OSV-2023-688 Invalid-free in Flow::~Flow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61361 Crash type: Invalid-free Crash state: Flow::Flow Flow::Flow GenericHash::cleanup...

OSV-2023-685 Invalid-free in reset_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61339 Crash type: Invalid-free Crash state: resetcontext cmtdecodeprometheuscreate cmetricsdecodefuzz.c...

OSV-2023-684 Heap-use-after-free in __xmlRaiseError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61337 Crash type: Heap-use-after-free READ 2 Crash state: xmlRaiseError htmlParseErr htmlCurrentChar...

OSV-2023-680 Security exception in org.apache.poi.hdgf.streams.PointerContainingStream.findChildren

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61372 Crash type: Security exception Crash state: org.apache.poi.hdgf.streams.PointerContainingStream.findChildren...

OSV-2023-676 Security exception in com.github.javaparser.ast.visitor.CloneVisitor.visit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61313 Crash type: Security exception Crash state: com.github.javaparser.ast.visitor.CloneVisitor.visit com.github.javaparser.ast.type.ClassOrInterfaceType.accept com.github.javaparser.ast.visitor.CloneVisitor.cloneNode...

OSV-2023-675 Heap-use-after-free in parse_options

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61292 Crash type: Heap-use-after-free WRITE 4 Crash state: parseoptions appendnewoperation parseoptions...

OSV-2023-674 Heap-buffer-overflow in get_grouplength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61269 Crash type: Heap-buffer-overflow WRITE 4 Crash state: getgrouplength getbranchlength getgrouplength...

OSV-2023-665 Security exception in org.apache.poi.hdgf.streams.PointerContainingStream.findChildren

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61256 Crash type: Security exception Crash state: org.apache.poi.hdgf.streams.PointerContainingStream.findChildren org.apache.poi.util.IOUtils.checkLength org.apache.poi.util.IOUtils.safelyAllocateCheck...

OSV-2023-663 Segv on unknown address in decUnitCompare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61235 Crash type: Segv on unknown address Crash state: decUnitCompare decCompare decCompareOp...

OSV-2023-660 Security exception in org.apache.poi.hwpf.model.StyleSheet.createPap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61252 Crash type: Security exception Crash state: org.apache.poi.hwpf.model.StyleSheet.createPap org.apache.poi.util.BitField.getRawValue org.apache.poi.util.BitField.getValue...

OSV-2023-650 Heap-use-after-free in yr_parser_lookup_loop_variable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61164 Crash type: Heap-use-after-free READ 1 Crash state: yrparserlookuploopvariable yarayyparse yrlexparserulesfile...

OSV-2023-648 Stack-buffer-overflow in parse_regex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61131 Crash type: Stack-buffer-overflow READ 1 Crash state: parseregex parseregex parseregex...

OSV-2023-645 Segv on unknown address in decUnitCompare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61050 Crash type: Segv on unknown address Crash state: decUnitCompare decCompare decCompareOp...

OSV-2022-1280 Heap-buffer-overflow in Canvas5Structure::NIBDecoder::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61081 Crash type: Heap-buffer-overflow READ 1 Crash state: Canvas5Structure::NIBDecoder::decode Canvas5Structure::decodeZone5 Canvas5Parser::decode...

OSV-2023-636 Security exception in jflex.core.NFA.insertNFA

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61028 Crash type: Security exception Crash state: jflex.core.NFA.insertNFA jflex.core.NFA.insertNFA jflex.core.NFA.insertNFA...

OSV-2023-634 Heap-buffer-overflow in bit_read_BB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60993 Crash type: Heap-buffer-overflow READ 1 Crash state: bitreadBB bitreadBS dwgdecodeATTDEFprivate...

OSV-2023-631 Heap-buffer-overflow in test_verify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60971 Crash type: Heap-buffer-overflow READ Crash state: testverify fuzzpkcs11.c...

OSV-2023-627 Security exception in org.apache.lucene.util.automaton.RegExp.toAutomaton

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60964 Crash type: Security exception Crash state: org.apache.lucene.util.automaton.RegExp.toAutomaton java.base/java.util.BitSet.ensureCapacity java.base/java.util.BitSet.expandTo...

OSV-2023-623 Heap-use-after-free in Elf32_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60863 Crash type: Heap-use-after-free READ 8 Crash state: Elf32free destroy rbinfilefree...

OSV-2023-619 Security exception in java.base/java.util.regex.Pattern$GroupTail.match

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60846 Crash type: Security exception Crash state: java.base/java.util.regex.Pattern$GroupTail.match java.base/java.io.BufferedWriter.ensureOpen java.base/java.io.BufferedWriter.write...