wireshark: Heap-buffer-overflow in bootp_option

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=5638972833267712 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkudpport-bootp Fuzz target binary: fuzzsharkudpport-bootp Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type:...

libreoffice: Global-buffer-overflow in SwWW8ImplReader::ReadCaptionBox

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5802161055203328 Project: libreoffice Fuzzer: libFuzzerlibreofficeww2fuzzer Fuzz target binary: ww2fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

wireshark: Heap-buffer-overflow in bootp_option

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=6216983760601088 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkudpport-bootp Fuzz target binary: fuzzsharkudpport-bootp Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type:...

wireshark: Heap-buffer-overflow in print_address_prefix_buf

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=6147014918144000 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkdissectorip Fuzz target binary: fuzzsharkdissectorip Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type:...

VirtualBox Unprivilege Host User To Host Kernel Privilege Escalation

VirtualBox: unprivileged host user - host kernel privesc via ALSA config CVE-2017-3576 This is another way to escalate from an unprivileged userspace process into the VirtualBox process, which has an open file descriptor to the privileged device /dev/vboxdrv and can use that to compromise the hos...

dlplibs: Container-overflow in libvisio::VSDContentCollector::_generateBezierSegmentsFromNURBS

Detailed report: https://oss-fuzz.com/testcase?key=5890037898018816 Project: dlplibs Fuzzer: libFuzzerdlplibsvsdfuzzer Fuzz target binary: vsdfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Container-overflow READ 8 Crash Address: 0x6060000009b0 Crash State:...

grpc: Heap-use-after-free in gpr_unref

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=6462055064272896 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address:...

dlplibs: Global-buffer-overflow in StarEncoding::read

Detailed report: https://oss-fuzz.com/testcase?key=6608338966020096 Project: dlplibs Fuzzer: libFuzzerdlplibssdwfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000000a9d1dc Crash State: StarEncoding::read StarEncoding::convert...

dlplibs: Global-buffer-overflow in computeBMPDataOffset

Detailed report: https://oss-fuzz.com/testcase?key=5669948070297600 Project: dlplibs Fuzzer: libFuzzerdlplibsvsdfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x00000096a278 Crash State: computeBMPDataOffset...

file: Heap-buffer-overflow in cdf_getuint32

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=4879865188712448 Project: file Fuzzer: aflfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: aflasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x611000000280 Cra...

libxml2: Use-of-uninitialized-value in xmlNextChar

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=5437541593382912 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

WebKit constructJSReadableStreamDefaultReader Type Confusion

WebKit: Type confusion in constructJSReadableStreamDefaultReader CVE-2017-2457 EncodedJSValue JSCHOSTCALL constructJSReadableStreamDefaultReaderExecState& exec VM& vm = exec.vm; auto scope = DECLARETHROWSCOPEvm; JSReadableStream stream = jsDynamicDowncastexec.argument0; if !stream return...

Apple WebKit Frame::setDocument UXSS

Apple WebKit: UXSS via Frame::setDocument 1. CVE-2017-2364 void Frame::setDocumentRefPtr&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... The function...

Apple WebKit JSCallbackData UXSS

Apple Webkit: UXSS with JSCallbackData CVE-2017-2442 Here is the definition of |JSCallbackData| class. This class is used to call a javascript function from a DOM object. class JSCallbackDataStrong : public JSCallbackData public: JSCallbackDataStrongJSC::JSObject callback, void :...

WebKit FormSubmission::create Use-After-Free

WebKit: use-after-free in FormSubmission::create CVE-2017-2460 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. Please note: This bug is subject to a 90 day...

libxml2: Use-of-uninitialized-value in xmlParsePI

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=4556488108408832 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

dlplibs: Global-buffer-overflow in StarEncoding::read

Detailed report: https://oss-fuzz.com/testcase?key=6132274431000576 Project: dlplibs Fuzzer: libFuzzerdlplibssdwfuzzer Fuzz target binary: sdwfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000000a4fcdc Crash State:...

libxml2: Use-of-uninitialized-value in xmlCurrentChar

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=6685532522283008 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

file: Heap-buffer-overflow in cdf_file_property_info

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=5417710252982272 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

libxml2: Use-of-uninitialized-value in xmlParseXMLDecl

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=4803617708048384 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...