SUSE CVE-2007-0776

Heap-based buffer overflow in the cairopeninit function in Mozilla Firefox 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allows remote attackers to execute arbitrary code via a large stroke-width attribute in the clipPath element in an SVG file...

OSV-2022-1001 Heap-buffer-overflow in SkRect::setBoundsCheck

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51933 Crash type: Heap-buffer-overflow READ 8 Crash state: SkRect::setBoundsCheck SkEdgeClipper::clipCubic SkEdgeClipper::ClipPath...

OSV-2022-986 Heap-buffer-overflow in SkEdgeClipper::ClipPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51917 Crash type: Heap-buffer-overflow READ 8 Crash state: SkEdgeClipper::ClipPath SkPathPriv::PerspectiveClip SkPath::transform...

OSV-2022-983 Heap-buffer-overflow in SkPathPriv::IsRectContour

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51909 Crash type: Heap-buffer-overflow READ 4 Crash state: SkPathPriv::IsRectContour SkPath::isRect SkCanvas::clipPath...

PT-2022-37320 · Skia · Skia

Name of the Vulnerable Software and Affected Versions: Skia affected versions not specified Description: The issue is related to a heap-buffer-overflow read, which occurs in the SkPathPriv::IsRectContour function. This function is called by SkPath::isRect and SkCanvas::clipPath. No information is...

Opera SVG Use After Free Vulnerability

No description provided by source. svg xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w0.org/1999/xlink g id=group defs clipPath id=clip-circle clip-path=urlclip-rect /clipPath clipPath id=clip-rect /clipPath /defs circle id=rect x=10 y=10 width=100 height=100 fill=green / /g script!CDAT...

Opera SVG - Use-After-Free

!CDATA //Author=Cons0ul var b = new Array; // this is our spray function where spray is allocated on LFH with exact size 0x78 // so 0x78 size of block is created so far we are creating 0x50000 blocks // to create 0x78 blocks we are using ArrayBuffer; function fengshui...

CVE-2007-0776: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the cairopeninit function in Mozilla Firefox 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allows remote attackers to execute arbitrary code via a large stroke-width attribute in the clipPath element in an SVG file...