XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow

Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead...

OSV-2022-1265 Heap-buffer-overflow in BITLK_read_sb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54548 Crash type: Heap-buffer-overflow READ Crash state: BITLKreadsb cryptloadbitlk cryptload...

OSV-2022-1263 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54424 Crash type: Null-dereference READ Crash state: NULL...

OSV-2022-1262 Heap-use-after-free in HEIFHandler::ensureDecoder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54246 Crash type: Heap-use-after-free READ 3 Crash state: HEIFHandler::ensureDecoder HEIFHandler::read kimgiofuzzer.cc...

OSV-2022-1261 UNKNOWN WRITE in void std::__1::allocator_traits<std::__1::allocator<wabt::interp::HandlerDesc> >

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54245 Crash type: UNKNOWN WRITE Crash state: void std::1::allocatortraits void std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::inter std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::interp::Ha...

OSV-2022-1259 Heap-buffer-overflow in dwg_decode_INSERT_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54228 Crash type: Heap-buffer-overflow READ 1 Crash state: dwgdecodeINSERTprivate dwgdecodeINSERT dwgdecodeaddobject...

OSV-2022-1258 Heap-buffer-overflow in Assimp::ObjFileImporter::createVertexArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54187 Crash type: Heap-buffer-overflow WRITE 12 Crash state: Assimp::ObjFileImporter::createVertexArray Assimp::ObjFileImporter::createTopology Assimp::ObjFileImporter::createNodes...

OSV-2022-1252 Heap-buffer-overflow in bit_read_BB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54163 Crash type: Heap-buffer-overflow READ 1 Crash state: bitreadBB bitreadBD dwgdecodeheadervariables...

OSV-2022-1251 Heap-buffer-overflow in bit_read_B

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54162 Crash type: Heap-buffer-overflow READ 1 Crash state: bitreadB dwgdecodeheadervariables decodeR13RNUMBER...

OSV-2022-1246 Heap-buffer-overflow in AffixMgr::cpdpat_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54030 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::cpdpatcheck AffixMgr::compoundcheck AffixMgr::compoundcheck...

OSV-2022-1243 Security exception in com.github.javaparser.CommentsInserter.insertComments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53980 Crash type: Security exception Crash state: com.github.javaparser.CommentsInserter.insertComments java.base/java.util.Objects.equals com.github.javaparser.Position.equals...

OSV-2022-1234 Heap-use-after-free in gf_odf_vvc_cfg_read_bs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53971 Crash type: Heap-use-after-free READ 1 Crash state: gfodfvvccfgreadbs vvccboxread gfisomboxread...

OSV-2022-1232 Stack-buffer-overflow in sc_pkcs15init_rmdir

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53927 Crash type: Stack-buffer-overflow WRITE 1 Crash state: scpkcs15initrmdir scpkcs15initerasecardrecursively cardoserase...

OSV-2022-1230 Use-of-uninitialized-value in bn_trim

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53911 Crash type: Use-of-uninitialized-value Crash state: bntrim bndivdig bnsizestr...

OSV-2022-1229 UNKNOWN WRITE in gdev_mem_open_scan_lines_interleaved

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53903 Crash type: UNKNOWN WRITE Crash state: gdevmemopenscanlinesinterleaved memopen gssetdevicenoerase...

OSV-2022-1225 Heap-use-after-free in gs_font_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53847 Crash type: Heap-use-after-free READ 8 Crash state: gsfontfinalize gsgcreclaim ireclaim...

OSV-2022-1224 Security exception in com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer.deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53822 Crash type: Security exception Crash state: com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer.deserialize com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializerNR.deserialize...

OSV-2022-1223 Heap-use-after-free in mbedtls_pkcs7_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53798 Crash type: Heap-use-after-free READ 8 Crash state: mbedtlspkcs7free mbedtlspkcs7parseder fuzzpkcs7.c...

OSV-2022-1217 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53767 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

OSV-2022-1214 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53758 Crash type: UNKNOWN READ Crash state: chunkfreeobject gxfinalDeviceN gscspacefinal...