nghttp2:nghttp2_fuzzer_frames: Use-of-uninitialized-value in lookup_token

Project: https://github.com/nghttp2/nghttp2.git Detailed Report: https://oss-fuzz.com/testcase?key=4582323763871744 Project: nghttp2 Fuzzing Engine: libFuzzer Fuzz Target: nghttp2fuzzerframes Job Type: libfuzzermsannghttp2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Authorization

The MWOAuthDataStore::lookuptoken function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's...