shopify-scripts: Read after free in mrb_vm_exec with OP_ARYCAT reading R(B)

Hi, Slightly different one, this is a use after free as reported by an ASAN compiled binary. This one doesn't affect mruby-engine with the current instruction limit and memory limit, but if they are increased then it does. The file is: class Klazz def $thing.name [email protected]@thing.name nil end...

libarchive: Heap-buffer-overflow in archive_le32dec

Project: https://github.com/libarchive/libarchive.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4591448766808064 Target: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzzer binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type:...

pcre2: Heap-buffer-overflow in read_repeat_counts

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4719096310530048 Fuzzer: libFuzzerpcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x603000000118 Crash State:...

Wireshark - erf_meta_read_tag SIGSEGV

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=803 The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file": --- cut --- ==28415==ERROR:...

Wireshark - erf_meta_read_tag SIGSEGV

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=803 The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark...

Wireshark - erf_meta_read_tag SIGSEGV

Wireshark - erfmetareadtag SIGSEGV Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=803 The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr...

Internet Bug Bounty: Integer underflow / arbitrary null write in fread/gzread

https://bugs.php.net/bug.php?id=72114 Integer underflow in the fread/gzread length parameter allows to write an arbitrary null byte on 64 bit platforms. This was identified with the help of ASAN and a custom fuzzer. gdb run gzread2.php Starting program: /home/operac/php/php-56/sapi/cli/php...

Graphite2 - GlyphCache::GlyphCache Heap Based Buffer Overflow

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=749 The following crash due to a heap-based buffer overflow can be observed in a slightly modified ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered wi...

Graphite2 - GlyphCache::Loader Heap Based Overreads

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=751 The following crashes due to two different heap-based buffer overreads can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with...

Graphite2 - TtfUtil::CheckCmapSubtable12 Heap Overread

Graphite2 - TtfUtil::CheckCmapSubtable12 Heap Overread Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=752 The following crash due to a heap-based buffer overread can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the followi...

Graphite2 - GlyphCache::GlyphCache Heap Buffer Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=749 The following crash due to a heap-based buffer overflow can be observed in a slightly modified ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the following command: $ ./gr2fonttest...

Graphite2 - GlyphCache::Loader Heap Overreads

Graphite2 - GlyphCache::Loader Heap Overreads Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=751 The following crashes due to two different heap-based buffer overreads can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the...

Graphite2 - TtfUtil::CmapSubtable4NextCodepoint Heap Overread

Graphite2 - TtfUtil::CmapSubtable4NextCodepoint Heap Overread Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=755 The following crash due to a heap-based buffer overread can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the...

Graphite2 - TtfUtil::CmapSubtable4NextCodepoint Heap Overread

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=755 The following crash due to a heap-based buffer overread can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the following command: $ ./gr2fonttest /path/to/file -auto --- cut...

Graphite2 - TtfUtil::CheckCmapSubtable12 Heap Overread

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=752 The following crash due to a heap-based buffer overread can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the following command: $ ./gr2fonttest /path/to/file -auto --- cut...

Graphite2 - NameTable::getName Multiple Heap Out-of-Bounds Reads

Graphite2 - NameTable::getName Multiple Heap Out-of-Bounds Reads Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=756 We have encountered several different crashes in the graphite2::NameTable::getName method, observed in an ASAN build of the standard Graphite2 gr2FontTest utility...

Graphite2 - GlyphCache::Loader Heap Overreads

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=751 The following crashes due to two different heap-based buffer overreads can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the following command: $ ./gr2fonttest /path/to/fil...

Wireshark - AirPDcapDecryptWPABroadcastKey Heap Based Out-of-Bounds Read

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=740 The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark...

Wireshark - 'AirPDcapDecryptWPABroadcastKey' Heap Out-of-Bounds Read (2)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=740 The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file": --- cut --- ==8910==ERROR:...

Wireshark - ett_zbee_zcl_pwr_prof_enphases Static Out-of-Bounds Read

Wireshark - ettzbeezclpwrprofenphases Static Out-of-Bounds Read Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=806 The following crashes due to a static out-of-bounds memory read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to...