6544 matches found
Attacker can profitable trade with the pool
Lines of code Vulnerability details Impact The swap invariant used is unstable with large pool reserves locked. An attacker can generate a profit by trading with the pool, hurting Liquidity Providers. Proof of Concept To find some vulernable configurations we fuzzed the swap function of the Prote...
OSV-2023-750 Security exception in org.antlr.v4.runtime.atn.PredictionContext.fromRuleContext
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61786 Crash type: Security exception Crash state: org.antlr.v4.runtime.atn.PredictionContext.fromRuleContext java.base/jdk.internal.misc.Unsafe.weakCompareAndSetInt java.base/jdk.internal.misc.Unsafe.getAndAddInt...
OSV-2023-748 Segv on unknown address in dwg_encode
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61795 Crash type: Segv on unknown address Crash state: dwgencode llvmfuzz.c...
OSV-2023-747 Segv on unknown address in kh_get_ucl_hash_caseless_node
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61794 Crash type: Segv on unknown address Crash state: khgetuclhashcaselessnode uclhashsearch uclincludefilesingle...
OSV-2023-743 Out-of-memory in QueryParserFuzzer
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61742 Crash type: Out-of-memory Crash state: QueryParserFuzzer...
OSV-2023-742 Security exception in org.json.JSONArray.writeTo
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61747 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...
OSV-2023-741 Heap-buffer-overflow in Flow::dissectBittorrent
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61737 Crash type: Heap-buffer-overflow READ 1 Crash state: Flow::dissectBittorrent NetworkInterface::processPacket NetworkInterface::dissectPacket...
OSV-2023-734 Container-overflow in libbrotlidec.so.1
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61675 Crash type: Container-overflow WRITE Crash state: libbrotlidec.so.1 BrotliDecoderDecompressStream Exiv2::BmffImage::brotliUncompress...
OSV-2023-726 Heap-buffer-overflow in Flow::dissectNetBIOS
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61648 Crash type: Heap-buffer-overflow READ 1 Crash state: Flow::dissectNetBIOS NetworkInterface::processPacket NetworkInterface::dissectPacket...
OSV-2023-721 Stack-buffer-overflow in crc24q_check
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61617 Crash type: Stack-buffer-overflow READ 1 Crash state: crc24qcheck packetparse FuzzPacket.c...
OSV-2023-719 Security exception in org.apache.commons.jxpath.ri.compiler.CoreFunction.toString
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61597 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.compiler.CoreFunction.toString java.base/java.lang.String.valueOf java.base/java.lang.StringBuilder.append...
OSV-2023-717 Heap-buffer-overflow in bit_TV_to_utf8_codepage
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61593 Crash type: Heap-buffer-overflow READ 1 Crash state: bitTVtoutf8codepage bitTVtoutf8 dwgdecodeLAYOUTprivate...
OSV-2023-716 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61603 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.core.convert.support.GenericConversionService$ConverterCache...
OSV-2023-715 Stack-use-after-scope in ulocimp_addLikelySubtags_74
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61582 Crash type: Stack-use-after-scope READ 3 Crash state: ulocimpaddLikelySubtags74 ulocisRightToLeft74 ulocisrighttoleftfuzzer.cpp...
OSV-2023-705 Security exception in org.apache.lucene.util.automaton.RegExp.toAutomaton
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61493 Crash type: Security exception Crash state: org.apache.lucene.util.automaton.RegExp.toAutomaton java.base/java.util.BitSet.ensureCapacity java.base/java.util.BitSet.expandTo...
OSV-2023-697 Heap-buffer-overflow in IEC104Stats::processPacket
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61443 Crash type: Heap-buffer-overflow READ 1 Crash state: IEC104Stats::processPacket Flow::processIEC60870Packet NetworkInterface::processPacket...
OSV-2023-696 Security exception in org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61423 Crash type: Security exception Crash state: org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone org.apache.lucene.analysis.tokenattributes.PackedTokenAttributeImpl.clone...
OSV-2023-693 Security exception in org.json.JSONArray.writeTo
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61399 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...