OSV-2022-181 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44885 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2022-180 Heap-buffer-overflow in row_mt_worker_hook

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44862 Crash type: Heap-buffer-overflow WRITE 4 Crash state: rowmtworkerhook threadloop...

OSV-2022-179 Heap-buffer-overflow in row_mt_worker_hook

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44856 Crash type: Heap-buffer-overflow WRITE 4 Crash state: rowmtworkerhook execute av1decodetgtilesandwrapup...

OSV-2022-177 UNKNOWN READ in gx_dc_default_fill_masked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44855 Crash type: UNKNOWN READ Crash state: gxdcdefaultfillmasked copyportrait imagerendersimple...

OSV-2022-165 Stack-buffer-overflow in fmt::v8::basic_memory_buffer<unsigned int, 32ul, std::__1::allocator<unsigned in

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44763 Crash type: Stack-buffer-overflow READ 4 Crash state: fmt::v8::basicmemorybufferunsigned int, 32ul, std::1::allocatorunsigned in fmt::v8::detail::bigint::square fmt::v8::detail::bigint::assignpow10...

OSV-2022-158 Heap-buffer-overflow in parse_primitive

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44695 Crash type: Heap-buffer-overflow READ 1 Crash state: parseprimitive plistfromjson jplistfuzzer.cc...

OSV-2022-152 UNKNOWN WRITE

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44641 Crash type: UNKNOWN WRITE Crash state: NULL...

OSV-2022-151 Heap-buffer-overflow in extensionObjectOrder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44623 Crash type: Heap-buffer-overflow READ 4 Crash state: extensionObjectOrder extensionObjectOrder extensionObjectOrder...

OSV-2022-150 Heap-buffer-overflow in coap_split_uri_sub

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44611 Crash type: Heap-buffer-overflow READ 1 Crash state: coapspliturisub coapgeturipath...

OSV-2021-1807 Heap-use-after-free in dhcp6_no_relay

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44573 Crash type: Heap-use-after-free WRITE 1 Crash state: dhcp6norelay dhcp6mayberelay dhcp6mayberelay...

OSV-2022-146 Stack-use-after-scope in tag_cfa_pattern::Put

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44590 Crash type: Stack-use-after-scope READ 1 Crash state: tagcfapattern::Put dngtiffdirectory::Put dngimagewriter::WriteTIFFWithProfile...

OSV-2022-145 Heap-buffer-overflow in print_mac

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44581 Crash type: Heap-buffer-overflow WRITE 4 Crash state: printmac logpacket dhcpreply...

OSV-2022-144 Segv on unknown address in onig_free_body

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44603 Crash type: Segv on unknown address Crash state: onigfreebody onignew flbregexcreate...

OSV-2022-142 Heap-use-after-free in archive_read_format_rar_read_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44547 Crash type: Heap-use-after-free READ 4 Crash state: archivereadformatrarreaddata archivereaddata libarchivefuzzer.cc...

OSV-2022-141 Heap-use-after-free in nghttp2_hd_deflate_hd_bufs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44517 Crash type: Heap-use-after-free READ 3 Crash state: nghttp2hddeflatehdbufs nghttp2framepackheaders nghttp2sessionmemsendinternal...

OSV-2022-139 Heap-use-after-free in nghttp2_http_record_request_method

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44516 Crash type: Heap-use-after-free READ 4 Crash state: nghttp2httprecordrequestmethod nghttp2sessionmemsendinternal nghttp2sessionsend...

Duplicate advisory: swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pgfx-g6rc-8cjv. This link is maintained to preserve external references. Original Description A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a...

OSV-2022-137 Stack-buffer-overflow in LoadVoice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44527 Crash type: Stack-buffer-overflow READ Crash state: LoadVoice LoadVoiceVariant SpeakNextClause...

OSV-2022-136 Heap-buffer-overflow in cli_js_parse_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44490 Crash type: Heap-buffer-overflow READ 4 Crash state: clijsparsedone clihtmlnormalise htmlnormalisemap...

OSV-2022-134 Heap-use-after-free in RDKit::Chirality::cleanupStereoGroups

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44520 Crash type: Heap-use-after-free READ 1 Crash state: RDKit::Chirality::cleanupStereoGroups RDKit::MolOps::assignStereochemistry RDKit::SmilesToMol...