OSV-2018-109 Heap-use-after-free in ssl_get_prev_session

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8241 Crash type: Heap-use-after-free READ 4 Crash state: sslgetprevsession tlsearlypostprocessclienthello tlspostprocessclienthello...

OSV-2018-108 UNKNOWN READ in BEInt<int, 4>::operator int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10898 Crash type: UNKNOWN READ Crash state: BEInt::operator int hbkernmachinet::kern AAT::KerxSubTableFormat6::apply...

OSV-2018-105 UNKNOWN READ in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11300 Crash type: UNKNOWN READ Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2018-106 Stack-use-after-return in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10082 Crash type: Stack-use-after-return READ 1 Crash state: BEInt::operator unsigned short OT::CoverageFormat2::Iter::more OT::SingleSubstFormat2::closure...

OSV-2018-102 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11303 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rbinfilegetstrings rbinobjectsetitems...

OSV-2018-101 Heap-buffer-overflow in r_bin_mdmp_init_pe_bins

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11361 Crash type: Heap-buffer-overflow READ 8 Crash state: rbinmdmpinitpebins rbinmdmpinit rbinmdmpnewbuf...

OSV-2018-99 Heap-buffer-overflow in git__strntol64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11173 Crash type: Heap-buffer-overflow READ 1 Crash state: gitstrntol64 gitsignatureparse gitcommitparseraw...

OSV-2018-97 Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11713 Crash type: Heap-buffer-overflow READ Crash state: CFF::CFF2VariationStore::serialize writecff2 hbsubsetcff2...

OSV-2018-95 Heap-use-after-free in Envoy::FakeConnectionBase::close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8783 Crash type: Heap-use-after-free READ 1 Crash state: Envoy::FakeConnectionBase::close Envoy::Event::DispatcherImpl::runPostCallbacks eventprocessactivesinglequeue...

OSV-2018-91 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10881 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::kern::hasdata hbotlayouthaskerning...

OSV-2018-90 Heap-buffer-overflow in wireguard_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11279 Crash type: Heap-buffer-overflow READ 8 Crash state: wireguarddone netdevfree netdevunref...

OSV-2018-89 Heap-use-after-free in TunnelIPv6Interface::remove_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10864 Crash type: Heap-use-after-free READ 4 Crash state: TunnelIPv6Interface::removeaddress nl::wpantund::NCPInstanceBase::unicastaddresswasremoved nl::wpantund::NCPInstanceBase::onmeshprefixwasremoved...

OSV-2018-83 Heap-buffer-overflow in encode_LEARN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12328 Crash type: Heap-buffer-overflow READ Crash state: encodeLEARN ofpactsputopenflowactions ofputilencodeflowmod...

OSV-2018-82 Heap-buffer-overflow in OT::LigatureSubstFormat1::closure

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10081 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::LigatureSubstFormat1::closure hbvoidt const OT::hbclosurecontextt::dispatch OT::hbclosurecontextt::returnt OT::LigatureSubst::dispatchOT::hbclosureco...

OSV-2018-79 Use-of-uninitialized-value in g_dbus_message_new_from_blob

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9825 Crash type: Use-of-uninitialized-value Crash state: gdbusmessagenewfromblob fuzzdbusmessage.c gdbusmessagenewfromblob...

OSV-2018-75 Heap-buffer-overflow in ref_oneandzero_unpad

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10628 Crash type: Heap-buffer-overflow READ 1 Crash state: refoneandzerounpad fuzz fuzzers.h...

OSV-2018-74 Heap-use-after-free in yr_re_ast_extract_literal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11753 Crash type: Heap-use-after-free READ 4 Crash state: yrreastextractliteral yrparserwritestring yrparserreducestringdeclaration...

OSV-2018-73 Stack-buffer-overflow in hb_array_t<char const>::cmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11908 Crash type: Stack-buffer-overflow READ 4 Crash state: hbarrayt::cmp OT::post::acceleratort::cmpkey hbbsearchr...

OSV-2018-72 Use-of-uninitialized-value in read_pbkdf2_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10143 Crash type: Use-of-uninitialized-value Crash state: readpbkdf2params gnutlsreadpkcsschemaparams pkcs8keydecrypt...

OSV-2018-70 Heap-buffer-overflow in learn_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11862 Crash type: Heap-buffer-overflow READ 2 Crash state: learncheck ofpactscheck parseofpstr...