envoy:buffer_fuzz_test: Heap-buffer-overflow in Envoy::Buffer::OwnedImpl::copyOutToSlices

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5473864153432064 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: bufferfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address:...

openexr:openexr_exrcheck_fuzzer: Heap-buffer-overflow in hufDecode

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=4692142948220928 Project: openexr Fuzzing Engine: libFuzzer Fuzz Target: openexrexrcheckfuzzer Job Type: libfuzzerasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflow RE...

Heap-based Buffer Overflow in gpac/gpac

Description When fuzzing gpac with clang 10 I found a heap overflow. Proof of Concept pocgffprintf Crash stack trace aldo@vps:/gpac/bin/gcc$ ASANOPTIONS=symbolize=1 ASANSYMBOLIZERPATH=/usr/bin/llvm-symbolizer ./MP4Box -disox -ttxt -2 -dump-chap-ogg -dump-cover -drtp -bt -out /dev/null...

imagemagick:encoder_label_fuzzer: Heap-buffer-overflow in GetFunction

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5650684790308864 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderlabelfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4...

testing-native-go-fuzzing:normalizer_fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5571437979631616 Project: testing-native-go-fuzzing Fuzzing Engine: libFuzzer Fuzz Target: normalizerfuzzer Job Type: libfuzzerasantesting-native-go-fuzzing Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL...

clamav:clamav_dbload_LDB_fuzzer: Heap-buffer-overflow in cli_ac_addsig

Detailed Report: https://oss-fuzz.com/testcase?key=5427764210040832 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavdbloadLDBfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x603000000682 Crash State: cliacaddsig cliparseadd...

clamav:clamav_dbload_CRB_fuzzer: Index-out-of-bounds in fp_mul_2d

Detailed Report: https://oss-fuzz.com/testcase?key=6269128405549056 Project: clamav Fuzzing Engine: libFuzzer Fuzz Target: clamavdbloadCRBfuzzer Job Type: libfuzzerubsanclamav Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: fpmul2d fpreadunsignedbin cliloadcrt...

go-coredns:fuzz_plugin_forward: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6020075566530560 Project: go-coredns Fuzzing Engine: libFuzzer Fuzz Target: fuzzpluginforward Job Type: libfuzzerasango-coredns Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000061e6a161 Crash State: NULL Sanitizer: address ASAN...

Zooming in on Zero-click Exploits

Posted by Natalie Silvanovich, Project Zero Zoom is a video conferencing platform that has gained popularity throughout the pandemic. Unlike other video conferencing systems that I have investigated, where one user initiates a call that other users must immediately accept or reject, Zoom calls ar...

What is fuzz testing? What is it used to test for?

Fuzz testing, regularly known as fuzzing, is a product testing procedure that incorporates embedding flawed or arbitrary information FUZZ into a product framework to recognize coding issues and security issues. Fuzz testing involves infusing information into a framework utilizing robotized or...

gdal:gdal_fuzzer: Container-overflow in std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5988013182681088 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gdalfuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Container-overflow READ Crash Address: 0x6080000055e8 Crash...

stb:stbi_read_fuzzer: Global-buffer-overflow in stbi__jpeg_huff_decode

Detailed Report: https://oss-fuzz.com/testcase?key=6344671293472768 Project: stb Fuzzing Engine: afl Fuzz Target: stbireadfuzzer Job Type: aflasanstb Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x0000005426fc Crash State: stbijpeghuffdecode stbijpegdecodeblock...

teleport:parse_fuzz: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5300877605339136 Project: teleport Fuzzing Engine: libFuzzer Fuzz Target: parsefuzz Job Type: libfuzzerasanteleport Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

lcms:cms_overwrite_transform_fuzzer: Index-out-of-bounds in cmsReadTag

Project: https://github.com/mm2/Little-CMS.git Detailed Report: https://oss-fuzz.com/testcase?key=4652838645530624 Project: lcms Fuzzing Engine: libFuzzer Fuzz Target: cmsoverwritetransformfuzzer Job Type: libfuzzerubsanlcms Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

md4c:fuzz-mdhtml: Crash in md_build_attribute

Project: https://github.com/mity/md4c.git Detailed Report: https://oss-fuzz.com/testcase?key=4802461515251712 Project: md4c Fuzzing Engine: libFuzzer Fuzz Target: fuzz-mdhtml Job Type: libfuzzerasanmd4c Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0001dfff8001 Crash State:...

tcmalloc:profile_builder_fuzz: Heap-buffer-overflow in void absl::BytesToHexStringInternal<std::__1::basic_string<char, std::__1::char_

Project: https://github.com/google/tcmalloc.git Detailed Report: https://oss-fuzz.com/testcase?key=5257871728705536 Project: tcmalloc Fuzzing Engine: afl Fuzz Target: profilebuilderfuzz Job Type: aflasantcmalloc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value in grk::N_SCALAR::DecompressIrrev::vtrans

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4525486825406464 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...

libssh2:ssh2_client_fuzzer: Null-dereference READ in ubsan_GetStackTrace

Project: https://github.com/cmeister2/libssh2.git https://github.com/libssh2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5104008459583488 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerubsanlibssh2 Platform Id: linux Crash Type:...

Infinite Loop in Apache James

In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user nee...

etcd:fuzz_kv_proxy: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4525041667145728 Project: etcd Fuzzing Engine: libFuzzer Fuzz Target: fuzzkvproxy Job Type: libfuzzerasanetcd Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00001dcf216a Crash State: NULL Sanitizer: address ASAN Recommended Security...