OSV-2022-429 Heap-buffer-overflow in pdfi_dict_get_no_store_R_inner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47601 Crash type: Heap-buffer-overflow READ Crash state: pdfidictgetnostoreRinner pdfidictgetnostoreRkey pdfifindresource...

OSV-2022-427 Stack-use-after-scope in RefCopyBytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47560 Crash type: Stack-use-after-scope READ Crash state: RefCopyBytes DoCopyBytes dngstream::Put...

OSV-2022-426 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47557 Crash type: Memcpy-param-overlap Crash state: repeat pere cliregcompreal...

OSV-2022-422 UNKNOWN WRITE in alloc_restore_step_in

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47513 Crash type: UNKNOWN WRITE Crash state: allocrestorestepin allocrestoreall gsmainfinit...

OSV-2022-421 Stack-buffer-overflow in cardos_list_files

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47512 Crash type: Stack-buffer-overflow READ 1 Crash state: cardoslistfiles sclistfiles fuzzcard.c...

OSV-2022-416 Heap-buffer-overflow in opj_t1_allocate_buffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47500 Crash type: Heap-buffer-overflow WRITE Crash state: opjt1allocatebuffers opjt1clbldecodeprocessor opjthreadpoolsubmitjob...

OSV-2022-417 Heap-buffer-overflow in read_xref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47501 Crash type: Heap-buffer-overflow READ 8 Crash state: readxref pdfireadxref pdfisetinputstream...

OSV-2022-415 UNKNOWN READ in pdfi_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47499 Crash type: UNKNOWN READ Crash state: pdfifreeobject pdficlearcontext pdfifreecontext...

OSV-2022-412 Bad-cast to const upb_tabent' (aka 'const struct _upb_tabent')insert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47464 Crash type: Bad-cast Crash state: Bad-cast to const upbtabent' aka 'const struct upbtabent'insert upbstrtableinsert createfielddef...

[SECURITY] [DLA 3010-1] ffmpeg security update

Debian LTS Advisory DLA-3010-1 [email protected] https://www.debian.org/lts/security/ Enrico Zini May 16, 2022 https://wiki.debian.org/LTS Package : ffmpeg Version : 7:3.2.18-0+deb9u1 The ffmpeg project released the new version 3.2.18 with fixes for various issues found by the OSS-Fuzz...

OSV-2022-410 Heap-buffer-overflow in Assimp::ASE::Parser::ParseLV1SoftSkinBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47392 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::ASE::Parser::ParseLV1SoftSkinBlock Assimp::ASE::Parser::Parse Assimp::ASEImporter::InternReadFile...

OSV-2022-409 Heap-buffer-overflow in std::__1::__tree_node_base<void*>*& std::__1::__tree<std::__1::__value_type<std:

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47391 Crash type: Heap-buffer-overflow READ 1 Crash state: std::1::treenodebase& std::1::treestd::1::valuetypestd: std::1::pairstd::1::treeiteratorstd::1::valuetypestd::1::basic...

OSV-2022-406 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47339 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2022-403 Heap-use-after-free in dwg_add_handleref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47319 Crash type: Heap-use-after-free READ 8 Crash state: dwgaddhandleref dwgaddSTYLE decodepreR13section...

OSV-2022-401 UNKNOWN READ in OT::gvar::subset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47281 Crash type: UNKNOWN READ Crash state: OT::gvar::subset bool trysubset hbsubsetplanexecuteorfail...

OSV-2022-400 Heap-double-free in dwg_free_XRECORD_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300 Crash type: Heap-double-free Crash state: dwgfreeXRECORDprivate dwgfreeXRECORD dwgfreeobject...

OSV-2022-398 Heap-buffer-overflow in json_common_entity_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47259 Crash type: Heap-buffer-overflow READ 8 Crash state: jsoncommonentitydata dwgjsonREPEAT dwgjsonobject...

OSV-2022-396 Heap-buffer-overflow in ucl_object_free_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47206 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectfreeinternal uclparserfree uclstatemachine...

OSV-2022-395 Uncaught exception in com.alibaba.fastjson.JSONPath.deepScan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47192 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.JSONPath.deepScan java.base/java.lang.Boolean.valueOf com.alibaba.fastjson.parser.ParserConfig$2.apply...

OSV-2022-394 Incorrect-function-pointer-type in cv::split

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47190 Crash type: Incorrect-function-pointer-type Crash state: cv::split cv::split TestSplitAndMerge...