OSV-2023-404 Invalid-free in Assimp::FBX::Scope::Scope

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59056 Crash type: Invalid-free Crash state: Assimp::FBX::Scope::Scope Assimp::FBX::Element::Element Assimp::FBX::Scope::Scope...

PT-2023-35832 · Git +1 · Liblouis

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state involves several functions, includi...

OSV-2023-402 Heap-use-after-free in Assimp::FBXExporter::WriteObjects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59036 Crash type: Heap-use-after-free READ 4 Crash state: Assimp::FBXExporter::WriteObjects Assimp::FBXExporter::ExportBinary Assimp::ExportSceneFBX...

swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. It is fixed in 1.19.2 and later releases. This vulnerability is caused by a logica...

OSV-2023-397 Heap-buffer-overflow in json_write_TF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58915 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonwriteTF jsonpreR13headerwriteprivate dwgwritejson...

OSV-2023-396 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58938 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.Arrays.hashCode java.base/sun.reflect.generics.reflectiveObjects.ParameterizedTypeImpl.hashC...

OSV-2023-392 Negative-size-param in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58892 Crash type: Negative-size-param Crash state: H5MMmemcpy H5Olinkdecode H5Omsgiteratereal...

OSV-2023-390 Heap-buffer-overflow in sdhci_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 Crash type: Heap-buffer-overflow WRITE 1 Crash state: sdhciwrite memoryregionwriteaccessor memoryregiondispatchwrite...

OSV-2023-388 Heap-buffer-overflow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58786 Crash type: Heap-buffer-overflow READ 4 Crash state: NULL...

PT-2023-35822 · Git +1 · Tcmalloc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 4 crash has been reported, with a crash state of NULL. This issue was identified through an OSS-Fuzz report. Recommendations:...

OSV-2023-385 Bad-cast to Assimp::BaseImporter from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58724 Crash type: Bad-cast Crash state: Bad-cast to Assimp::BaseImporter from invalid vptr Assimp::Importer::ReadFile Assimp::BatchLoader::LoadAll...

OSV-2023-384 Heap-use-after-free in mrb_str_hash_m

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58723 Crash type: Heap-use-after-free READ 1 Crash state: mrbstrhashm mrbfuncallwithblock mrbfuncallargv...

OSV-2023-383 Security exception in org.json.JSONStringer.value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58722 Crash type: Security exception Crash state: org.json.JSONStringer.value org.json.JSONArray.writeTo org.json.JSONStringer.beforeValue...

OSV-2023-382 Use-of-uninitialized-value in wabt::BinaryReaderObjdump::PrintInitExpr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58694 Crash type: Use-of-uninitialized-value Crash state: wabt::BinaryReaderObjdump::PrintInitExpr wabt::BinaryReaderObjdump::EndInitExpr wabt::BinaryReaderObjdump::EndGlobalInitExpr...

OSV-2023-381 UNKNOWN READ in H5FL__blk_gc_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58701 Crash type: UNKNOWN READ Crash state: H5FLblkgclist H5FLgarbagecoll H5FLtermpackage...

OSV-2023-380 UNKNOWN WRITE in bool OT::Layout::Common::Coverage::serialize<hb_map_iter_t<hb_map_iter_t<hb_filt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58663 Crash type: UNKNOWN WRITE Crash state: bool OT::Layout::Common::Coverage::serialize::subset hbsubsetcontextt::returnt OT::Layout::GSUBimpl::SubstLookupSubTable::dispat...

OSV-2023-379 Heap-buffer-overflow in void sort_r_simple<>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58662 Crash type: Heap-buffer-overflow READ 1 Crash state: void sortrsimple bool OT::ClassDef::serializehbsortedarraythbpairtunsigned int, unsigned OT::ClassDefremapandserialize...

OSV-2023-377 UNKNOWN WRITE in bool OT::Layout::Common::CoverageFormat2_4<OT::Layout::MediumTypes>::serialize<h

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58671 Crash type: UNKNOWN WRITE Crash state: bool OT::Layout::Common::CoverageFormat24::serialize::subset...

OSV-2023-375 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58658 Crash type: Heap-buffer-overflow WRITE Crash state: H5MMmemcpy H5Oallocchunk H5Oalloc...

OSV-2023-372 UNKNOWN WRITE in hb_ot_layout_substitute_start

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58626 Crash type: UNKNOWN WRITE Crash state: hbotlayoutsubstitutestart hbotshape hbshapeplanexecute...