OSV-2021-1124 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37116 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-1122 Heap-double-free in sudoers_gc_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37056 Crash type: Heap-double-free Crash state: sudoersgcrun fuzzpolicy.c resolveeditor...

OSV-2021-1121 UNKNOWN WRITE in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025 This is the same issue as OSV-2021-1143 which replaced this one after it was closed wrongly. Crash type: UNKNOWN WRITE Crash state: QtPrivate::QCommonArrayOps::growAppend QPainterPath::addPath QPathClipper::intersect...

OSV-2021-1120 Heap-use-after-free in on_body

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37023 Crash type: Heap-use-after-free READ 1 Crash state: onbody reqbodysendcomplete runsocket...

OSV-2021-1117 Heap-buffer-overflow in json_object_new_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37017 Crash type: Heap-buffer-overflow READ Crash state: jsonobjectnewstring clijsonstr clihwp5header...

OSV-2021-1116 Use-after-poison in JS::PrimitiveString::string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36985 Crash type: Use-after-poison READ 1 Crash state: JS::PrimitiveString::string JS::abstractrelation JS::lessthan...

OSV-2021-1113 Stack-buffer-overflow in getoid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36962 Crash type: Stack-buffer-overflow READ 8 Crash state: getoid parseobjectid parseasntype...

OSV-2021-1110 Stack-buffer-overflow in TranslateWord2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36932 Crash type: Stack-buffer-overflow WRITE 1 Crash state: TranslateWord2 TranslateClause SpeakNextClause...

OSV-2021-1108 Use-of-uninitialized-value in init_main_qtable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36913 Crash type: Use-of-uninitialized-value Crash state: initmainqtable LibRaw::fujidecodestrip LibRaw::fujidecodeloop...

OSV-2021-1105 Heap-buffer-overflow in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36908 Crash type: Heap-buffer-overflow READ 1 Crash state: readconfig snmpconfigfuzzer.c...

OSV-2021-1102 Heap-use-after-free in usbredirparser_serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36861 Crash type: Heap-use-after-free WRITE 4 Crash state: usbredirparserserialize tryserialize usbredirparserfuzz.cc...

OSV-2021-1099 Stack-buffer-overflow in ot::StringFind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36830 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::StringFind ot::Coap::Message::AppendUriPathOptions otCoapMessageAppendUriPathOptions...

OSV-2021-1084 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36738 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::ResolveConstant...

OSV-2021-1085 Stack-buffer-overflow in strcat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36743 Crash type: Stack-buffer-overflow WRITE Crash state: strcat prvTidystrrep tidyMessageCreateInitV...

OSV-2021-1083 Heap-buffer-overflow in flb_hash_get_by_id

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36718 Crash type: Heap-buffer-overflow READ Crash state: flbhashgetbyid utilsfuzzer.c...

OSV-2021-1080 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36706 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-1079 Stack-use-after-return in aio_bh_dequeue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36690 Crash type: Stack-use-after-return READ 8 Crash state: aiobhdequeue aiobhpoll aiodispatch...

OSV-2021-1076 UNKNOWN READ in ParseXMLElement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36671 Crash type: UNKNOWN READ Crash state: ParseXMLElement prvTidyParseXMLDocument prvTidyDocParseStream...

OSV-2021-1075 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36677 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-1074 Use-of-uninitialized-value in SkBaseDevice::save

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36647 Crash type: Use-of-uninitialized-value Crash state: SkBaseDevice::save SkCanvas::internalSave SkCanvas::internalSaveLayer...