OSV-2023-436 Heap-buffer-overflow in ndpi_check_punycode_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59393 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpicheckpunycodestring ndpimatchhostsubprotocol checkcontenttypeandchangeprotocol...

OSV-2022-1275 Security exception in java.desktop/java.awt.image.DataBufferInt.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59354 Crash type: Security exception Crash state: java.desktop/java.awt.image.DataBufferInt. java.desktop/java.awt.image.Raster.createPackedRaster java.desktop/java.awt.image.DirectColorModel.createCompatibleWritableRaster...

OpenEXR -- heap buffer overflow in internal_huf_decompress

oss-fuzz reports: heap buffer overflow in internalhufdecompress. Cary Phillips reports: v3.1.9 - Patch release that addresses ... also OSS-fuzz 59382 Heap-buffer-overflow in internalhufdecompress Kimball Thurston reports: Fix scenario where malformed dwa file could read past end of buffer - fixes...

GHSA-FRQX-JFCM-6JJR malformed proposed intoto entries can cause a panic

Impact A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. Patches This is fixed in v1.2.0 of...

malformed proposed intoto entries can cause a panic

Impact A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. Patches This is fixed in v1.2.0 of...

OSV-2023-426 Heap-buffer-overflow in libdeflate_zlib_decompress_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59267 Crash type: Heap-buffer-overflow READ 2 Crash state: libdeflatezlibdecompressex exruncompressbuffer DwaCompressoruncompress...

OSV-2023-425 Heap-buffer-overflow in ICMPinfo::dissectICMP

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59217 Crash type: Heap-buffer-overflow READ 1 Crash state: ICMPinfo::dissectICMP NetworkInterface::processPacket NetworkInterface::dissectPacket...

OSV-2023-423 Heap-buffer-overflow in NetworkInterface::dissectPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59216 Crash type: Heap-buffer-overflow READ 4 Crash state: NetworkInterface::dissectPacket fuzzdissectpacket.cpp...

OSV-2023-422 Heap-use-after-free in wmem_memdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59167 Crash type: Heap-use-after-free READ 6 Crash state: wmemmemdup copyaddress fragmentaddressespersistentkey...

OSV-2023-418 Heap-buffer-overflow in bfd_getl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59148 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetl32 bfdstabsectionfindnearestline cofffindnearestlinewithnames...

OSV-2023-416 UNKNOWN READ in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59118 Crash type: UNKNOWN READ Crash state: dxffixupstring dwgdxfDIMENSIONALIGNEDprivate dwgdxfDIMENSIONALIGNED...

OSV-2023-415 UNKNOWN READ in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59097 Crash type: UNKNOWN READ Crash state: dxffixupstring dwgdxfLAYOUTprivate dwgdxfLAYOUT...

OSV-2023-409 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59072 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2023-408 Security exception in org.apache.lucene.util.ArrayUtil.growExact

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59071 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.growExact org.apache.lucene.util.ArrayUtil.grow org.apache.lucene.util.BytesRefBuilder.grow...

OSV-2023-407 Stack-buffer-overflow in DwaCompressor_readChannelRules

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59070 Crash type: Stack-buffer-overflow READ Crash state: DwaCompressorreadChannelRules DwaCompressoruncompress internalexrundodwaa...

OSV-2023-405 Heap-buffer-overflow in _lou_stringHash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59057 Crash type: Heap-buffer-overflow READ 2 Crash state: loustringHash loutranslate loutranslateString...

OSV-2023-404 Invalid-free in Assimp::FBX::Scope::Scope

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59056 Crash type: Invalid-free Crash state: Assimp::FBX::Scope::Scope Assimp::FBX::Element::Element Assimp::FBX::Scope::Scope...

PT-2023-35832 · Git +1 · Liblouis

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state involves several functions, includi...

OSV-2023-402 Heap-use-after-free in Assimp::FBXExporter::WriteObjects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59036 Crash type: Heap-use-after-free READ 4 Crash state: Assimp::FBXExporter::WriteObjects Assimp::FBXExporter::ExportBinary Assimp::ExportSceneFBX...

swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. It is fixed in 1.19.2 and later releases. This vulnerability is caused by a logica...