ffmpeg:ffmpeg_AV_CODEC_ID_AAC_DEC_fuzzer: Use-of-uninitialized-value in ff_aac_ec_data_dec

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6460684568428544 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDAACDECfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

ghostscript:gs_xps_fuzzer: Heap-use-after-free in txt_impl_process

Detailed Report: https://oss-fuzz.com/testcase?key=6422215347470336 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsxpsfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address: 0x7c54dadcc973 Crash State: txtimplprocess...

haproxy:fuzz_cfg_parser: Global-buffer-overflow in cfg_eval_cond_term

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=6039851723194368 Project: haproxy Fuzzing Engine: honggfuzz Fuzz Target: fuzzcfgparser Job Type: honggfuzzasanhaproxy Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in grk::FileFormatMJ2Decompress::read_mdhd

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=5918383458811904 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...

libvips:vips_fuzzer: Crash in vips_invertlut_build

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5664453864783872 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: vipsfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7a09671e9680 Crash...

kde-thumbnailers:gsthumbnail_fuzzer: Heap-buffer-overflow in dsc_copy_string

Detailed Report: https://oss-fuzz.com/testcase?key=5160199337082880 Project: kde-thumbnailers Fuzzing Engine: libFuzzer Fuzz Target: gsthumbnailfuzzer Job Type: libfuzzerasankde-thumbnailers Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7aa8d80e23c0 Crash State:...

llvm:llvm-opt-fuzzer--x86_64-lower_matrix_intrinsics: Use-of-uninitialized-value in llvm::Value::eraseMetadataIf

Detailed Report: https://oss-fuzz.com/testcase?key=5114845824614400 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-opt-fuzzer--x8664-lowermatrixintrinsics Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

checkstyle:CheckstyleFuzzer: Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement

Detailed Report: https://oss-fuzz.com/testcase?key=4893279333449728 Project: checkstyle Fuzzing Engine: libFuzzer Fuzz Target: CheckstyleFuzzer Job Type: libfuzzerasancheckstyle Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

assimp:assimp_fuzzer: Crash in unsigned long Assimp::StreamReader<true, true>::Get<unsigned long>

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4846648873517056 Project: assimp Fuzzing Engine: afl Fuzz Target: assimpfuzzer Job Type: aflasanassimp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x78a628c42d94 Crash State: unsigned...

mupdf:pdf_fuzzer: Heap-buffer-overflow in fz_unpack_line

Project: git://git.ghostscript.com/mupdf.git https://github.com/ArtifexSoftware/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=4634427291664384 Project: mupdf Fuzzing Engine: honggfuzz Fuzz Target: pdffuzzer Job Type: honggfuzzasanmupdf Platform Id: linux Crash Type:...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in read_lazy_chunk_bytes

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=4519495711653888 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Addres...

GHSA-JFQG-HF23-QPW2 Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Impact Apps that pass VideoFrame objects from the WebCodecs API across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world for example, via XSS can use a bridged VideoFrame to gain access to the isolated world, including any...

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Impact Apps that pass VideoFrame objects from the WebCodecs API across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world for example, via XSS can use a bridged VideoFrame to gain access to the isolated world, including any...

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Impact On macOS, app.moveToApplicationsFolder used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the...

GHSA-5RQW-R77C-JP79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Impact On macOS, app.moveToApplicationsFolder used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the...

Electron: Service worker can spoof executeJavaScript IPC replies

Impact A service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered...

GHSA-XJ5X-M3F3-5X3H Electron: Service worker can spoof executeJavaScript IPC replies

Impact A service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered...

Electron: Incorrect origin passed to permission request handler for iframe requests

Impact When an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter ...

GHSA-R5P7-GP4J-QHRX Electron: Incorrect origin passed to permission request handler for iframe requests

Impact When an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter ...

GHSA-3C8V-CFP5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Impact On macOS and Linux, apps that call app.requestSingleInstanceLock were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same...