harfbuzz:hb-shape-fuzzer: Use-of-uninitialized-value in bool OT::glyf_impl::Glyph::get_points<OT::glyf_accelerator_t>

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5114131137822720 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

OSV-2023-458 Invalid-free in hb_free_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59592 Crash type: Invalid-free Crash state: hbfreeimpl OT::glyf::freecompiledsubsetglyphs OT::glyf::subset...

PT-2023-35859 · Git +1 · Harfbuzz

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Invalid-free. The crash state involves several function calls, including hb free impl, OT::glyf:: free...

harfbuzz:hb-subset-fuzzer: Invalid-free in hb_free_impl

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5855710991482880 Project: harfbuzz Fuzzing Engine: honggfuzz Fuzz Target: hb-subset-fuzzer Job Type: honggfuzzasanharfbuzz Platform Id: linux Crash Type: Invalid-free Crash Address: 0x619000000814...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in OT::glyf_impl::SubsetGlyph::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6521393809588224 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash...

OSV-2023-170 Invalid-free in hb_free_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56952 Crash type: Invalid-free Crash state: hbfreeimpl OT::glyf::freecompiledsubsetglyphs OT::glyf::populatesubsetglyphs...

harfbuzz:hb-subset-fuzzer: Invalid-free in hb_free_impl

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5388270411579392 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Invalid-free Crash Address: 0x621000004f34...

PT-2023-35690 · Git +1 · Harfbuzz

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a global buffer overflow read error. Technical details include a crash state involving the OT::gvar::accelerator t::apply deltas ...

ots:ots-fuzzer: Use-of-uninitialized-value in ots::OpenTypeGLYF::ParseSimpleGlyph

Project: https://github.com/khaledhosny/ots.git Detailed Report: https://oss-fuzz.com/testcase?key=5155272037367808 Project: ots Fuzzing Engine: libFuzzer Fuzz Target: ots-fuzzer Job Type: libfuzzermsanots Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Microsoft Windows Kernel - 'win32k.sys' '.TTF' Font Processing Out-of-Bounds Read with Malformed 'glyf' Table 'win32k!fsc_CalcGrayRow' (Denial of Service)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1274 We have encountered a number of Windows kernel crashes in the win32k.sys driver while processing corrupted TTF font files: --- PAGEFAULTINNONPAGEDAREA 50 Invalid system memory was referenced. This cannot be protected by...

Microsoft Windows Kernel - win32k.sys .TTF Font Processing Out-of-Bounds Read with Malformed glyf Table win32k!fsc_CalcGrayRow (Denial of Service)

Microsoft Windows Kernel - win32k.sys .TTF Font Processing Out-of-Bounds Read with Malformed glyf Table win32k!fscCalcGrayRow Denial of Service Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1274 We have encountered a number of Windows kernel crashes in the win32k.sys driver...

Microsoft Windows - 'win32k.sys' TTF Font Processing win32k!fsc_RemoveDups Out-of-Bounds Pool Memory Access

Source: https://code.google.com/p/google-security-research/issues/detail?id=401&can=1 We have encountered a Windows kernel crash in the win32k!fscRemoveDups function while processing corrupted TTF font files, such as: --- PAGEFAULTINNONPAGEDAREA 50 Invalid system memory was referenced. This canno...

Microsoft Windows - win32k.sys TTF Font Processing win32k!fsc_RemoveDups Out-of-Bounds Pool Memory Access

Microsoft Windows - win32k.sys TTF Font Processing win32k!fscRemoveDups Out-of-Bounds Pool Memory Access Source: https://code.google.com/p/google-security-research/issues/detail?id=401&can=1 We have encountered a Windows kernel crash in the win32k!fscRemoveDups function while processing corrupted...