PT-2021-27901

Name of the Vulnerable Software and Affected Versions Apache Arrow affected versions not specified Description A heap buffer overflow read issue has been identified. The crash occurs in the arrow::internal::ValidateArrayImpl module, specifically in the Visit, ValidateWithType, and Validate...

arrow:arrow-ipc-stream-fuzz: Heap-buffer-overflow in arrow::internal::ValidateArrayImpl::Visit

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4961281405222912 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-stream-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

arrowcontractors.com Improper Access Control vulnerability OBB-2263248

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

arrow:parquet-arrow-fuzz: Memcpy-param-overlap in parquet::DeltaByteArrayDecoder::GetInternal

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5068267832606720 Project: arrow Fuzzing Engine: afl Fuzz Target: parquet-arrow-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address: 0x624000027576,0x6241000275...

arrow:arrow-ipc-file-fuzz: Crash in void arrow::internal::detail::FormatTwoDigits<long>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5873085270589440 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-file-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000013f960c4 Crash...

arrow:arrow-ipc-file-fuzz: Global-buffer-overflow in void arrow::internal::detail::FormatTwoDigits<long>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6625366190456832 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-file-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x000001ef1c47...

arrow:arrow-ipc-file-fuzz: Global-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::ArrayPrinter>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5864855240835072 Project: arrow Fuzzing Engine: honggfuzz Fuzz Target: arrow-ipc-file-fuzz Job Type: honggfuzzasanarrow Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...

OSV-2021-1192 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37927 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::PoolBuffer::MakeUnique arrow::AllocateBuffer...

PT-2021-27737

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash reported by OSS-Fuzz, with a Segv on an unknown address. The crash state involves the arrow::DefaultBackend,...

PT-2021-27736

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash, specifically a Segv on an unknown address. The crash state involves components such as arrow::DefaultBackend,...

arrow:arrow-ipc-file-fuzz: Segv on unknown address in arrow::DefaultBackend

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6674891504484352 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-file-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State...

arrow:arrow-ipc-stream-fuzz: Segv on unknown address in arrow::DefaultBackend

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4757582821064704 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-stream-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash...

arrow:arrow-ipc-file-fuzz: Crash in arrow::Status arrow::VisitTypeInline<arrow::ArrayDataEndianSwapper>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5298734406172672 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-file-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000001ed3000 Crash...

arrow (>=0.14.0, <=4.4.0), arrow-flight (>=2.0.0, <=4.4.0) +62 more potentially affected by CVE-2020-35864 via flatbuffers (>=0.4.0, <=0.8.4)

flatbuffers CARGO version =0.4.0, =0.14.0, =2.0.0, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.17.0, =0.1.1, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2020-35864 Source advisory: OSV:GHSA-C9H5-HF8R-M97X...

arrow (>=0.14.0, <=0.15.1), blockbuffers (0.1.0) +9 more potentially affected by CVE-2019-25004 via flatbuffers (>=0.4.0, <=0.5.0)

flatbuffers CARGO version =0.4.0, =0.14.0, =0.1.8, =0.1.0, =0.0.5, =3.0.0, =1.0.0, =1.1.2, =1.2.0, =1.3.2 Source cves: CVE-2019-25004 Source advisory: OSV:GHSA-GX73-2498-R55C...

UBUNTU-CVE-2020-21680

A stack-based buffer overflow in the putarrow component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service DOS via converting a xfig file into pict2e format...

arrow:parquet-arrow-fuzz: Bad-cast to const ::arrow::Decimal128Type from arrow::Decimal256Type in parquet::arrow::DecimalConverter<arrow::Decimal256Array, parquet::PhysicalType<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6015129204424704 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000488bee8 Crash State...

OSV-2020-2179 Heap-buffer-overflow in arrow::internal::ValidateUTF8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27731 Crash type: Heap-buffer-overflow READ 8 Crash state: arrow::internal::ValidateUTF8 arrow::internal::ValidateArrayFullImpl::ValidateWithType arrow::internal::ValidateArrayFullImpl::Visit...

PT-2020-22149

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the involvement of arrow::internal::ValidateUTF8,...

arrow:arrow-ipc-stream-fuzz: Global-buffer-overflow in void arrow::internal::TransferBitmap<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6229177539493888 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-stream-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Global-buffer-overflow READ Crash Address: 0x00000238fbb8...