OSV-2023-162 Global-buffer-overflow in xmlCurrentChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56841 Crash type: Global-buffer-overflow READ 1 Crash state: xmlCurrentChar xmlParseNCName xmlParseQName...

GHSA-V829-X6HH-CQFQ Crossplane-runtime contains Improper Input Validation via Compositions

Summary Fuzz testing, by Ada Logics and sponsored by the CNCF, identified a vulnerability in the fieldpath package from crossplane/crossplane-runtime that an already highly privileged Crossplane user able to create or update Compositions could leverage to cause an out of memory panic in Crossplan...

Crossplane-runtime contains Improper Input Validation via Compositions

Summary Fuzz testing, by Ada Logics and sponsored by the CNCF, identified a vulnerability in the fieldpath package from crossplane/crossplane-runtime that an already highly privileged Crossplane user able to create or update Compositions could leverage to cause an out of memory panic in Crossplan...

OSV-2023-160 Global-buffer-overflow in OT::gvar::accelerator_t::apply_deltas_to_points

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56800 Crash type: Global-buffer-overflow READ 2 Crash state: OT::gvar::acceleratort::applydeltastopoints bool OT::glyfimpl::Glyph::getpoints bool OT::glyfimpl::Glyph::getpoints...

OSV-2023-159 UNKNOWN READ in isvce_cabac_flush

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56816 Crash type: UNKNOWN READ Crash state: isvcecabacflush isvcecabacencodeterminate isvceentropy...

OSV-2023-158 Heap-use-after-free in ddsi_type_unref_impl_locked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56837 Crash type: Heap-use-after-free READ 4 Crash state: ddsitypeunrefimpllocked ddsitypeunreflocked ddsixttypefini...

OSV-2023-156 Heap-use-after-free in HashMgr::add_word

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56737 Crash type: Heap-use-after-free READ 2 Crash state: HashMgr::addword HashMgr::loadtables HashMgr::HashMgr...

OSV-2023-153 Heap-use-after-free in ucl_hash_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56716 Crash type: Heap-use-after-free READ 8 Crash state: uclhashfunc khresizeuclhashnode khputuclhashnode...

OSV-2023-152 UNKNOWN READ in dissect_oran_c_section

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56724 Crash type: UNKNOWN READ Crash state: dissectorancsection dissectoran calldissectorwork...

OSV-2023-151 UNKNOWN READ in mrb_vm_find_method

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56687 Crash type: UNKNOWN READ Crash state: mrbvmfindmethod mrbvmexec mrbvmrun...

OSV-2023-137 Heap-buffer-overflow in OT::Layout::Common::Coverage::get_population

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56510 Crash type: Heap-buffer-overflow READ 1 Crash state: OT::Layout::Common::Coverage::getpopulation OT::Layout::GPOSimpl::SinglePosFormat1::sanitize hbsanitizecontextt::returnt OT::Layout::GPOSimpl::PosLookupSubTable::dispa...

OSV-2023-135 Heap-buffer-overflow in json_cquote

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56473 Crash type: Heap-buffer-overflow READ 1 Crash state: jsoncquote dwgjsonLTYPE jsonobjectswrite...

OSV-2023-119 Use-of-uninitialized-value in rename_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56401 Crash type: Use-of-uninitialized-value Crash state: renameprocess safeforkfull parsetimestamp...

OSV-2023-118 Heap-use-after-free in mrb_gc_mark

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56406 Crash type: Heap-use-after-free READ 4 Crash state: mrbgcmark mrbgcmarkiv gcmarkchildren...

OSV-2023-117 Heap-buffer-overflow in isvcd_nal_byte_swap_emulation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56386 Crash type: Heap-buffer-overflow WRITE 4 Crash state: isvcdnalbyteswapemulation isvcdnalparsenonvclnal isvcdpreparserefineau...

OSV-2023-116 Security exception in org.codehaus.janino.Parser.parseUnaryExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56367 Crash type: Security exception Crash state: org.codehaus.janino.Parser.parseUnaryExpression java.base/java.nio.ByteBuffer.limit java.base/java.nio.Buffer...

OSV-2023-106 UNKNOWN WRITE in sudo_lbuf_append_quoted_v1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56278 Crash type: UNKNOWN WRITE Crash state: sudolbufappendquotedv1 sudoersformatmemberint sudoersformatmemberint...

OSV-2023-104 Heap-buffer-overflow in H5FS__sect_link

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56234 Crash type: Heap-buffer-overflow READ 8 Crash state: H5FSsectlink H5FSsectadd H5MFaddsect...

OSV-2023-102 Segv on unknown address in ndpi_free_flow_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56272 Crash type: Segv on unknown address Crash state: ndpifreeflowdata ndpifreeflow fuzzprocesspacket.c...

OSV-2023-101 Heap-use-after-free in pci_enum

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56243 Crash type: Heap-use-after-free READ 4 Crash state: pcienum gptrarrayforeach genericfuzz...