Heap-based Buffer Overflow in croatiacontrolltd/asterix

✍️ Description Whilst experimenting with asterix, built from commit f44cfea, compiled with Clang 10 + ASan on Ubuntu 20.04.2 LTS, we are able to induce a heap-buffer-overflow in DataItemBits::getBits asterix/src/asterix/DataItemBits.cpp:125. Since there is no bounds checking, when the software...

bleach:sanitize_fuzzer: Uncaught exception in convert_entity

Project: https://github.com/mozilla/bleach.git Detailed Report: https://oss-fuzz.com/testcase?key=6267753038217216 Project: bleach Fuzzing Engine: libFuzzer Fuzz Target: sanitizefuzzer Job Type: libfuzzerasanbleach Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

Security update for neomutt (moderate)

openSUSE Security Update: Security update for neomutt Announcement ID: openSUSE-SU-2020:2158-1 Rating: moderate References: 1172906 1172935 1173197 1179035 1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Backports SLE-15-SP2 An...

serenity:FuzzGIFLoader: Global-buffer-overflow in Gfx::decode_frame

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=6281737226944512 Project: serenity Fuzzing Engine: afl Fuzz Target: FuzzGIFLoader Job Type: aflasanserenity Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address:...

serenity:FuzzPNGLoader: Heap-buffer-overflow in decode

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=6265409137016832 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzPNGLoader Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

serenity:FuzzBMPLoader: Heap-buffer-overflow in Gfx::Streamer::read_u8

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=6281654599155712 Project: serenity Fuzzing Engine: afl Fuzz Target: FuzzBMPLoader Job Type: aflasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6110000002...

serenity:FuzzICOLoader: Stack-use-after-return in AK::Vector<unsigned char, 0ul>::clear_with_capacity

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=4888328016756736 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzICOLoader Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address...

llvm:llvm-dwarfdump-fuzzer: Heap-buffer-overflow in llvm::StringMapImpl::LookupBucketFor

Detailed Report: https://oss-fuzz.com/testcase?key=5071836601384960 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x607000000148 Crash State:...

llvm:llvm-opt-fuzzer--x86_64-guard_widening: Heap-use-after-free in llvm::Value::setValueName

Detailed Report: https://oss-fuzz.com/testcase?key=5720028133195776 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-opt-fuzzer--x8664-guardwidening Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6210000094b0 Crash State:...

serenity:FuzzBMP: Heap-buffer-overflow in Gfx::decode_bmp_pixel_data

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5380810148151296 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzBMP Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

leptonica:adaptmap_fuzzer: Heap-use-after-free in pixChangeRefcount

Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=4941737753313280 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: adaptmapfuzzer Job Type: libfuzzerasanleptonica Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash...

libreoffice:fodtfuzzer: Heap-buffer-overflow in std::__1::unique_ptr<SwXMLTableRow_Impl, std::__1::default_delete<SwXMLTableRow_

Detailed Report: https://oss-fuzz.com/testcase?key=5196181338324992 Project: libreoffice Fuzzing Engine: afl Fuzz Target: fodtfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6020001c6da0 Crash State: std::1::uniqueptrSwXMLTableRowImp...

imagemagick:ping_pwp_fuzzer: Stack-buffer-overflow in SetStringInfoDatum

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5632955822899200 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: pingpwpfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash...

libreoffice:fodtfuzzer: Container-overflow in std::__1::unique_ptr<SwXMLTableRow_Impl, std::__1::default_delete<SwXMLTableRow_

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5766728887566336 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: fodtfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Container-overflow READ 8 Crash...

simdjson:fuzz_ondemand: Crash in numberparsing.h

Project: https://github.com/simdjson/simdjson.git https://github.com/lemire/simdjson.git Detailed Report: https://oss-fuzz.com/testcase?key=5632701446750208 Project: simdjson Fuzzing Engine: libFuzzer Fuzz Target: fuzzondemand Job Type: libfuzzerasansimdjson Platform Id: linux Crash Type: UNKNOWN...

libvips:jpegsave_buffer_fuzzer: Heap-buffer-overflow in rtiff_parse_palette

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=4660373640445952 Project: libvips Fuzzing Engine: afl Fuzz Target: jpegsavebufferfuzzer Job Type: aflasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

skia:sksl2spirv: Segv on unknown address in std::__1::unique_ptr<SkSL::Expression, std::__1::default_delete<SkSL::Expression

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=6198631948091392 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2spirv Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

simdjson:fuzz_dump: Stack-buffer-overflow in simdjson::internal::decimal_right_shift

Project: https://github.com/simdjson/simdjson.git https://github.com/lemire/simdjson.git Detailed Report: https://oss-fuzz.com/testcase?key=5087581219586048 Project: simdjson Fuzzing Engine: libFuzzer Fuzz Target: fuzzdump Job Type: libfuzzerasansimdjson Platform Id: linux Crash Type:...

skia:skruntimeeffect: Segv on unknown address in SkSL::Expression::kind

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5118234535395328 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: skruntimeeffect Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

llvm:clang-fuzzer: Global-buffer-overflow in ProcessCharEscape

Detailed Report: https://oss-fuzz.com/testcase?key=5730186039132160 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x00000ccfc3dc Crash State: ProcessCharEscape...