php:php-fuzz-tracing-jit: Heap-use-after-free in zend_std_read_property

Detailed Report: https://oss-fuzz.com/testcase?key=6753130298277888 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-tracing-jit Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x78061c2f56ec Crash State: zendstdreadproperty...

Denial Of Service (DoS)

firefox is vulnerable to Denial of Service DoS. The vulnerability is due to an empty shape list caused by memory exhaustion, leading to a crash if the JIT traces the object...

CVE-2024-3860

An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently traced the object it would crash. This vulnerability affects Firefox 125...

php:php-fuzz-tracing-jit: Heap-use-after-free in zval_call_destructor

Detailed Report: https://oss-fuzz.com/testcase?key=5995844627988480 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-tracing-jit Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x604000026b50 Crash State: zvalcalldestructor...

php:php-fuzz-tracing-jit: Segv on unknown address in zend_jit_trace_execute

Detailed Report: https://oss-fuzz.com/testcase?key=5221091013951488 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-tracing-jit Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: zendjittraceexecute zendjittracehotroot...

php:php-fuzz-tracing-jit: Segv on unknown address in zero

Detailed Report: https://oss-fuzz.com/testcase?key=5098168402968576 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-tracing-jit Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: zero zendexecute fuzzerdorequestfrombuffer...

php:php-fuzz-tracing-jit: Segv on unknown address in zero

Detailed Report: https://oss-fuzz.com/testcase?key=5995746541830144 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-tracing-jit Job Type: libfuzzerasani386php Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: zero zendexecute fuzzerdorequestfrombuffer...