OSV-2020-63 UNKNOWN READ in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20697 Crash type: UNKNOWN READ Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow...

Buffer overflow

Buffer over-write may occur during fetching track decoder specific information if cb size exceeds buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in...

CVE-2020-3663

Buffer over-write may occur during fetching track decoder specific information if cb size exceeds buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in...

CVE-2021-3510

Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions = 1.14.0, = 2.5.0 contain Attempt to Access Child of a Non-structure Pointer CWE-588. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4...

draco:draco_decoder_fuzzer: Crash in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::c

Project: https://github.com/google/draco.git Detailed Report: https://oss-fuzz.com/testcase?key=5900700302442496 Project: draco Fuzzing Engine: libFuzzer Fuzz Target: dracodecoderfuzzer Job Type: libfuzzerubsandraco Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00007e000000 Crash...

SGN - Encoder Ported Into Go With Several Improvements

SGN is a polymorphic binary encoder for offensive security purposes such as generating statically undetecable binary payloads. It uses a additive feedback loop to encode given binary instructions similar to LSFR. This project is the reimplementation of the original Shikata ga nai in golang with...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

DEBIAN-CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

Design/Logic Flaw

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

UBUNTU-CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

CVE-2020-14040 affects golang.org/x/text/encoding/unicode and golang.org/x/text/transform in the x/text package for Go, with a vulnerability in encoding/unicode that can cause the UTF-16 decoder to enter an infinite loop, potentially crashing or exhausting memory when a single byte is supplied to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...

CVE-2020-11043

In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfxprocessmessagetileset. Invalid data fed to RFX decoder results in garbage on screen as colors. This has been patched in 2.1.0. Mitigation To mitigate this flaw, do not use /rfx, /gfx or /network:auto command line options...

Denial Of Service (DoS)

github.com/golang/text is vulnerable to denial of service DoS. The attack is possible because it does not properly handle the single-byte UTF-16 inputs passing to a UTF-16 decoder, causing an infinite loop if the return value from transformer is ErrShortSrc with atEOF true...

Loop with Unreachable Exit Condition (Infinite Loop)

The x/text package for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an...

PT-2020-13859 · Go +6 · X/Text +6

Name of the Vulnerable Software and Affected Versions: x/text package versions prior to 0.3.3 Description: The issue is related to the UTF-16 decoder in the encoding/unicode component, which could enter an infinite loop if a single byte is provided to a UTF16 decoder instantiated with UseBOM or...

draco:draco_decoder_fuzzer: Crash in std::__1::_MetaBase<__can_be_converted_to_string_view<char, std::__1::char_trait

Project: https://github.com/google/draco.git Detailed Report: https://oss-fuzz.com/testcase?key=5750127758409728 Project: draco Fuzzing Engine: libFuzzer Fuzz Target: dracodecoderfuzzer Job Type: libfuzzerubsandraco Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000002242 Crash...