Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98 and Firefox ESR 91.7. Some of these bugs showed evidence of...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value in grk::N_SCALAR::DecompressIrrev::vtrans

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=5141855240585216 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...

PT-2022-36927

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 8 crash occurred, as reported by OSS-Fuzz. The crash involves the lwan h2 huffman decode for fuzzing function, which is related...

Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98 and Firefox ESR 91.7. Some of these bugs showed evidence of...

libvips:sharpen_fuzzer: Crash in [heap]

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5754724558700544 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: sharpenfuzzer Job Type: libfuzzerubsanlibvips Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000544a480 Crash...

libvips:thumbnail_fuzzer: Heap-use-after-free in start_pass_phuff_decoder

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=4689569129299968 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: thumbnailfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address:...

php:php-fuzz-execute: Crash in zend_hash_find

Detailed Report: https://oss-fuzz.com/testcase?key=6066390068494336 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-execute Job Type: libfuzzerasani386php Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x07615816 Crash State: zendhashfind zendhashcompare zendcompare...

libraw:libraw_fuzzer: Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=6226494360256512 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawfuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

heap buffer overflow in get_one_sourceline

Description When fuzzing vim commit 471b3aed3 I discovered a heap buffer overflow. I'm using ubuntu 20.04 with clang 13 Proof of Concept Here is the minimized poc bash norm300gr0 so How to build bash LD=lld AS=llvm-as AR=llvm-ar RANLIB=llvm-ranlib CC=clang CXX=clang++ CFLAGS="-fsanitize=address"...

fastjson2:JsonFuzzer: Uncaught exception in com.alibaba.fastjson.JSONPath.getPropertyValue

Detailed Report: https://oss-fuzz.com/testcase?key=6554221698220032 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: com.alibaba.fastjson.JSONPath.getPropertyValue...

use after free in mrb_vm_exec

While fuzzing mruby I found a use after free in mruby compiled with ASAn. Proof of Concept uaf5.rb rb...

libreoffice:hwpfuzzer: Global-buffer-overflow in DateCode::GetString

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5268453310726144 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: hwpfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Global-buffer-overflow READ 3 Crash...

User after free in mrb_vm_exec

While fuzzing mruby I found a use after free in mruby compiled with ASAn. Proof of Concept uaf1.rb rb var1 = -0 var2 = 1.0 var3 = 1 var4 = +0 var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby || var3 = methods.groupby ||...

suricata:fuzz_predefpcap_aware: Crash in HTPFileCloseHandleRange

Project: https://github.com/OISF/suricata.git Detailed Report: https://oss-fuzz.com/testcase?key=6513589428551680 Project: suricata Fuzzing Engine: libFuzzer Fuzz Target: fuzzpredefpcapaware Job Type: libfuzzerubsansuricata Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x010100000021...

fluent-bit:flb-it-fuzz-multiline_fuzzer_OSSFUZZ: Index-out-of-bounds in test_multiline_parser

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5039754892148736 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-multilinefuzzerOSSFUZZ Job Type: libfuzzerubsanfluent-bit Platform Id: linux Crash Type: Index-out-of-bounds...

fluent-bit:flb-it-fuzz-engine_fuzzer_OSSFUZZ: Heap-double-free in flb_pack_state_reset

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=6288472741117952 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-enginefuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type: Heap-double-free Crash...

fluent-bit:flb-it-fuzz-parser_fuzzer_OSSFUZZ: Crash in flb_sds_copy

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=4780794801946624 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-parserfuzzerOSSFUZZ Job Type: libfuzzerubsanfluent-bit Platform Id: linux Crash Type: UNKNOWN READ Crash...

fluent-bit:flb-it-fuzz-config_random_fuzzer_OSSFUZZ: Heap-double-free in read_config

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5891863347855360 Project: fluent-bit Fuzzing Engine: afl Fuzz Target: flb-it-fuzz-configrandomfuzzerOSSFUZZ Job Type: aflasanfluent-bit Platform Id: linux Crash Type: Heap-double-free Crash Addres...

fastjson2:JsonFuzzer: Uncaught exception in com.alibaba.fastjson.JSONPath.getPropertyValue

Detailed Report: https://oss-fuzz.com/testcase?key=6046886602080256 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: com.alibaba.fastjson.JSONPath.getPropertyValue...

openh264:decoder_fuzzer: Index-out-of-bounds in WelsDec::WelsInitRefList

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5744443444035584 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzerubsanopenh264 Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...