OSV-2023-443 Use-after-poison in file_is_simh

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59438 Crash type: Use-after-poison READ 4 Crash state: fileissimh filebuffer magicbuffer...

OSV-2023-440 Heap-double-free in dwg_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59428 Crash type: Heap-double-free Crash state: dwgfreeobject dwgfree llvmfuzz.c...

PT-2023-35851 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-double-free crash. The crash occurs in the dwg free object and dwg free functions, as indicated by the crash state. This...

OSV-2023-437 Heap-buffer-overflow in internal_huf_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59382 Crash type: Heap-buffer-overflow READ 1 Crash state: internalhufdecompress DwaCompressoruncompress internalexrundodwaa...

OSV-2023-436 Heap-buffer-overflow in ndpi_check_punycode_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59393 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpicheckpunycodestring ndpimatchhostsubprotocol checkcontenttypeandchangeprotocol...

OSV-2022-1275 Security exception in java.desktop/java.awt.image.DataBufferInt.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59354 Crash type: Security exception Crash state: java.desktop/java.awt.image.DataBufferInt. java.desktop/java.awt.image.Raster.createPackedRaster java.desktop/java.awt.image.DirectColorModel.createCompatibleWritableRaster...

OpenEXR -- heap buffer overflow in internal_huf_decompress

oss-fuzz reports: heap buffer overflow in internalhufdecompress. Cary Phillips reports: v3.1.9 - Patch release that addresses ... also OSS-fuzz 59382 Heap-buffer-overflow in internalhufdecompress Kimball Thurston reports: Fix scenario where malformed dwa file could read past end of buffer - fixes...

malformed proposed intoto entries can cause a panic

Impact A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. Patches This is fixed in v1.2.0 of...

GHSA-FRQX-JFCM-6JJR malformed proposed intoto entries can cause a panic

Impact A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. Patches This is fixed in v1.2.0 of...

OSV-2023-426 Heap-buffer-overflow in libdeflate_zlib_decompress_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59267 Crash type: Heap-buffer-overflow READ 2 Crash state: libdeflatezlibdecompressex exruncompressbuffer DwaCompressoruncompress...

OSV-2023-425 Heap-buffer-overflow in ICMPinfo::dissectICMP

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59217 Crash type: Heap-buffer-overflow READ 1 Crash state: ICMPinfo::dissectICMP NetworkInterface::processPacket NetworkInterface::dissectPacket...

OSV-2023-423 Heap-buffer-overflow in NetworkInterface::dissectPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59216 Crash type: Heap-buffer-overflow READ 4 Crash state: NetworkInterface::dissectPacket fuzzdissectpacket.cpp...

OSV-2023-422 Heap-use-after-free in wmem_memdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59167 Crash type: Heap-use-after-free READ 6 Crash state: wmemmemdup copyaddress fragmentaddressespersistentkey...

OSV-2023-418 Heap-buffer-overflow in bfd_getl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59148 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetl32 bfdstabsectionfindnearestline cofffindnearestlinewithnames...

OSV-2023-416 UNKNOWN READ in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59118 Crash type: UNKNOWN READ Crash state: dxffixupstring dwgdxfDIMENSIONALIGNEDprivate dwgdxfDIMENSIONALIGNED...

OSV-2023-415 UNKNOWN READ in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59097 Crash type: UNKNOWN READ Crash state: dxffixupstring dwgdxfLAYOUTprivate dwgdxfLAYOUT...

OSV-2023-409 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59072 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2023-407 Stack-buffer-overflow in DwaCompressor_readChannelRules

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59070 Crash type: Stack-buffer-overflow READ Crash state: DwaCompressorreadChannelRules DwaCompressoruncompress internalexrundodwaa...

OSV-2023-408 Security exception in org.apache.lucene.util.ArrayUtil.growExact

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59071 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.growExact org.apache.lucene.util.ArrayUtil.grow org.apache.lucene.util.BytesRefBuilder.grow...

OSV-2023-405 Heap-buffer-overflow in _lou_stringHash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59057 Crash type: Heap-buffer-overflow READ 2 Crash state: loustringHash loutranslate loutranslateString...