llvm/llvm-special-case-list-fuzzer: Heap-buffer-overflow in p_ere

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=5450169182060544 Project: llvm Fuzzer: libFuzzerllvmllvm-special-case-list-fuzzer Fuzz target binary: llvm-special-case-list-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type:...

llvm/llvm-special-case-list-fuzzer: Heap-buffer-overflow in p_ere

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=5235826691670016 Project: llvm Fuzzer: libFuzzerllvmllvm-special-case-list-fuzzer Fuzz target binary: llvm-special-case-list-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type:...

llvm/clangd-fuzzer: Use-after-poison in llvm::yaml::Scanner::scanValue

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=4553604959567872 Project: llvm Fuzzer: libFuzzerllvmclangd-fuzzer Fuzz target binary: clangd-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address...

llvm/clang-fuzzer: Stack-buffer-overflow in clang::Lexer::LexAngledStringLiteral

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=5625920451772416 Project: llvm Fuzzer: libFuzzerllvmclang-fuzzer Fuzz target binary: clang-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash...

llvm/llvm-dwarfdump-fuzzer: Crash in llvm::object::WasmObjectFile::parseDataSection

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=4546851673997312 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: UNKNOWN READ Crash...

llvm/llvm-dwarfdump-fuzzer: Heap-buffer-overflow in readInitExpr

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=4536944311664640 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow...

llvm/llvm-special-case-list-fuzzer: Global-buffer-overflow in p_b_symbol

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=6124359660863488 Project: llvm Fuzzer: libFuzzerllvmllvm-special-case-list-fuzzer Fuzz target binary: llvm-special-case-list-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type:...

librawspeed/FiffParserFuzzer-GetDecoder-Decode: Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=4955346603868160 Project: librawspeed Fuzzer: libFuzzerlibrawspeedFiffParserFuzzer-GetDecoder-Decode Fuzz target binary: FiffParserFuzzer-GetDecoder-Decode Job Type: libfuzzermsanlibrawspeed...

llvm/llvm-isel-fuzzer--x86_64-O2: Use-after-poison in DAGCombiner::useDivRem

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=6048513491206144 Project: llvm Fuzzer: libFuzzerllvmllvm-isel-fuzzer--x8664-O2 Fuzz target binary: llvm-isel-fuzzer--x8664-O2 Job Type: libfuzzerasanllvm Platform Id: linux Crash Type:...

llvm/llvm-dwarfdump-fuzzer: Heap-buffer-overflow in llvm::identify_magic

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=6095520196984832 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow...

librawspeed: Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=4923578240729088 Project: librawspeed Fuzzer: libFuzzerlibrawspeedRawParserFuzzer-GetDecoder-Decode Fuzz target binary: RawParserFuzzer-GetDecoder-Decode Job Type: libfuzzermsanlibrawspeed...

llvm: Heap-buffer-overflow in llvm::StringMapImpl::FindKey

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=5653990445416448 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow...

Wfuzz - Web Application Fuzzer

Wfuzz has been created to facilitate the task in web applications assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value of a given payload. A payload in Wfuzz is a source of data. This simple concept allows any input to be injected in any fiel...

harfbuzz: Use-of-uninitialized-value in hb_buffer_t::merge_out_clusters

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=6424351550210048 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-fuzzer Fuzz target binary: hb-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

Bad-cast to boost::detail::sp_counted_base from invalid vptr;boost::detail::shared_count::~shared_count;boost::match_results<std::__1::__wrap_iter<char const*>, std::__1::allocator<boost::sub_match<std::__1::__wrap_iter<char const*> > > >::~match_results

Project: https://github.com/boostorg/boost.git Detailed report: https://oss-fuzz.com/testcase?key=6313446367821824 Project: boost Fuzzer: libFuzzerboostregexfuzzer Fuzz target binary: boostregexfuzzer Job Type: libfuzzerubsanboost Platform Id: linux Crash Type: Bad-cast Crash Address:...

wireshark: Global-buffer-overflow in dissect_gtpv2_ie_common

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=5241250057814016 Project: wireshark Fuzzer: aflwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: aflasanwireshark Platform Id: linux Crash Type:...

libreoffice: Heap-use-after-free in rtl::OUString::OUString

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5504242112528384 Project: libreoffice Fuzzer: libFuzzerlibreofficeww6fuzzer Fuzz target binary: ww6fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...

librawspeed: Use-after-poison in void rawspeed::SamsungV2Decompressor::decompressRow<

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5856496673882112 Project: librawspeed Fuzzer: afllibrawspeedTiffDecoderFuzzer-SrwDecoder Fuzz target binary: TiffDecoderFuzzer-SrwDecoder Job Type: aflasanlibrawspeed Platform Id: linux Crash...

gdal: Index-out-of-bounds in unpk_g2ncep

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5096432585408512 Project: gdal Fuzzer: libFuzzergdalfilesystemfuzzer Fuzz target binary: gdalfilesystemfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Index-out-of-bounds Crash Address...

The Great DOM Fuzz-off of 2017

Posted by Ivan Fratric, Project Zero Introduction Historically, DOM engines have been one of the largest sources of web browser bugs. And while in the recent years the popularity of those kinds of bugs in targeted attacks has somewhat fallen in favor of Flash which allows for cross-browser exploi...