OSV-2023-358 Heap-double-free in wolfCrypt_custom_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58484 Crash type: Heap-double-free Crash state: wolfCryptcustomfree wolfSSLFree FreeOcspRequest...

OSV-2023-357 Heap-buffer-overflow in flac__analyze_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58481 Crash type: Heap-buffer-overflow READ 4 Crash state: flacanalyzeframe writecallback writeaudioframetoclient...

OSV-2023-356 Heap-buffer-overflow in pdf_nextobject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58475 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfnextobject findlength pdfextractobj...

OSV-2023-353 Stack-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58405 Crash type: Stack-buffer-overflow WRITE 1 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcfffont...

OSV-2023-350 UNKNOWN READ in cli_html_normalise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58398 Crash type: UNKNOWN READ Crash state: clihtmlnormalise htmlnormalisemap cliscanhtml...

OSV-2023-346 UNKNOWN WRITE in void std::__1::allocator_traits<std::__1::allocator<wabt::interp::HandlerDesc> >

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58344 Crash type: UNKNOWN WRITE Crash state: void std::1::allocatortraits void std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::inter std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::interp::Ha...

OSV-2023-344 Heap-buffer-overflow in tok_get_normal_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58295 Crash type: Heap-buffer-overflow WRITE 1 Crash state: tokgetnormalmode PyTokenizerGet PyPegentokenizefullsourcetocheckforerrors...

OSV-2023-343 Heap-buffer-overflow in _libssh2_ntohu32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58291 Crash type: Heap-buffer-overflow READ 1 Crash state: libssh2ntohu32 packetauthagentopen libssh2packetadd...

OSV-2023-342 Heap-use-after-free in ih264_inter_pred_luma_vert_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58278 Crash type: Heap-use-after-free READ 16 Crash state: ih264interpredlumavertssse3 ih264dmotioncompensatemp isvcddecoderecontfrnmbnonbaselyr...

OSV-2023-340 Heap-double-free in grk::DecompressCodeblock::release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58285 Crash type: Heap-double-free Crash state: grk::DecompressCodeblock::release grk::t1part1::T1Part1::decompress std::1::function::funcgrk::DecompressScheduler::scheduleBlocks...

OSV-2023-337 Heap-buffer-overflow in PyBytes_FromStringAndSize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58225 Crash type: Heap-buffer-overflow READ Crash state: PyBytesFromStringAndSize domkvalue vabuildstack...

OSV-2023-335 Security exception in org.json.JSONArray.writeTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58204 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...

OSV-2023-334 Heap-buffer-overflow in unicode_decode_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58201 Crash type: Heap-buffer-overflow READ 1 Crash state: unicodedecodeutf8 PyUnicodeDecodeUTF8 PyPegenformattedvalue...

OSV-2023-332 Heap-buffer-overflow in RegionGeometry_Polygon::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58183 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionGeometryPolygon::parse RegionItem::parse heif::HeifContext::interpretheiffile...

OSV-2023-330 Heap-buffer-overflow in RegionItem::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58150 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionItem::parse heif::HeifContext::interpretheiffile heif::HeifContext::readfrommemory...

OSV-2023-328 Heap-buffer-overflow in RegionItem::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58152 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionItem::parse heif::HeifContext::interpretheiffile heif::HeifContext::read...

CVE-2023-30612 Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily...

OSV-2023-327 Heap-double-free in HashMgr::~HashMgr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58133 Crash type: Heap-double-free Crash state: HashMgr::HashMgr HunspellImpl::HunspellImpl Hunspell::Hunspell...

OSV-2023-326 Heap-use-after-free in dynsec_clients__find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58108 Crash type: Heap-use-after-free READ 8 Crash state: dynsecclientsfind clientfreeitem dynsecclientscleanup...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...