American Fuzzy Lop plus plus security vulnerabilities

American Fuzzy Lop plus plus AFL++ is is an advanced branch of Google's AFL - faster, more and better mutations, more and better instrumentation, custom module support, and more. AFL++ 4.05c contains a security vulnerability that originates in the CmpLog component that uses the current working...

OSV-2023-84 Stack-buffer-overflow in parse_regex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56121 Crash type: Stack-buffer-overflow READ 1 Crash state: parseregex parseregex parseregex...

elfutils:fuzz-libdwfl: Use-of-uninitialized-value in check_section

Detailed Report: https://oss-fuzz.com/testcase?key=6724057145147392 Project: elfutils Fuzzing Engine: libFuzzer Fuzz Target: fuzz-libdwfl Job Type: libfuzzermsanelfutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: checksection dwarfbeginelf loaddw...

OSV-2023-78 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56054 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2023-72 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56057 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParseTracePacketData...

orbit:ElfFileLoadSymbolsFuzzer: Heap-buffer-overflow in checkLinkerOptCommand

Detailed Report: https://oss-fuzz.com/testcase?key=6363674672758784 Project: orbit Fuzzing Engine: libFuzzer Fuzz Target: ElfFileLoadSymbolsFuzzer Job Type: libfuzzerasanorbit Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6040000031bc Crash State: checkLinkerOptComma...

OSV-2023-69 Heap-use-after-free in zend_ast_evaluate_inner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56021 Crash type: Heap-use-after-free READ 4 Crash state: zendastevaluateinner zendastevaluateex zvalupdateconstantwithctx...

OSV-2023-68 Heap-buffer-overflow in isvcd_residual_samp_mb_dyadic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56023 Crash type: Heap-buffer-overflow READ 2 Crash state: isvcdresidualsampmbdyadic isvcdprocessresidualresamplemb isvcdprocessintermbrsdpredtargetlyr...

OSV-2023-67 Heap-use-after-free in config__cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56009 Crash type: Heap-use-after-free READ 8 Crash state: configcleanup mosquittofuzzmain runbroker...

OSV-2023-66 Heap-buffer-overflow in mosquitto__strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56008 Crash type: Heap-buffer-overflow READ Crash state: mosquittostrdup configreadfilecore configreadfile...

binutils:fuzz_objdump_safe: Heap-buffer-overflow in evax_bfd_print_eobj

Detailed Report: https://oss-fuzz.com/testcase?key=4736582684114944 Project: binutils Fuzzing Engine: afl Fuzz Target: fuzzobjdumpsafe Job Type: aflasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x603000008f03 Crash State: evaxbfdprinteobj evaxbfdprintimag...

PT-2023-35941 · Mosquitto · Mosquitto

Name of the Vulnerable Software and Affected Versions: mosquitto affected versions not specified Description: A heap-use-after-free READ 8 crash has been identified. The crash occurs in the config cleanup function, which is called by mosquitto fuzz main and run broker. Recommendations: At the...

imagemagick:encoder_wpg_fuzzer: Use-of-uninitialized-value in WPGAddRLEByte

Detailed Report: https://oss-fuzz.com/testcase?key=6667138896363520 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderwpgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: WPGAddRLEByte WriteWPGImage...

libgit2:download_refs_fuzzer: Heap-buffer-overflow in set_data

Project: https://github.com/libgit2/libgit2.git Detailed Report: https://oss-fuzz.com/testcase?key=5606242883338240 Project: libgit2 Fuzzing Engine: honggfuzz Fuzz Target: downloadrefsfuzzer Job Type: honggfuzzasanlibgit2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

libredwg:llvmfuzz: Crash in dwg_free_object

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5299384381472768 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerubsanlibredwg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000d9c2fdb0 Crash...

hdf5:h5_extended_fuzzer: Heap-buffer-overflow in H5SM_delete

Detailed Report: https://oss-fuzz.com/testcase?key=5248504286281728 Project: hdf5 Fuzzing Engine: afl Fuzz Target: h5extendedfuzzer Job Type: aflasanhdf5 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x605000009240 Crash State: H5SMdelete H5Omsgwritereal H5Omsgwrite...

mosquitto:broker_fuzz_test_config: Heap-use-after-free in config__cleanup

Project: https://github.com/eclipse/mosquitto.git Detailed Report: https://oss-fuzz.com/testcase?key=5007090919014400 Project: mosquitto Fuzzing Engine: libFuzzer Fuzz Target: brokerfuzztestconfig Job Type: libfuzzerasanmosquitto Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

OSV-2023-61 Heap-buffer-overflow in xmlParseTryOrFinish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55980 Crash type: Heap-buffer-overflow READ 1 Crash state: xmlParseTryOrFinish xmlParseChunk xml.c...

OSV-2023-60 Security exception in org.json.JSONTokener.nextValue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55978 Crash type: Security exception Crash state: org.json.JSONTokener.nextValue org.json.JSONTokener.readArray org.json.JSONTokener.nextToInternal...

SUSE CVE-2021-45952

Dnsmasq 2.86 has a heap-based buffer overflow in dhcpreply called from dhcppacket and FuzzDhcp. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge...