OSV-2022-133 Heap-buffer-overflow in coap_split_uri_sub

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44503 Crash type: Heap-buffer-overflow READ 1 Crash state: coapspliturisub coapgeturipath...

CVE-2022-24668

A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handlin...

OSV-2022-129 Heap-buffer-overflow in dwg_free_HATCH_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44481 Crash type: Heap-buffer-overflow READ 8 Crash state: dwgfreeHATCHprivate dwgfreeHATCH dwgfreeobject...

OSV-2022-128 Stack-buffer-overflow in decompress_rNUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44432 Crash type: Stack-buffer-overflow WRITE 1 Crash state: decompressrNUMBER readrNUMBERmetadata dwgdecode...

OSV-2022-127 Heap-use-after-free in UA_ServerConfig_clean

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44434 Crash type: Heap-use-after-free READ 8 Crash state: UAServerConfigclean fuzzbinarymessage.cc UAmemoryManagerfree...

OSV-2022-126 Heap-buffer-overflow in md_analyze_inlines

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44446 Crash type: Heap-buffer-overflow READ 1 Crash state: mdanalyzeinlines mdprocessnormalblockcontents mdprocesstablecell...

OSV-2022-125 Invalid-free in NIOHTTP2.NIOHTTP2Handler.

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44431 Crash type: Invalid-free Crash state: NIOHTTP2.NIOHTTP2Handler. NIOHTTP2.NIOHTTP2Handler.channelRead NIOCore.ChannelHandlerContext...

OSV-2022-121 Heap-buffer-overflow in s_hex_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44406 Crash type: Heap-buffer-overflow READ 1 Crash state: shexprocess sexDprocess sreadbuf...

OSV-2022-120 Heap-buffer-overflow in ndpi_strncasestr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44405 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpistrncasestr checkcontenttypeandchangeprotocol ndpisearchhttptcp...

OSV-2022-116 Heap-buffer-overflow in parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44301 Crash type: Heap-buffer-overflow READ 4 Crash state: parseobject parseobject parseobject...

OSV-2022-115 UNKNOWN READ in unescape_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44300 Crash type: UNKNOWN READ Crash state: unescapestring parsestring parseobject...

OSV-2022-112 Heap-use-after-free in hb_bit_set_invertible_t::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44263 Crash type: Heap-use-after-free READ 1 Crash state: hbbitsetinvertiblet::next hbbitsetinvertiblet::intersects hbsparsesett::intersects...

OSV-2022-111 Heap-use-after-free in OT::CoverageFormat1::intersected_coverage_glyphs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44257 Crash type: Heap-use-after-free READ 4 Crash state: OT::CoverageFormat1::intersectedcoverageglyphs OT::ChainContextFormat3::closure OT::hbclosurecontextt::returnt OT::SubstLookupSubTable::dispatchOT::hbclos...

OSV-2022-110 Heap-buffer-overflow in ZSTD_compressLiterals

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44239 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ZSTDcompressLiterals ZSTDentropyCompressSeqStore ZSTDcompressSequences...

OSV-2022-108 Heap-buffer-overflow in void apply_string<GSUBProxy>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44212 Crash type: Heap-buffer-overflow READ 2 Crash state: void applystring void hbotmapt::apply hbotmapt::substitute...

OSV-2022-105 Heap-buffer-overflow in parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44199 Crash type: Heap-buffer-overflow READ 4 Crash state: parseobject parseobject parseobject...

OSV-2022-104 Heap-use-after-free in hb_bit_set_invertible_t::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44198 Crash type: Heap-use-after-free READ 1 Crash state: hbbitsetinvertiblet::intersects OT::CoverageFormat2::intersectedcoverageglyphs OT::ChainContextFormat1::closure...

OSV-2022-101 Heap-double-free in flb_sds_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44153 Crash type: Heap-double-free Crash state: flbsdsdestroy flbparserconffile configrandomfuzzer.c...

OSV-2022-99 UNKNOWN WRITE in helper_shl_cc_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44136 Crash type: UNKNOWN WRITE Crash state: helpershlccarm...

OSV-2022-97 Heap-buffer-overflow in gs_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44123 Crash type: Heap-buffer-overflow WRITE 16 Crash state: gsinterpret gsmainrunstringwithlength gsmainrunstring...