OSV-2020-852 Use-of-uninitialized-value in H5MM_xstrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21457 Crash type: Use-of-uninitialized-value Crash state: H5MMxstrdup H5Epushstack H5Eprintfstack...

OSV-2020-847 Use-of-uninitialized-value in ycck_cmyk_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18732 Crash type: Use-of-uninitialized-value Crash state: ycckcmykconvert sepupsample processdatasimplemain...

OSV-2020-849 Heap-buffer-overflow in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19591 Crash type: Heap-buffer-overflow READ 2 Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-845 Use-of-uninitialized-value in isMatchAtCPBoundary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19497 Crash type: Use-of-uninitialized-value Crash state: isMatchAtCPBoundary ustrFindFirst66 icu66::UnicodeString::indexOf...

OSV-2020-846 Heap-buffer-overflow in std::__1::char_traits<char>::compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22358 Crash type: Heap-buffer-overflow READ 6 Crash state: std::1::chartraits::compare wabt::stringview::compare wabt::operator==...

OSV-2020-843 Heap-buffer-overflow in uni_utf8_get_char_n

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23513 Crash type: Heap-buffer-overflow READ 1 Crash state: uniutf8getcharn smtpcommandparseparameters smtpcommandparseline...

OSV-2020-842 Heap-buffer-overflow in H5A_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18943 Crash type: Heap-buffer-overflow WRITE 3 Crash state: H5Aread H5Aread MatH5ReadVarInfo...

OSV-2020-841 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 13 Crash state: yrobjectsetstring dexparse dexload...

OSV-2020-837 UNKNOWN WRITE in helper_wfe_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20245 Crash type: UNKNOWN WRITE Crash state: helperwfearm...

OSV-2020-835 UNKNOWN READ in H5G_node_cmp3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17337 Crash type: UNKNOWN READ Crash state: H5Gnodecmp3 H5Bfind H5Gstablookup...

OSV-2020-833 Heap-buffer-overflow in Hacl_Chacha20PolyNUMBER_256_aead_decrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23934 Crash type: Heap-buffer-overflow READ 1 Crash state: HaclChacha20PolyNUMBER256aeaddecrypt ChaCha20PolyNUMBEROpen sftkChaCha20PolyNUMBERDecrypt...

OSV-2020-831 Heap-buffer-overflow in g_string_insert_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23816 Crash type: Heap-buffer-overflow READ 5 Crash state: gstringinsertlen gstringappendlen uriencoder...

OSV-2020-830 Heap-buffer-overflow in CRYPTO_128_wrap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22836 Crash type: Heap-buffer-overflow WRITE 16 Crash state: CRYPTO128wrap aeswrapcipherinternal aeswrapcipher...

libreoffice:ww8fuzzer: Index-out-of-bounds in WW8ListManager::ReadLVL

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5733197544161280 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: ww8fuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Index-out-of-bounds Crash Address:...

OSV-2020-829 Heap-use-after-free in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23834 Crash type: Heap-use-after-free READ 2 Crash state: checkcontenttypeandchangeprotocol ndpicheckhttptcp ndpisearchhttptcp...

OSV-2020-824 UNKNOWN READ in std::__1::_MetaBase<__can_be_converted_to_string_view<char, std::__1::char_trait

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24057 Crash type: UNKNOWN READ Crash state: std::1::MetaBase, std::1::allocator std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st...

OSV-2020-827 Use-of-uninitialized-value in llvm_ks::isIntN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22920 Crash type: Use-of-uninitialized-value Crash state: llvmks::isIntN X86AsmBackend::applyFixup llvmks::MCAssembler::layout...

OSV-2020-825 Index-out-of-bounds in tcg_liveness_analysis_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23971 Crash type: Index-out-of-bounds Crash state: tcglivenessanalysisarm tcggencodearm cpuarmgencodearm...

OSV-2020-828 Heap-use-after-free in draco::Metadata::AddSubMetadata

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24059 Crash type: Heap-use-after-free READ 8 Crash state: draco::Metadata::AddSubMetadata draco::MetadataDecoder::DecodeMetadata draco::MetadataDecoder::DecodeGeometryMetadata...

OSV-2020-823 Object-size in std::__1::vector<wabt::DataSegment*, std::__1::allocator<wabt::DataSegment*> >::

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20367 Crash type: Object-size Crash state: std::1::vector :: wabt::BinaryReaderIR::OnDataSymbol wabt::BinaryReader::ReadLinkingSection...