OSV-2020-55 Stack-buffer-overflow in tcos_decipher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967 Crash type: Stack-buffer-overflow WRITE Crash state: tcosdecipher scdecipher usekey...

OSV-2020-39 Heap-use-after-free in ndpi_http_check_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22899 Crash type: Heap-use-after-free READ 1 Crash state: ndpihttpcheckcontent ndpiinthttpaddconnection ndpicheckhttptcp...

OSV-2020-54 Heap-buffer-overflow in OT::HintingDevice* hb_serialize_context_t::embed<OT::HintingDevice>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20211 Crash type: Heap-buffer-overflow READ Crash state: OT::HintingDevice hbserializecontextt::embed OT::HintingDevice::copy OT::Device::copy...

OSV-2020-49 Heap-buffer-overflow in ndpi_netbios_name_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21365 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpinetbiosnameinterpret ndpiintnetbiosaddconnection checkndpiudpflowfunc...

OSV-2020-48 UNKNOWN READ in decode_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20448 Crash type: UNKNOWN READ Crash state: decodefast unpackdsdsamples WavpackUnpackSamples...

OSV-2020-53 Index-out-of-bounds in parse_exp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22925 Crash type: Index-out-of-bounds Crash state: parseexp parsebranch parsealts...

OSV-2020-42 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20695 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-32 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber douncompressblock...

OSV-2020-40 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20766 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-34 UNKNOWN READ in parquet::LevelDecoder::SetData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20666 Crash type: UNKNOWN READ Crash state: parquet::LevelDecoder::SetData parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::ColumnReaderImplBaseparquet::PhysicalType...

OSV-2020-15 UNKNOWN READ in _01inverse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22245 Crash type: UNKNOWN READ Crash state: 01inverse res1inverse mapping0inverse...

OSV-2020-21 UNKNOWN WRITE in arrow::internal::unpack32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20711 Crash type: UNKNOWN WRITE Crash state: arrow::internal::unpack32 int arrow::BitUtil::BitReader::GetBatch parquet::DictByteArrayDecoderImpl::DecodeArrowDense...

OSV-2020-24 Heap-buffer-overflow in pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23026 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage pcpp::SSLHandshakeMessage::createHandhakeMessage pcpp::SSLHandshakeLayer::SSLHandshakeLayer...

OSV-2020-14 Stack-buffer-overflow in fmt_setup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22507 Crash type: Stack-buffer-overflow WRITE 1 Crash state: fmtsetup mrbstrformat mrbfsprintf...

OSV-2020-28 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20712 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

OSV-2020-29 Heap-use-after-free in CRYPTO_DOWN_REF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20816 Crash type: Heap-use-after-free WRITE 4 Crash state: CRYPTODOWNREF DHfree evppkeyfreeit...

OSV-2020-19 Heap-use-after-free in htp_connp_is_line_terminator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21712 Crash type: Heap-use-after-free READ 1 Crash state: htpconnpislineterminator htpconnpREQHEADERS htpconnpreqdata...

OSV-2020-18 Heap-buffer-overflow in ndpi_search_openvpn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22244 Crash type: Heap-buffer-overflow READ 8 Crash state: ndpisearchopenvpn checkndpiudpflowfunc ndpidetectionprocesspacket...

OSV-2020-16 Heap-use-after-free in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20906 Crash type: Heap-use-after-free READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::GlyphVarData::hasdata...

OSV-2020-11 Heap-buffer-overflow in jbig2_image_get_pixel_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20440 Crash type: Heap-buffer-overflow READ 1 Crash state: jbig2imagegetpixelfast jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...