libreoffice: Global-buffer-overflow in ImplUnicodeToDBCS

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4560618956783616 Project: libreoffice Fuzzer: libFuzzerlibreofficewmffuzzer Fuzz target binary: wmffuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

gdal: Stack-buffer-overflow in CSLAddNameValue

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4969921421246464 Project: gdal Fuzzer: libFuzzergdalmrffuzzer Fuzz target binary: mrffuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address:...

gdal: Bad-cast to SDTSAttrReader from SDTSLineReader;OGRSDTSLayer::OGRSDTSLayer;OGRSDTSDataSource::Open

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5383072822329344 Project: gdal Fuzzer: libFuzzergdalogrsdtsfuzzer Fuzz target binary: ogrsdtsfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000087452a0 Cras...

llvm_libcxxabi: Use-of-uninitialized-value in __cxxabiv1::parse_nested_name

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=4792369528438784 Project: llvmlibcxxabi Fuzzer: libFuzzerllvmlibcxxabicxademanglefuzzer Fuzz target binary: cxademanglefuzzer Job Type: libfuzzermsanllvmlibcxxabi Platform Id: linux Crash Type:...

WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS

WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object's prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called...

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit...

WebKit JSC Incorrect Scope Register Handling

WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry CVE-2017-7018 Here's a snippet of DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry. void flushInlineStackEntry inlineStackEntry ... if mgraph.needsScopeRegister...

WebKit JSC JSArray::appendMemcpy Uninitialized Memory Copy Vulnerability

WebKit suffers from a JSC JSArray::appendMemcpy uninitialized memory copy vulnerability. WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy CVE-2017-7064 WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool...

WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference

WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...

WebKit JSC JSArray::appendMemcpy Uninitialized Memory Copy

WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy CVE-2017-7064 WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool JSArray::appendMemcpyExecState exec, VM& vm, unsigned startIndex, JSC::JSArray otherArray auto scope =...

boringssl: Incorrect-function-pointer-type in bssl::ext_npn_parse_serverhello

Project: https://boringssl.googlesource.com/boringssl Detailed report: https://oss-fuzz.com/testcase?key=6121765925289984 Project: boringssl Fuzzer: libFuzzerboringsslclient Fuzz target binary: client Job Type: libfuzzerubsanboringssl Platform Id: linux Crash Type: Incorrect-function-pointer-type...

gdal: Heap-buffer-overflow in putcontig8bitYCbCr42tile

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6163325639458816 Project: gdal Fuzzer: aflgdalgtiffmmap Fuzz target binary: gtiffmmap Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6110000004cb Crash...

gdal: Heap-buffer-overflow in CADBuffer::ReadCHAR

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6298144394444800 Project: gdal Fuzzer: aflgdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62700000350e Crash...

gdal: Stack-use-after-return in void SwapEndianness<long&, unsigned long>

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4542983628128256 Project: gdal Fuzzer: libFuzzergdalcadfuzzer Fuzz target binary: cadfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Stack-use-after-return READ 1 Crash Address:...

gnutls: Use-of-uninitialized-value in mpn_normalized_size

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5967681322745856 Project: gnutls Fuzzer: libFuzzergnutlsserverfuzzer Fuzz target binary: gnutlsserverfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

libpsl: Stack-buffer-overflow in _psl_idna_toASCII

Project: https://github.com/rockdaboot/libpsl.git Detailed report: https://oss-fuzz.com/testcase?key=5165632150568960 Project: libpsl Fuzzer: libFuzzerlibpsliculoadfuzzer Fuzz target binary: libpsliculoadfuzzer Job Type: libfuzzerasanlibpsl Platform Id: linux Crash Type: Stack-buffer-overflow REA...

postgis: Heap-buffer-overflow in ptarray_from_wkb_state

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed report: https://oss-fuzz.com/testcase?key=6439724333924352 Project: postgis Fuzzer: libFuzzerpostgiswkbimportfuzzer Fuzz target binary: wkbimportfuzzer Job Type: libfuzzerasanpostgis Platform Id: linux Crash Type:...

gdal: Heap-buffer-overflow in NITFRasterBand::IReadBlock

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5463142119243776 Project: gdal Fuzzer: libFuzzergdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x603000084656 Crash State:...

gdal: Heap-buffer-overflow in GTiffDataset::IsBlockAvailable

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5368481509801984 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Fuzz target binary: gdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash...

gdal: Heap-buffer-overflow in GTiffDataset::IsBlockAvailable

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4688815685894144 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60300000d8b8 Crash State:...