzzerlibassfuzzer Fuzz target binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Attempting free Crash...

libass: Attempting free in ass_render_event

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5582267204239360 Project: libass Fuzzer: libFuzzerlibassfuzzer Fuzz target binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Attempting free Crash...

gnutls: Attempting free in _gnutls_buffer_append_printf

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5494487300177920 Project: gnutls Fuzzer: libFuzzergnutlsx509parserfuzzer Fuzz target binary: gnutlsx509parserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux Crash Type:...

libass: Attempting free in parse_events

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5420800962199552 Project: libass Fuzzer: libFuzzerlibassfuzzer Fuzz target binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Attempting free Crash...