OSV-2023-328 Heap-buffer-overflow in RegionItem::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58152 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionItem::parse heif::HeifContext::interpretheiffile heif::HeifContext::read...

AZL-26278 CVE-2023-30612 affecting package cloud-hypervisor for versions less than 31.1-1

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily...

CVE-2023-30612 Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily...

OSV-2023-327 Heap-double-free in HashMgr::~HashMgr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58133 Crash type: Heap-double-free Crash state: HashMgr::HashMgr HunspellImpl::HunspellImpl Hunspell::Hunspell...

OSV-2023-326 Heap-use-after-free in dynsec_clients__find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58108 Crash type: Heap-use-after-free READ 8 Crash state: dynsecclientsfind clientfreeitem dynsecclientscleanup...

libvips:jpegsave_file_fuzzer: Heap-buffer-overflow in RegionItem::parse

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=4536474203979776 Project: libvips Fuzzing Engine: afl Fuzz Target: jpegsavefilefuzzer Job Type: aflasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61100000560...

hunspell:affdicfuzzer: Heap-double-free in HashMgr::~HashMgr

Project: https://github.com/hunspell/hunspell.git Detailed Report: https://oss-fuzz.com/testcase?key=6668957611589632 Project: hunspell Fuzzing Engine: libFuzzer Fuzz Target: affdicfuzzer Job Type: libfuzzerasanhunspell Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x6020000000b0...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...

OSV-2023-323 Heap-buffer-overflow in OT::glyf_impl::SubsetGlyph::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58071 Crash type: Heap-buffer-overflow WRITE 2 Crash state: OT::glyfimpl::SubsetGlyph::serialize OT::glyf::subset bool trysubset...

OSV-2023-322 Use-after-poison in str_new_frozen_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58079 Crash type: Use-after-poison READ 8 Crash state: strnewfrozenbuffer fstrupdatecallback rbstupdate...

OSV-2023-321 Heap-use-after-free in ucl_hash_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58069 Crash type: Heap-use-after-free READ 8 Crash state: uclhashfunc khresizeuclhashnode khputuclhashnode...

binutils:fuzz_nm: Heap-buffer-overflow in print_symname

Detailed Report: https://oss-fuzz.com/testcase?key=5121669269422080 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzznm Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x61f000000d48 Crash State: printsymname printsymbolinfobsd...

OSV-2023-319 Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035 Crash type: Heap-buffer-overflow READ 8 Crash state: ZSTDdecompressSequencesLongbmi2 ZSTDdecompressSequencesLong ZSTDdecompressBlockinternal...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in OT::glyf_impl::SubsetGlyph::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6521393809588224 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash...

libucl:ucl_add_string_fuzzer: Heap-use-after-free in ucl_hash_func

Project: https://github.com/vstakhov/libucl.git Detailed Report: https://oss-fuzz.com/testcase?key=6235945317040128 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerasanlibucl Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

wolfssl:cryptofuzz-normal-math: Heap-buffer-overflow in sp_read_unsigned_bin

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4522678383149056 Project: wolfssl Fuzzing Engine: honggfuzz Fuzz Target: cryptofuzz-normal-math Job Type: honggfuzzasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash...

OSV-2023-316 Segv on unknown address in dwg_ref_get_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57981 Crash type: Segv on unknown address Crash state: dwgrefgetobject dwggeojsonfeature dwggeojsonobject...

notary:FuzzVerify: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5978256221536256 Project: notary Fuzzing Engine: libFuzzer Fuzz Target: FuzzVerify Job Type: libfuzzerasannotary Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c00004c000 Crash State: pthreadcreate cgotrypthreadcreate Sanitizer:...