wireshark: Heap-buffer-overflow in bootp_option

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=6216983760601088 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkudpport-bootp Fuzz target binary: fuzzsharkudpport-bootp Job Type:...

wireshark: Heap-buffer-overflow in bootp_option

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=4781424697671680 Project: wireshark Fuzzer: aflwiresharkfuzzsharkdissectorip Fuzz target binary: fuzzsharkdissectorip Job Type: aflasanwireshark...

dlplibs: Container-overflow in libvisio::VSDContentCollector::_generateBezierSegmentsFromNURBS

Detailed report: https://oss-fuzz.com/testcase?key=5890037898018816 Project: dlplibs Fuzzer: libFuzzerdlplibsvsdfuzzer Fuzz target binary: vsdfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Container-overflow READ 8 Crash Address: 0x6060000009b0 Crash State:...

grpc: Heap-use-after-free in gpr_unref

Detailed report: https://oss-fuzz.com/testcase?key=6462055064272896 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x611000002340 Crash State: gprunref grpcerrorunref...

shopify-scripts: heap-buffer-overflow (read outside of buffer) in mrb_vm_exec()

Triggered in 3231219 14 April 2017. Compiled with afl-gcc + asan. ./mirb test000 ==10555==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200001c920 at pc 0x52be2c bp 0x7ffe6751ada0 sp 0x7ffe6751ad98 READ of size 16 at 0x60200001c920 thread T0 0 0x52be2b in mrbvmexec...

dlplibs: Container-overflow in MWAWPictBitmapContainerBool::setRowPacked

Detailed report: https://oss-fuzz.com/testcase?key=4685785548718080 Project: dlplibs Fuzzer: afldlplibsapplepictfuzzer Fuzz target binary: applepictfuzzer Job Type: aflasandlplibs Platform Id: linux Crash Type: Container-overflow READ 1 Crash Address: 0x621000001e12 Crash State:...

dlplibs: Global-buffer-overflow in StarEncoding::read

Detailed report: https://oss-fuzz.com/testcase?key=6608338966020096 Project: dlplibs Fuzzer: libFuzzerdlplibssdwfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000000a9d1dc Crash State: StarEncoding::read StarEncoding::convert...

dlplibs: Global-buffer-overflow in computeBMPDataOffset

Detailed report: https://oss-fuzz.com/testcase?key=5669948070297600 Project: dlplibs Fuzzer: libFuzzerdlplibsvsdfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x00000096a278 Crash State: computeBMPDataOffset...

file: Heap-buffer-overflow in cdf_getuint32

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=4879865188712448 Project: file Fuzzer: aflfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: aflasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x611000000280 Cra...

Apple WebKit - Document::adoptNode Use-After-Free Exploit

Exploit for multiple platform in category dos / poc var s = document.body.appendChilddocument.createElement'script'; s.type = '0'; s.textContent = 'document.body.appendChildparent.i0'; var i0 = s.appendChilddocument.createElement'iframe'; s.type = ''; var f =...

libtsm: Heap-buffer-overflow in tsm_screen_tab_left

Project: git://people.freedesktop.org/dvdhrm/libtsm Detailed report: https://oss-fuzz.com/testcase?key=5437603467755520 Project: libtsm Fuzzer: afllibtsmfuzzer Fuzz target binary: libtsmfuzzer Job Type: aflasanlibtsm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

WebKit WebCore::toJS Use-After-Free

WebKit: WebCore::toJS use-after-free CVE-2017-2476 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar i=0;i...

dlplibs: Heap-buffer-overflow in librevenge::RVNGString::Iter::operator

Detailed report: https://oss-fuzz.com/testcase?key=6384974469005312 Project: dlplibs Fuzzer: libFuzzerdlplibsabwfuzzer Fuzz target binary: abwfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60a000002cf8 Crash State:...

WebKit ComposedTreeIterator::traverseNextInShadowTree Use-After-Free

WebKit: ComposedTreeIterator::traverseNextInShadowTree use-after-free CVE-2017-2466 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC:...

WebKit FormSubmission::create Use-After-Free

WebKit: use-after-free in FormSubmission::create CVE-2017-2460 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. Please note: This bug is subject to a 90 day...

WebKit JSC::B3::Procedure::resetReachability Use-After-Free

WebKit: Use-after-free in JSC::B3::Procedure::resetReachability CVE-2017-2470 Note: It seems it doesn't crash the JSC compiled without Address Sanitizer. PoC: function for var i = 0; i 1000000; ++i const v = Array & 1 ? v : 1; typeof o = 'object'; ; Asan Log:...

WebKit RenderLayer Use-After-Free

WebKit: use-after-free in RenderLayer CVE-2017-2455 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the latest nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC and ASan log follow PoC:...

ffmpeg: Heap-buffer-overflow in av_samples_copy

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=6456688074817536 Project: ffmpeg Fuzzer: libFuzzerffmpegAUDIOAVCODECIDAACfuzzer Fuzz target binary: ffmpegAUDIOAVCODECIDAACfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

dlplibs: Global-buffer-overflow in StarEncoding::read

Detailed report: https://oss-fuzz.com/testcase?key=6132274431000576 Project: dlplibs Fuzzer: libFuzzerdlplibssdwfuzzer Fuzz target binary: sdwfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000000a4fcdc Crash State:...

file: Heap-buffer-overflow in cdf_file_property_info

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=5417710252982272 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...