librawspeed/Cr2DecompressorFuzzer: Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6162553081167872 Project: librawspeed Fuzzer: libFuzzerlibrawspeedCr2DecompressorFuzzer Fuzz target binary: Cr2DecompressorFuzzer Job Type: libfuzzermsanlibrawspeed Platform Id: linux Crash...

skia/image_filter_deserialize_width: Use-of-uninitialized-value in SkMatrix::getType

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5662420044349440 Project: skia Fuzzer: libFuzzerskiaimagefilterdeserializewidth Fuzz target binary: imagefilterdeserializewidth Job Type: libfuzzermsanskia Platform Id: linux Crash Type:...

dlplibs/cdrfuzzer: Use-of-uninitialized-value in libcdr::CDRContentCollector::_generateBitmapFromPattern

Detailed report: https://oss-fuzz.com/testcase?key=5929090067464192 Project: dlplibs Fuzzer: libFuzzerdlplibscdrfuzzer Fuzz target binary: cdrfuzzer Job Type: libfuzzermsandlplibs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

imagemagick/ping_mvg_fuzzer: Heap-buffer-overflow in TracePoint

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4676100501274624 Project: imagemagick Fuzzer: aflimagemagickpingmvgfuzzer Fuzz target binary: pingmvgfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow...

imagemagick: Heap-buffer-overflow in SetPixelIndex

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4766460271394816 Project: imagemagick Fuzzer: libFuzzerimagemagickpingwpgfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...

imagemagick/ping_mvg_fuzzer: Crash in TracePoint

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=6268203001970688 Project: imagemagick Fuzzer: libFuzzerimagemagickpingmvgfuzzer Fuzz target binary: pingmvgfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: UNKNOWN...

imagemagick/encoder_pdb_fuzzer: Use-of-uninitialized-value in ConstrainColormapIndex

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4631679604883456 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpdbfuzzer Fuzz target binary: encoderpdbfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

dropbear/fuzzer-preauth_nomaths: Use-of-uninitialized-value in wrapfd_select

Project: https://secure.ucc.asn.au/hg/dropbear Detailed report: https://oss-fuzz.com/testcase?key=5112123366572032 Project: dropbear Fuzzer: libFuzzerdropbearfuzzer-preauthnomaths Fuzz target binary: fuzzer-preauthnomaths Job Type: libfuzzermsandropbear Platform Id: linux Crash Type:...

dlplibs/mpfuzzer: Global-buffer-overflow in libwps_tools_win::unicodeFromMacSymbol

Detailed report: https://oss-fuzz.com/testcase?key=5162371531145216 Project: dlplibs Fuzzer: libFuzzerdlplibsmpfuzzer Fuzz target binary: mpfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000000a8e9dc Crash State:...

Chrome V8 JIT Optmization Bug Exploit

Chrome V8 JIT suffers from a simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement optimization bug. Chrome: V8: JIT: Simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement optimization bug I think this commit has introduced the bugs:...

Chrome V8 JIT JSBuiltinReducer::ReduceObjectCreate NULL Check Fail Exploit

Exploit for multiple platform in category dos / poc Chrome: V8: JIT: JSBuiltinReducer::ReduceObjectCreate fails to ensure that the prototype is "null" I think this commit has introduced the bug. https://chromium.googlesource.com/v8/v8/+/ff7063c7d5d8ad8eafcce3da59e65d7fe2b4f915%5E%21/F2 According ...

Welcome to the Cyber-Regulatory Market of 2018 and Beyond

In the past few years, we’ve seen an increase in the number of companies facing legal consequences for ineffectively meeting deadlines requiring them to measure the effectiveness of their security solutions. Combined with these deadlines, companies also have to prove they have awareness and contr...

Chrome V8 JIT JSBuiltinReducer::ReduceObjectCreate NULL Check Fail

Chrome: V8: JIT: JSBuiltinReducer::ReduceObjectCreate fails to ensure that the prototype is "null" I think this commit has introduced the bug. https://chromium.googlesource.com/v8/v8/+/ff7063c7d5d8ad8eafcce3da59e65d7fe2b4f915%5E%21/F2 According to the description, Object.create is supposed to be...

Chrome V8 Out-Of-Bounds Read

Chrome: V8: Empty BytecodeJumpTable may lead to OOB read In the current implementation, the bytecode generator also emits empty jump tables. https://cs.chromium.org/chromium/src/v8/src/interpreter/bytecode-array-writer.cc?rcl=111e990462823c9faeee06b67c0dcf05749d4da8&l=89 So the bytecode for the...

Chrome V8 JIT Optmization Bug

Chrome: V8: JIT: Simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement optimization bug I think this commit has introduced the bugs: https://chromium.googlesource.com/v8/v8/+/c22ca7f73ba92f22d0cd29b06bb2944a545a8d3e%5E%21/F0 Here's a snippet. case IrOpcode::kStoreField: FieldAccess...

Chrome V8 JIT GetSpecializationContext Type Confusion

Chrome: V8: JIT: Type confusion in GetSpecializationContext PoC: function optarg = = arg let tmp = opt.x; // LdaNamedProperty for ;; arg; yield; function inner tmp; break; for let i = 0; i arg; this; , opt let tmp = arg.x; for ;; arg; yield; tmp = inner tmp; ; for let i = 0; i 10000; i++ opt; Wha...

chakra: Crash in Js::JavascriptOperators::GetAndAssertIsConstructorSuperCall

Detailed report: https://oss-fuzz.com/testcase?key=6448634108313600 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f0a0000000c Crash State: Js::JavascriptOperators::GetAndAssertIsConstructorSuperCall...

gdal/envi_fuzzer: Heap-buffer-overflow in ENVIDataset::ReadHeader

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5710112736935936 Project: gdal Fuzzer: libFuzzergdalenvifuzzer Fuzz target binary: envifuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

gdal/ehdr_fuzzer: Heap-buffer-overflow in EHdrRasterBand::IReadBlock

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6240695363829760 Project: gdal Fuzzer: libFuzzergdalehdrfuzzer Fuzz target binary: ehdrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

libreoffice/pptfuzzer: Bad-cast to SdrObjectSvxMSDffManager::SolveSolver in SdrPowerPointImport::ImportPage

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6233996204703744 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...