OSV-2021-1585 Heap-buffer-overflow in _parse_to

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41073 Crash type: Heap-buffer-overflow READ 1 Crash state: parseto parseto gethdrfield...

OSV-2021-1580 Heap-buffer-overflow in H5G__node_found

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41011 Crash type: Heap-buffer-overflow READ 15 Crash state: H5Gnodefound H5Bfind H5Gstablookup...

OSV-2021-1577 Heap-buffer-overflow in apreq_header_attribute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40985 Crash type: Heap-buffer-overflow READ 1 Crash state: apreqheaderattribute createmultipartcontext apreqparsemultipart...

OSV-2021-1575 Heap-buffer-overflow in bfd_getl16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40967 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetl16 parsemodule bfdvmsfindnearestline...

OSV-2021-1570 Heap-buffer-overflow in bfd_putl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40919 Crash type: Heap-buffer-overflow WRITE 1 Crash state: bfdputl32 bpfelfgenericreloc bfdperformrelocation...

OSV-2021-1568 Heap-use-after-free in MqttDecode_Props

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40904 Crash type: Heap-use-after-free READ 1 Crash state: MqttDecodeProps MqttDecodeDisconnect MqttClientDecodePacket...

OSV-2021-1565 Memcpy-param-overlap in parquet::DeltaByteArrayDecoder::GetInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40902 Crash type: Memcpy-param-overlap Crash state: parquet::DeltaByteArrayDecoder::GetInternal parquet::DeltaByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2021-1564 Heap-buffer-overflow in bfd_getl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40908 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetl32 bfdmipselfsectionfromshdr bfdsectionfromshdr...

OSV-2021-1563 Global-buffer-overflow in xstrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40915 Crash type: Global-buffer-overflow READ 1 Crash state: xstrdup scanfilteredsymbols scanallsymbols...

OSV-2021-1562 Heap-buffer-overflow in __bpf_object__open

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40868 Crash type: Heap-buffer-overflow WRITE 4 Crash state: bpfobjectopen bpfobjectopenmem bpf-object-fuzzer.c...

CVE-2021-3941

In ImfChromaticities.cpp routine RGBtoXYZ, there are some division operations such as float Z = 1 - chroma.white.x - chroma.white.y Y / chroma.white.y; and chroma.green.y X + Z / d; but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition whi...

OSV-2021-1554 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40797 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-1553 Segv on unknown address in bfd_getl16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40809 Crash type: Segv on unknown address Crash state: bfdgetl16 bfdmipselfrelocunshuffle bfdmipself32gprel16reloc...

OSV-2021-1549 Uncaught exception in com.google.gson.internal.bind.TypeAdapters$27.read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40830 Crash type: Uncaught exception Crash state: com.google.gson.internal.bind.TypeAdapters$27.read java.base/java.lang.StringUTF16.compress java.base/java.lang.String...

OSV-2021-1546 Heap-buffer-overflow in pn_buffer_append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40748 Crash type: Heap-buffer-overflow READ Crash state: pnbufferappend pnidatainternnode pnidecoderdecodevalue...

OSV-2021-1540 Heap-buffer-overflow in consume_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40723 Crash type: Heap-buffer-overflow READ 1 Crash state: consumelist pnamqpdecodeDqEoQBIoIe pnmessagedecode...

OSV-2021-1526 Global-buffer-overflow in fr_unix_time_from_tm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40600 Crash type: Global-buffer-overflow READ 2 Crash state: frunixtimefromtm frunixtimefromstr frvalueboxfromsubstr...

OSV-2021-1521 Heap-buffer-overflow in exif_data_load_data_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40617 Crash type: Heap-buffer-overflow READ 4 Crash state: exifdataloaddatacontent exifdataloaddata exifloadergetdata...

OSV-2021-1515 Heap-use-after-free in std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<std::__1::basic_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40507 Crash type: Heap-use-after-free READ 1 Crash state: std::1::pairstd::1::treeiteratorstd::1::valuetypestd::1::basic dd::Propertiesimpl::set dd::eatpairs...

OSV-2021-1514 Container-overflow in m3d_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40535 Crash type: Container-overflow READ 1 Crash state: m3dload Assimp::M3DWrapper::M3DWrapper Assimp::M3DImporter::InternReadFile...