inchi:inchi_input_fuzzer: Heap-buffer-overflow in CtPartFill

Project: https://github.com/IUPAC-InChI/InChI.git Detailed Report: https://oss-fuzz.com/testcase?key=6506027121442816 Project: inchi Fuzzing Engine: libFuzzer Fuzz Target: inchiinputfuzzer Job Type: libfuzzerasaninchi Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

Tuesday, January 21, 2025 Security Releases

Tuesday, January 21, 2025 Security Releases Security releases available Updates are now available for the 23.x, 22.x, 20.x, 18.x Node.js release lines for the following issues. This security release includes the following dependency updates to address public vulnerabilities: undici v7.2.3, v6.21....

libical:libical_fuzzer: Use-of-uninitialized-value in icalmemory_strdup

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=5491272529281024 Project: libical Fuzzing Engine: libFuzzer Fuzz Target: libicalfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

circl:cryptofuzz: Crash in ___interceptor_pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4581096045477888 Project: circl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz Job Type: libfuzzerasancircl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7c4dfaaf5c78 Crash State: interceptorpthreadcreate cgotrypthreadcreate...

tensorflow:stringprintf_fuzz@CC_FUZZING.FuzzTest: Heap-buffer-overflow in FuzzTest

Detailed Report: https://oss-fuzz.com/testcase?key=6145102883389440 Project: tensorflow Fuzzing Engine: libFuzzer Fuzz Target: [email protected] Job Type: libfuzzerasantensorflow Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x604000001f40 Crash State...

CVE-2025-0441

Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0440

Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0441

Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0439

Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0442

Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0443

Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0440

Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0441

An inappropriate implementation in the Fenced Frames privacy feature of Google Chrome prior to version 132.0.6834.83 allows a remote attacker to obtain potentially sensitive information from the system. This vulnerability is triggered via a crafted HTML page , resulting in a Medium security sever...

CVE-2025-0440

Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0442

Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0439

Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0439

A race condition in the Frames component of Google Chrome (prior to version 132.0.6834.83 ) allows a remote attacker to perform UI spoofing . By convincing a user to engage in specific UI gestures while visiting a crafted HTML page , the attacker can bypass security restrictions to spoof the user...

libyal:libewf_handle_fuzzer: Use-of-uninitialized-value in libewf_line_reader_read_data

Detailed Report: https://oss-fuzz.com/testcase?key=6327143511949312 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libewfhandlefuzzer Job Type: libfuzzermsanlibyal Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: libewflinereaderreaddata...

Vim 9.1.1003 (GHSA-5rgf-26wj-48v8)

The version of Vim installed on the remote host is prior to 9.1.1003. It is, therefore, affected by a vulnerability as referenced in the GHSA-5rgf-26wj-48v8 advisory. - When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow...

CVE-2025-22134

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visu...