Mozilla Firefox: out-of-bounds read in gfxTextRun(CVE-2017-5447)

Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1343552 There is an out-of-bounds read vulnerability in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC: .class1 float: left; white-space: pre-line; .class2 border-bottom-style: solid; font-face: Arial;...

pcre2: Heap-buffer-overflow in internal_dfa_match

Project: svn://vcs.exim.org/pcre2/code/trunk https://github.com/PCRE2Project/pcre2.git Detailed report: https://oss-fuzz.com/testcase?key=4538978877308928 Project: pcre2 Fuzzer: libFuzzerpcre2fuzzer Fuzz target binary: pcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type:...

gdal: Heap-buffer-overflow in Read2B

Detailed report: https://oss-fuzz.com/testcase?key=4979475152371712 Project: gdal Fuzzer: libFuzzergdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60700000019d Crash State: Read2B ReadBITSHORT Skip...

grpc: Global-buffer-overflow in grpc_chttp2_hptbl_add

Detailed report: https://oss-fuzz.com/testcase?key=5659602282610688 Project: grpc Fuzzer: libFuzzergrpchpackparserfuzzertest Fuzz target binary: hpackparserfuzzertest Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000000da36f0 Crash State...

libarchive: Heap-buffer-overflow in process_extra

Detailed report: https://oss-fuzz.com/testcase?key=5042257776345088 Project: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x615000000780 Crash State:...

gdal: Stack-buffer-overflow in CADHandle::getAsLong

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5735999550259200 Project: gdal Fuzzer: libFuzzergdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address:...

gdal: Heap-buffer-overflow in Read2B

Detailed report: https://oss-fuzz.com/testcase?key=6406166785556480 Project: gdal Fuzzer: libFuzzergdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x602000000344 Crash State: Read2B SkipBITDOUBLE...

Skia Graphics Library - Heap Overflow due to Rounding Error in SkEdge::setLine Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1155 Skia bug: https://bugs.chromium.org/p/skia/issues/detail?id=6294 There is a heap overflow in SkARGB32ShaderBlitter::blitH caused by a rounding error in SkEdge::setLine. To...

Mozilla Firefox < 53 - 'ConvolvePixel' Memory Disclosure

/home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:2358 2 0x7f8d3fcd397d in alreadyAddRefed mozilla::gfx::FilterNodeConvolveMatrixSo...

Mozilla Firefox 53 - ConvolvePixel Memory Disclosure

Mozilla Firefox 53 - ConvolvePixel Memory Disclosure /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:2358 2 0x7f8d3fcd397d in alreadyAddRefedmozilla::gfx::Data...

Apple WebKit Safari 10.0.3(12602.4.8) - Editor::Command::execute Universal Cross-Site Scripting

Apple WebKit Safari 10.0.312602.4.8 - Editor::Command::execute Universal Cross-Site Scripting document-updateLayoutIgnorePendingStylesheets; return mcommand-executemframe, triggeringEvent, msource, parameter; This method is invoked under an |EventQueueScope|. But...

Mozilla Firefox 53 - gfxTextRun Out-of-Bounds Read

Mozilla Firefox 53 - gfxTextRun Out-of-Bounds Read .class1 float: left; white-space: pre-line; .class2 border-bottom-style: solid; font-face: Arial; font-size: 7ex; function go menuitem.appendChilddocument.body.firstChild; canvas.toBlobcallback; function callback var s = menu.style;...

Skia Graphics Library Heap Overflow

Skia Graphics Library: heap overflow due to rounding error in SkEdge::setLine Skia bug: https://bugs.chromium.org/p/skia/issues/detail?id=6294 There is a heap overflow in SkARGB32ShaderBlitter::blitH caused by a rounding error in SkEdge::setLine. To trigger the bug Skia needs to be compiled with...

WebKit WebCore::FrameView::scheduleRelayout Use-After-Free

WebKit: UAF in WebCore::FrameView::scheduleRelayout CVE-2017-2514 PoC: let f = document.body.appendChilddocument.createElement'iframe'; let g = f.contentDocument.body.appendChilddocument.createElement'iframe'; g.contentWindow.onunload = = g.contentWindow.onunload = null; let h =...

Mozilla Firefox gfxTextRun Out-Of-Bounds Read

Mozilla Firefox: out-of-bounds read in gfxTextRun CVE-2017-5447 Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1343552 There is an out-of-bounds read vulnerability in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC:...

gdal: Heap-buffer-overflow in NTFFileReader::Open

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4776382523506688 Project: gdal Fuzzer: libFuzzergdalogrfilesystemfuzzer Fuzz target binary: ogrfilesystemfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cras...

Apple iOS / macOS - NSKeyedArchiver Heap Corruption Due to Rounding Error in TIKeyboardLayout initWi

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1172 Using lldb inside a simple helloworld app for iOS we can see that there are over 600 classes which we could get deserialized for persistance for example. The TextInput...

Apple macOS/iOS - 'TIKeyboardLayout initWithCoder:' NSKeyedArchiver Heap Corruption Due to Rounding Error

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1172 Using lldb inside a simple helloworld app for iOS we can see that there are over 600 classes which we could get deserialized for persistance for example. The TextInput framework which is loaded has a class TIKeyboardLayout. Th...

proj4: Stack-buffer-overflow in pj_open_lib_ex

Detailed report: https://oss-fuzz.com/testcase?key=6058391271112704 Project: proj4 Fuzzer: aflproj4standardfuzzer Fuzz target binary: standardfuzzer Job Type: aflasanproj4 Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7f2bb94a2421 Crash State: pjopenlibex...

gdal: Heap-buffer-overflow in NASReader::SetFeaturePropertyDirectly

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4908186949648384 Project: gdal Fuzzer: libFuzzergdalogrfuzzer Fuzz target binary: ogrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...