OSV-2022-223 Container-overflow in Exiv2::Photoshop::locateIrb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45302 Crash type: Container-overflow READ 4 Crash state: Exiv2::Photoshop::locateIrb Exiv2::Photoshop::setIptcIrb Exiv2::JpegBase::doWriteMetadata...

libxslt:xslt: Invalid-free in xmlFreeNodeList

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=5480760906219520 Project: libxslt Fuzzing Engine: afl Fuzz Target: xslt Job Type: aflasanlibxslt Platform Id: linux Crash Type: Invalid-free Crash Address: 0x6190000006c0 Crash State:...

OSV-2022-222 Heap-use-after-free in cb_stdout_flush

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45251 Crash type: Heap-use-after-free READ Crash state: cbstdoutflush outputprecbflush flb-it-fuzz-filterstdoutfuzzerOSSFUZZ...

OSV-2022-220 Stack-buffer-overflow in load_regex_matcher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45247 Crash type: Stack-buffer-overflow WRITE 1 Crash state: loadregexmatcher cliloadpdb cliload...

libreoffice:svmfuzzer: Heap-buffer-overflow in OutputDevice::DrawHatchLine

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4780802620129280 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: svmfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash...

libxslt:xslt: Invalid-free in xmlFreeProp

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed Report: https://oss-fuzz.com/testcase?key=4769079506894848 Project: libxslt Fuzzing Engine: libFuzzer Fuzz Target: xslt Job Type: libfuzzerasanlibxslt Platform Id: linux Crash Type: Invalid-free Crash Address: 0x6190000005ed Crash State...

OSV-2022-217 Stack-buffer-overflow in msgpack_sbuffer_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45208 Crash type: Stack-buffer-overflow READ Crash state: msgpacksbufferwrite flbpackmsgpacktojsonformat flbjsonfuzzer.c...

OSV-2022-216 Null-dereference READ in cl_finish_hash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45197 Crash type: Null-dereference READ Crash state: clfinishhash hashimptbl scanpeimp...

OSV-2022-214 Heap-buffer-overflow in cli_bcomp_freemeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45194 Crash type: Heap-buffer-overflow READ 8 Crash state: clibcompfreemeta clibcompaddpatt readdbparseldbsubsignature...

fluent-bit:flb-it-fuzz-flb_json_fuzzer_OSSFUZZ: Stack-buffer-overflow in msgpack_sbuffer_write

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=4894251580784640 Project: fluent-bit Fuzzing Engine: afl Fuzz Target: flb-it-fuzz-flbjsonfuzzerOSSFUZZ Job Type: aflasanfluent-bit Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash...

OSV-2022-210 UNKNOWN READ in pdfi_count_cff_index

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45173 Crash type: UNKNOWN READ Crash state: pdficountcffindex pdfireadcfffont pdfiloadfont...

OSV-2022-209 Heap-buffer-overflow in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45161 Crash type: Heap-buffer-overflow READ 4 Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

libreoffice:htmlfuzzer: Memcpy-param-overlap in HTMLParser::FilterXMP

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5912552456978432 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: htmlfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...

yara:dotnet_fuzzer: Heap-buffer-overflow in dotnet_parse_tilde_2

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5275377885380608 Project: yara Fuzzing Engine: libFuzzer Fuzz Target: dotnetfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x618000000ba...

libxml2:xml: Invalid-free in xmlFreeProp

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5805533850894336 Project: libxml2 Fuzzing Engine: afl Fuzz Target: xml Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Invalid-free Crash Address: 0x619000000ff8 Crash State: xmlFreeProp...

pillow:fuzz_pillow: Heap-buffer-overflow in ImagingTgaRleDecode

Detailed Report: https://oss-fuzz.com/testcase?key=5309778291720192 Project: pillow Fuzzing Engine: libFuzzer Fuzz Target: fuzzpillow Job Type: libfuzzerasanpillow Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x616000658a81 Crash State: ImagingTgaRleDecode decode...

OSV-2022-206 Heap-buffer-overflow in spgetcc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45049 Crash type: Heap-buffer-overflow READ Crash state: spgetcc gsscantoken gsinterpret...

binutils:fuzz_as: Use-of-uninitialized-value in buffer_and_nest

Detailed Report: https://oss-fuzz.com/testcase?key=6259013149392896 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzas Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: bufferandnest dorepeat srept Sanitizer: memory...

upb:file_descriptor_parsenew_fuzzer: Use-of-uninitialized-value in resolve_fielddef

Detailed Report: https://oss-fuzz.com/testcase?key=5010696608284672 Project: upb Fuzzing Engine: libFuzzer Fuzz Target: filedescriptorparsenewfuzzer Job Type: libfuzzermsanupb Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: resolvefielddef upbDefPoolAddFile...

ghostscript:gstoraster_fuzzer: Heap-use-after-free in gstate_free_contents

Detailed Report: https://oss-fuzz.com/testcase?key=5019015288848384 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x61c000000910 Crash State: gstatefreeconten...