OESA-2021-1304 openvswitch security update

Open vSwitch is a production quality, multilayer virtual switch licensed under the open source Apache 2.0 license. Security Fixes: Open vSwitch aka openvswitch 2.11.0 through 2.15.0 has a use-after-free in decodeNXASTRAWENCAP called from ofpactdecode and ofpactsdecode during the decoding of a...

PT-2021-5754

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.4 Description The issue is related to the adts decode extradata function in the libavformat/adtsenc.c component of the FFmpeg library. It does not check the return value of init get bits, which can be crafted by an attacker...

simd:simd_load_fuzzer: Heap-use-after-free in Simd::Base::jpeg__jpeg_decode_block

Detailed Report: https://oss-fuzz.com/testcase?key=5306550322331648 Project: simd Fuzzing Engine: afl Fuzz Target: simdloadfuzzer Job Type: aflasansimd Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x62900011324f Crash State: Simd::Base::jpegjpegdecodeblock...

serenity:FuzzJPGLoader: Bad-cast to AK::Array<AK::TypeErasedParameter, 0>Gfx::read_start_of_scan in Gfx::decode_jpg

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5187720287748096 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJPGLoader Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffe49a3fba8 Cra...

PT-2021-27672

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of "Use-of-uninitialized-value" as reported by OSS-Fuzz. The crash occurs in the fuzz json decode encode.cc file,...

open62541:fuzz_json_decode_encode: Use-of-uninitialized-value in fuzz_json_decode_encode.cc

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6699708436316160 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsondecodeencode Job Type: libfuzzermsanopen62541 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

Industrial Light And Magic（lim） OpenEXR 输入验证错误漏洞

Industrial Light And Magic lim OpenEXR is an image file format for high dynamic range HDR images from Industrial Light and Magic LIM Industrial Light And Magic lim, USA. A security vulnerability exists in OpenEXR version 0.9.5, which stems from an integer overflow override in...

DEBIAN-CVE-2021-3246

A heap buffer overflow vulnerability in msadpcmdecodeblock of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file...

DEBIAN-CVE-2020-36430

libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decodechars called from decodefont and processtext because the wrong integer data type is used for subtraction...

PT-2021-6688 · Libass +2 · Libsass +2

Name of the Vulnerable Software and Affected Versions: libass versions 0.15.x through 0.15.0 Description: The issue is related to the decode chars function of the libass subtitle renderer, which is used for ASS/SSA formats. It involves the use of an incorrect integer data type for subtraction,...

OESA-2021-1266 djvulibre security update

DjVu is a set of compression technologies, a file format, and a software platform for the deliveryover the Web of digital documents, scanned documents, and high resolution images.DjVu documents download and display extremely quickly, and look exactly the same on all platforms with no compatibilit...

CVE-2020-23707

A heap-based buffer overflow vulnerability in the function okjpgdecodeblockprogressive at okjpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service DOS via a crafted jpeg file...

PT-2021-10931

Name of the Vulnerable Software and Affected Versions ok-file-formats through 2020-06-26 Description A heap-based buffer overflow issue in the ok jpg decode block subsequent scan function allows attackers to cause a Denial of Service DOS via a crafted jpeg file. The issue is related to the ok jpg...

PT-2021-10932 · Unknown · Ok-File-Formats

Name of the Vulnerable Software and Affected Versions: ok-file-formats through 2020-06-26 Description: A heap-based buffer overflow issue in the ok jpg decode block progressive function at ok jpg.c:1054 allows attackers to cause a Denial of Service DOS via a crafted jpeg file. Recommendations: Fo...

PT-2021-28353

Name of the Vulnerable Software and Affected Versions: GFWX affected versions not specified Description: The issue is related to a dynamic stack buffer overflow, which can cause a crash. The crash occurs in the decode function of the GFWX class, specifically when decoding short values. The...

PT-2021-28350

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash occurred due to an unknown read issue, as reported by OSS-Fuzz. The crash involves the generate inter prediction samples function within the mc...

DJVU::DjVuTXT::decode() Heap Buffer Overflow DoS

The vulnerability of the DJVU::DjVuTXT::decode function in libraries and utilities for viewing, creating, and editing DjVu files is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using a special...

JWTweak - Detects The Algorithm Of Input JWT Token And Provide Options To Generate The New JWT Token Based On The User Selected Algorithm

With the global increase in JSON Web Token JWT usage, the attack surface has also increased significantly. Having said that, this utility is designed with the aim to generate the new JWT token with little or no time which would help security enthusiasts to find security flaws in JWT implementatio...

opus:opus_decode_fuzzer_floating: Dynamic-stack-buffer-overflow in decode_split

Project: https://gitlab.xiph.org/xiph/opus.git Detailed Report: https://oss-fuzz.com/testcase?key=4749540455481344 Project: opus Fuzzing Engine: afl Fuzz Target: opusdecodefuzzerfloating Job Type: aflasanopus Platform Id: linux Crash Type: Dynamic-stack-buffer-overflow WRITE 2 Crash Address:...

opus:opus_multi_fuzzer_floating: Dynamic-stack-buffer-overflow in deemphasis

Project: https://gitlab.xiph.org/xiph/opus.git Detailed Report: https://oss-fuzz.com/testcase?key=5364310208544768 Project: opus Fuzzing Engine: afl Fuzz Target: opusmultifuzzerfloating Job Type: aflasanopus Platform Id: linux Crash Type: Dynamic-stack-buffer-overflow WRITE 4 Crash Address:...