libmspub: Stack-use-after-scope in libmspub::MSPUBCollector::paintShape

Detailed report: https://oss-fuzz.com/testcase?key=4867319689904128 Project: libmspub Fuzzer: afllibmspubpubfuzzer Fuzz target binary: pubfuzzer Job Type: aflasanlibmspub Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address: 0x7f23248bf9f0 Crash State:...

libmspub: Container-overflow in librevenge::RVNGStringStreamPrivate::RVNGStringStreamPrivate

Detailed report: https://oss-fuzz.com/testcase?key=4774762205151232 Project: libmspub Fuzzer: libFuzzerlibmspubpubfuzzer Fuzz target binary: pubfuzzer Job Type: libfuzzerasanlibmspub Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address: 0x629000000200 Crash State:...

grpc: Heap-buffer-overflow in server_filter_incoming_metadata

Detailed report: https://oss-fuzz.com/testcase?key=5417405008314368 Project: grpc Fuzzer: libFuzzergrpcserverfuzzer Fuzz target binary: serverfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x607000001799 Crash State:...

Mozilla Firefox table use-after-free（CVE-2017-5404）

Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1340138 There is a use-after-free security vulnerability in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC and ASan log can be found below. Notes for reproducing: - PoC uses domFuzzLite3 extension...

Mozilla Firefox: use-after-poison in nsStylePadding::GetPadding

Mozilla bug tracker link: https://bugzilla.mozilla.org/showbug.cgi?id=1340593 There is a use-after-poison issue in Firefox. The vulnerability was confirmed on the nightly ASan build. PoC: padding: inherit; function go var s = menu.style; s.setProperty"scroll-snap-destination", "1px 63%";...

shopify-scripts: SIGSEGV in mrb_vm_exec

PoC ------------------- The following code triggers the bug attached as testmrbvmexec.rb: def methodmissingmeth,argsyieldmeth,argsend enumfor.next Debug - mirb ------------------- x@x:/Desktop/test/mruby/bin$ gdb -q ./mirb rReading symbols from ./mirb...done. gdb r testmrbvmexec.rb Starting...

file: Heap-buffer-overflow in cdf_read_property_info

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=5121085282451456 Project: file Fuzzer: aflfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: aflasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x611000000280 Cra...

grpc: Heap-use-after-free in post_batch_completion

Detailed report: https://oss-fuzz.com/testcase?key=5965570207907840 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6250000c21a0 Crash State: postbatchcompletion...

shopify-scripts: heap use-after-free in mrb_vm_exec()

The code bellow triggers a heap use-after-free vulnerability: class M def M.newr super new0 end end M.new0 ASAN report : ================================================================= ==25617==ERROR: AddressSanitizer: heap-use-after-free on address 0xf4103e50 at pc 0x080f7231 bp 0xffc69ab8 sp...

libreoffice: Container-overflow in sdr::table::TableLayouter::SetBorder

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5828472368791552 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Container-overflow...

shopify-scripts: Crash in ary_concat()

The code above raises a segmentation fault both in mruby and mruby-engine N case when nil -do end def eend end ASAN report : line 1:3: '' interpreted as argument prefix ASAN:SIGSEGV ================================================================= ==111090==ERROR: AddressSanitizer: SEGV on unknow...

libxml2: Heap-buffer-overflow in xmlFAParsePosCharGroup

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=6574081912602624 Project: libxml2 Fuzzer: afllibxml2xmlregexpcompilefuzzer Fuzz target binary: libxml2xmlregexpcompilefuzzer Job Type: aflasanlibxml2 Platform Id: linux Crash Type:...

freetype2: Heap-buffer-overflow in psh_glyph_init

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://oss-fuzz.com/testcase?key=6729909500116992 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow...

ffmpeg: Global-buffer-overflow in ff_h264_filter_mb_fast

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=6515070404132864 Project: ffmpeg Fuzzer: libFuzzerffmpegVIDEOAVCODECIDH264fuzzer Fuzz target binary: ffmpegVIDEOAVCODECIDH264fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

freetype2: Heap-buffer-overflow in t1_builder_add_point

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://oss-fuzz.com/testcase?key=5773760927891456 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=5036643692052480 Project: lcms Fuzzer: afllcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: aflasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Mozilla Firefox - table Use-After-Free Exploit

Exploit for multiple platform in category dos / poc body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

Mozilla Firefox - 'table' Use-After-Free

body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line"; document.body.appenddocument.createElement"table"; freememory uZ1CqnaASOkr...

Mozilla Firefox - table Use-After-Free

Mozilla Firefox - table Use-After-Free body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

lcms: Heap-buffer-overflow in TetrahedralInterpFloat

Project: https://github.com/mm2/Little-CMS.git Detailed report: https://oss-fuzz.com/testcase?key=4650371647537152 Project: lcms Fuzzer: libFuzzerlcmscmstransformfuzzer Fuzz target binary: cmstransformfuzzer Job Type: libfuzzerasanlcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 4...