OSV-2021-404 Segv on unknown address in blosc_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30974 Crash type: Segv on unknown address Crash state: bloscreadheader blosc2getitemctx bloscgetitem...

OSV-2021-401 Segv on unknown address in us_internal_dispatch_ready_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30951 Crash type: Segv on unknown address Crash state: usinternaldispatchreadypoll uslooprun test...

OSV - Open Source Vulnerability DB And Triage Service

OSV is a vulnerability database and triage infrastructure for open source projects aimed at helping both open source maintainers and consumers of open source. For open source maintainers, OSV's automation helps reduce the burden of triage. Each vulnerability undergoes automated bisection and impa...

[SECURITY] Fedora 33 Update: audacity-2.4.2-4.fc33

Audacity is a cross-platform multitrack audio editor. It allows you to record sounds directly or to import files in various formats. It features a few simple effects, all of the editing features you should need, and unlimited undo. The GUI was built with wxWidgets and the audio I/O supports...

OSV-2021-399 Heap-buffer-overflow in void AK::__format_value<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30914 Crash type: Heap-buffer-overflow READ 1 Crash state: void AK::formatvalue AK::vformatimpl AK::vformatimpl...

Fedora: Security Advisory for audacity (FEDORA-2021-8aaccdbb5f)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OSV-2021-395 Heap-buffer-overflow in Crypto::der_decode_integer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30907 Crash type: Heap-buffer-overflow READ 1 Crash state: Crypto::derdecodeinteger Crypto::derdecodesequence Crypto::derdecodesequencemany::operator bool...

OSV-2021-389 Bad-cast to tt_cmap_t' (aka 'struct _tt_cmap')_cairo_truetype_index_to_ucs4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30823 Crash type: Bad-cast Crash state: Bad-cast to ttcmapt' aka 'struct ttcmap'cairotruetypeindextoucs4 cairosubfontglyphlookupunicode cairosubfontmapglyph...

OSV-2021-386 Stack-buffer-overflow in ot::Coap::Message::AppendUintOption

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30831 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::Coap::Message::AppendUintOption ot::Coap::Message::AppendBlockOption otCoapMessageAppendBlock2Option...

OSV-2021-385 Heap-buffer-overflow in grk::BitIO::bytein

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30863 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::BitIO::bytein grk::BitIO::read grk::T2Decompress::readpacketheader...

OSV-2021-374 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30817 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::AnchorMatrix::subset...

OSV-2021-369 Segv on unknown address in blosc_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30761 Crash type: Segv on unknown address Crash state: bloscreadheader blosc2getitemctx bloscgetitem...

OSV-2021-367 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30749 Crash type: Heap-buffer-overflow READ Crash state: H5MMmemcpy H5VMmemcpyvv H5Dcompactreadvv...

OSV-2021-366 Negative-size-param in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30748 Crash type: Negative-size-param Crash state: framegetmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-365 Global-buffer-overflow in llvm_ks::StringRef::find_last_not_of

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30790 Crash type: Global-buffer-overflow READ 1 Crash state: llvmks::StringRef::findlastnotof llvmks::StringRef::rtrim llvmks::StringRef::trim...

OSV-2021-363 Heap-buffer-overflow in H5HG_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30743 Crash type: Heap-buffer-overflow READ 8 Crash state: H5HGread H5VLnativeblobget H5VLblobget...

OSV-2021-349 Heap-buffer-overflow in flatbuffers::vector_downward::fill

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30684 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flatbuffers::vectordownward::fill flatbuffers::FlatBufferBuilder::PreAlign flatbuffers::FlatBufferBuilder::ForceVectorAlignment...

OSV-2021-347 Heap-buffer-overflow in flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30682 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::Table flatbuffers::GetMutableRoot flatbuffers::Table const flatbuffers::GetRoot flatbuffers::JsonPrinter::GenFieldOffset...

OSV-2021-333 Heap-buffer-overflow in int flatbuffers::ReadScalar<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30699 Crash type: Heap-buffer-overflow READ 4 Crash state: int flatbuffers::ReadScalar flatbuffers::Table::GetVTable flatbuffers::Table::GetOptionalFieldOffset...

OSV-2021-315 Global-buffer-overflow in Gfx::decode_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30507 Crash type: Global-buffer-overflow READ 4 Crash state: Gfx::decodeframe Gfx::GIFImageDecoderPlugin::frame Gfx::GIFImageDecoderPlugin::bitmap...