OSV-2020-110 Heap-buffer-overflow in parquet::internal::RecordReader::Make

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20989 Crash type: Heap-buffer-overflow READ 8 Crash state: parquet::internal::RecordReader::Make parquet::arrow::LeafReader::LeafReader parquet::arrow::GetReader...

OSV-2020-104 Heap-buffer-overflow in void arrow::util::internal::ByteStreamSlitDecodeSSE2<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21420 Crash type: Heap-buffer-overflow READ 1 Crash state: void arrow::util::internal::ByteStreamSlitDecodeSSE2 virtual thunk to parquet::ByteStreamSplitDecoderparquet::PhysicalType parquet::TypedDecoderparquet::PhysicalType...

OSV-2020-63 UNKNOWN READ in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20697 Crash type: UNKNOWN READ Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-52 Heap-buffer-overflow in int arrow::util::RleDecoder::GetBatchWithDictSpaced<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20665 Crash type: Heap-buffer-overflow READ 8 Crash state: int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-21 UNKNOWN WRITE in arrow::internal::unpack32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20711 Crash type: UNKNOWN WRITE Crash state: arrow::internal::unpack32 int arrow::BitUtil::BitReader::GetBatch parquet::DictByteArrayDecoderImpl::DecodeArrowDense...

PT-2020-22437

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by an unknown read. The crash occurs in the arrow::BaseBinaryBuilder::UnsafeAppend function, which is called by...

PT-2020-21869

Name of the Vulnerable Software and Affected Versions parquet affected versions not specified Description The issue is related to a heap-use-after-free error, specifically a WRITE 2 crash type. It occurs in the GetBatch function of arrow::BitUtil::BitReader, which is used by...

PT-2020-21728

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several functions, including arrow::BaseBinaryBuilder::UnsafeAppend,...

PT-2020-21693

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to an unknown read issue. The crash state involves the Append function in arrow::BufferBuilder, arrow::BaseBinaryBuilder, and...

PT-2020-21853

Name of the Vulnerable Software and Affected Versions Apache Arrow affected versions not specified Description The issue is related to a heap buffer overflow read. Technical details about the crash include the org::apache::arrow::flatbuf::Message::Verify function,...

PT-2020-22016

Name of the Vulnerable Software and Affected Versions Apache Arrow affected versions not specified Description The issue is related to a crash in the Apache Arrow library, specifically in the MessageDecoderImpl class. The crash occurs when consuming data buffers, as indicated by the stack trace...

PT-2020-22104

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves functions such as arrow::internal::unpack32,...

PT-2020-22313

Name of the Vulnerable Software and Affected Versions Apache Arrow affected versions not specified Description A heap buffer overflow issue has been identified. The crash occurs in the arrow::util::RleDecoder::NextCounts and arrow::util::RleDecoder::GetBatchWithDictSpaced functions. This issue is...

PT-2020-21962

Name of the Vulnerable Software and Affected Versions Parquet affected versions not specified Description The issue is related to a heap-buffer-overflow write error. Technical details indicate that the crash occurs in the GetBatch function of arrow::BitUtil::BitReader and arrow::util::RleDecoder,...

PT-2020-22593

Name of the Vulnerable Software and Affected Versions Parquet affected versions not specified Description The issue is related to a heap buffer overflow error. Technical details indicate that the problem occurs in the arrow::util::RleDecoder::NextCounts function, specifically when...

arrow:arrow-ipc-file-fuzz: Heap-buffer-overflow in org::apache::arrow::flatbuf::Message::Verify

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5693640900083712 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-file-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

arrow:arrow-ipc-file-fuzz: Crash in arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5750282928783360 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-file-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffff83ea89ab...

arrow (>=0.14.0, <=4.4.0), arrow-flight (>=2.0.0, <=4.4.0) +62 more potentially affected by CVE-2020-35864 via flatbuffers (>=0.4.0, <=0.8.4)

flatbuffers CARGO version =0.4.0, =0.14.0, =2.0.0, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.17.0, =0.1.1, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2020-35864 Source advisory: OSV:RUSTSEC-2020-0009...

arrow:parquet-arrow-fuzz: Crash in parquet::DictDecoderImpl<parquet::PhysicalType<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5125226590633984 Project: arrow Fuzzing Engine: afl Fuzz Target: parquet-arrow-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60effffffe14 Crash State:...

Xfig fig2dev Input Validation Error Vulnerability

Xfig fig2dev is a tool for printing and exporting .fig format files. An input validation error vulnerability exists in the 'makearrow' function of the arrow.c file in Xfig fig2dev version 3.2.7b. The vulnerability stems from a networked system or product that does not properly validate input data...