OSV-2023-372 UNKNOWN WRITE in hb_ot_layout_substitute_start

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58626 Crash type: UNKNOWN WRITE Crash state: hbotlayoutsubstitutestart hbotshape hbshapeplanexecute...

OSV-2023-371 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58625 Crash type: Memcpy-param-overlap Crash state: repeat pere cliregcompreal...

graphicsmagick:coder_TOPOL_fuzzer: Heap-buffer-overflow in CheckFName

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5319412560035840 Project: graphicsmagick Fuzzing Engine: afl Fuzz Target: coderTOPOLfuzzer Job Type: aflasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

harfbuzz:hb-shape-fuzzer: Crash in hb_ot_layout_substitute_start

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5920994267889664 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-shape-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x08669764...

OSV-2023-366 Heap-use-after-free in gc_mark_children

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58577 Crash type: Heap-use-after-free READ 4 Crash state: gcmarkchildren incrementalgc mrbfullgc...

OSV-2023-364 Heap-double-free in HashMgr::~HashMgr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58553 Crash type: Heap-double-free Crash state: HashMgr::HashMgr HunspellImpl::HunspellImpl Hunspell::Hunspell...

libecc:cryptofuzz-libecc: Index-out-of-bounds in sp_mul

Project: https://github.com/ANSSI-FR/libecc.git https://github.com/libecc/libecc.git Detailed Report: https://oss-fuzz.com/testcase?key=5007685845385216 Project: libecc Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-libecc Job Type: libfuzzerubsanlibecc Platform Id: linux Crash Type:...

OSV-2023-361 Heap-buffer-overflow in tok_get_normal_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58510 Crash type: Heap-buffer-overflow WRITE 1 Crash state: tokgetnormalmode PyTokenizerGet PyPegentokenizefullsourcetocheckforerrors...

poco:json_parser_fuzzer: Use-of-uninitialized-value in Poco::Dynamic::Var::~Var

Project: https://github.com/pocoproject/poco.git Detailed Report: https://oss-fuzz.com/testcase?key=5662436329127936 Project: poco Fuzzing Engine: libFuzzer Fuzz Target: jsonparserfuzzer Job Type: libfuzzermsanpoco Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

zeek:zeek-packet-fuzzer: Heap-buffer-overflow in zeek::packet_analysis::IEEE802_11::IEEE802_11Analyzer::AnalyzePacket

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=5569818983268352 Project: zeek Fuzzing Engine: libFuzzer Fuzz Target: zeek-packet-fuzzer Job Type: libfuzzerasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x606000d1baf...

OSV-2023-358 Heap-double-free in wolfCrypt_custom_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58484 Crash type: Heap-double-free Crash state: wolfCryptcustomfree wolfSSLFree FreeOcspRequest...

OSV-2023-357 Heap-buffer-overflow in flac__analyze_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58481 Crash type: Heap-buffer-overflow READ 4 Crash state: flacanalyzeframe writecallback writeaudioframetoclient...

skia-ftz:sksl2pipeline: Use-after-poison in SkSL::IsAssignableVisitor::visitExpression

Detailed Report: https://oss-fuzz.com/testcase?key=5090480953360384 Project: skia-ftz Fuzzing Engine: libFuzzer Fuzz Target: sksl2pipeline Job Type: libfuzzerasanskia-ftz Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x631000000b88 Crash State:...

OSV-2023-356 Heap-buffer-overflow in pdf_nextobject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58475 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfnextobject findlength pdfextractobj...

flac:fuzzer_tool_flac: Heap-buffer-overflow in flac__analyze_frame

Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=5235296999702528 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzertoolflac Job Type: libfuzzerasani386flac Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0xf5701874...

OSV-2023-353 Stack-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58405 Crash type: Stack-buffer-overflow WRITE 1 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcfffont...

OSV-2023-350 UNKNOWN READ in cli_html_normalise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58398 Crash type: UNKNOWN READ Crash state: clihtmlnormalise htmlnormalisemap cliscanhtml...

clamav:clamav_scanmap_PDF_fuzzer: Heap-buffer-overflow in pdf_nextobject

Project: https://github.com/Cisco-Talos/clamav.git Detailed Report: https://oss-fuzz.com/testcase?key=6599080934768640 Project: clamav Fuzzing Engine: libFuzzer Fuzz Target: clamavscanmapPDFfuzzer Job Type: libfuzzerasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

ghostscript:gs_device_psdcmyk_fuzzer: Heap-use-after-free in pdfi_cspace_free_callback

Detailed Report: https://oss-fuzz.com/testcase?key=5012590379270144 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicepsdcmykfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x631000118868 Crash State:...

OSV-2023-346 UNKNOWN WRITE in void std::__1::allocator_traits<std::__1::allocator<wabt::interp::HandlerDesc> >

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58344 Crash type: UNKNOWN WRITE Crash state: void std::1::allocatortraits void std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::inter std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::interp::Ha...