xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)

It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...

wasmtime:differential: Crash in _fini

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5750187404558336 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differential Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_search_oscar

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5077550909095936 Project: ndpi Fuzzing Engine: afl Fuzz Target: fuzzprocesspacket Job Type: aflasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x608000331572 Crash State...

janus-gateway:rtcp_fuzzer: Dynamic-stack-buffer-overflow in janus_rtcp_incoming_transport_cc

Project: https://github.com/meetecho/janus-gateway.git Detailed Report: https://oss-fuzz.com/testcase?key=5648598425665536 Project: janus-gateway Fuzzing Engine: afl Fuzz Target: rtcpfuzzer Job Type: aflasanjanus-gateway Platform Id: linux Crash Type: Dynamic-stack-buffer-overflow READ 2 Crash...

poppler:pdf_fuzzer: Use-of-uninitialized-value in Splash::pipeRunSimpleXBGR8

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=4885414177669120 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

skia:skottie_json: Use-of-uninitialized-value in sksg::Matrix<SkM44>::setMatrix

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5760004743495680 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: skottiejson Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

libreoffice:lwpfuzzer: Heap-use-after-free in XFCell::Add

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5072863168299008 Project: libreoffice Fuzzing Engine: afl Fuzz Target: lwpfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_MVDV_fuzzer: Heap-use-after-free in decode_mvdv

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5681452423577600 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDMVDVfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x6190000d4e90...

jbig2dec:jbig2_fuzzer: Use-of-uninitialized-value in jbig2_arith_decode

Project: git://git.ghostscript.com/jbig2dec.git Detailed Report: https://oss-fuzz.com/testcase?key=5658335175245824 Project: jbig2dec Fuzzing Engine: libFuzzer Fuzz Target: jbig2fuzzer Job Type: libfuzzermsanjbig2dec Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

CVE-2019-20446

In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially...

php:php-fuzz-mbstring: Heap-use-after-free in optimize_nodes

Detailed Report: https://oss-fuzz.com/testcase?key=5167491347382272 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60700000c0a0 Crash State: optimizenodes optimizenodes...

libarchive:libarchive_fuzzer: Heap-buffer-overflow in read_bits_16

Project: https://github.com/libarchive/libarchive.git Detailed Report: https://oss-fuzz.com/testcase?key=5135343248736256 Project: libarchive Fuzzing Engine: libFuzzer Fuzz Target: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

wabt:wasm2wat_fuzzer: Segv on unknown address in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/WebAssembly/wabt.git Detailed Report: https://oss-fuzz.com/testcase?key=5707618381463552 Project: wabt Fuzzing Engine: libFuzzer Fuzz Target: wasm2watfuzzer Job Type: libfuzzermsanwabt Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

qt:setMarkdown: Heap-use-after-free in QScopedPointer<QObjectData, QScopedPointerDeleter<QObjectData> >::operator->

Project: git://code.qt.io/qt/qt5.git Detailed Report: https://oss-fuzz.com/testcase?key=5728348359884800 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: setMarkdown Job Type: libfuzzerasanqt Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6020000006d8 Crash State:...

wavpack:fuzzer: Crash in decode_fast

Project: https://github.com/dbry/WavPack.git Detailed Report: https://oss-fuzz.com/testcase?key=5176778677288960 Project: wavpack Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzermsanwavpack Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x72d0001f0000 Crash State:...

USN-4234-2 firefox regressions

USN-4234-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafte...

imagemagick:encoder_dxt1_fuzzer: Use-of-uninitialized-value in PerceptibleReciprocal

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5070329724796928 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdxt1fuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

open62541:fuzz_json_decode: Heap-use-after-free in String_clear

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6215715764043776 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsondecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address...

imagemagick:encoder_palm_fuzzer: Use-of-uninitialized-value in IsFuzzyEquivalencePixelInfo

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6264774524665856 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderpalmfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

llvm:clang-fuzzer: Segv on unknown address in clang::Sema::ActOnCapScopeReturnStmt

Detailed Report: https://oss-fuzz.com/testcase?key=5675708116631552 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: clang::Sema::ActOnCapScopeReturnStmt...