OSV-2023-873 UNKNOWN WRITE in icu_74::Calendar::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62425 Crash type: UNKNOWN WRITE Crash state: icu74::Calendar::set calendarfuzzer.cpp...

OSV-2023-872 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62457 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

OSV-2023-869 Heap-buffer-overflow in Assimp::MD5::MD5MeshParser::MD5MeshParser

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62441 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::MD5::MD5MeshParser::MD5MeshParser Assimp::MD5Importer::LoadMD5MeshFile Assimp::MD5Importer::InternReadFile...

OSV-2023-865 UNKNOWN in WasmEdge::Loader::SharedLibrary::load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62387 Crash type: UNKNOWN Crash state: WasmEdge::Loader::SharedLibrary::load WasmEdge::Loader::Loader::loadModule WasmEdge::Loader::Loader::parseModule...

OSV-2023-862 Heap-use-after-free in g_datalist_get_flags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62381 Crash type: Heap-use-after-free READ 8 Crash state: gdatalistgetflags gobjectunref gstobjectunref...

PT-2023-36017 · Git +1 · Mongoose

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A crash occurred due to a negative-size-param issue, as reported by OSS-Fuzz. The crash involves the http cb function in fuzz.c. Recommendations: At the moment, there is no information...

Authentication flaw

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

OSV-2023-855 Heap-double-free in dwg_free_common_entity_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62367 Crash type: Heap-double-free Crash state: dwgfreecommonentitydata dwgfreePOINTCLOUD dwgfreevariablenoclass...

OSV-2023-849 Stack-buffer-overflow in ulocimp_toLanguageTag_74

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62348 Crash type: Stack-buffer-overflow WRITE 1 Crash state: ulocimptoLanguageTag74 icu74::Locale::toLanguageTag localemorphfuzzer.cpp...

OSV-2023-844 Heap-buffer-overflow in Video::VP9::Decoder::create_video_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62307 Crash type: Heap-buffer-overflow READ Crash state: Video::VP9::Decoder::createvideoframe Video::VP9::Decoder::decodeframe Video::VP9::Decoder::receivesample...

OSV-2023-840 Null-dereference READ in isvcd_parse_inter_slice_data_cavlc_enh_lyr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62290 Crash type: Null-dereference READ Crash state: isvcdparseinterslicedatacavlcenhlyr isvcdparseepslice isvcdparsedecodesliceextnal...

OSV-2023-838 Use-of-uninitialized-value in wabt::BinaryReaderIR::OnOpcode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62267 Crash type: Use-of-uninitialized-value Crash state: wabt::BinaryReaderIR::OnOpcode wabt::BinaryReader::ReadInstructions wabt::ReadBinary...

OSV-2023-837 Heap-buffer-overflow in uint7_get_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62270 Crash type: Heap-buffer-overflow READ 1 Crash state: uint7get64 cramhuffmandecodeinit cramdecoderinit...

CISA Releases its Open Source Software Security Roadmap

Today, CISA released an Open Source Software Security Roadmap to lay out—in alignment with the National Cybersecurity Strategy and the CISA Cybersecurity Strategic Plan—how we will partner with federal agencies, open source software OSS consumers, and the OSS community, to secure OSS...

OSV-2023-819 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62167 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2023-811 Invalid-free in bit_chain_alloc_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62132 Crash type: Invalid-free Crash state: bitchainallocsize bitwriteRC bitHtodat...

OSV-2023-798 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62081 Crash type: Memcpy-param-overlap Crash state: repeat repeat pere...

OSV-2023-797 Stack-buffer-overflow in QBuffer::readData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62075 Crash type: Stack-buffer-overflow WRITE Crash state: QBuffer::readData QIODevicePrivate::read QDataStream::readRawData...

OSV-2023-795 Security exception in org.apache.poi.hwpf.converter.AbstractWordConverter.processNoteAnchor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62068 Crash type: Security exception Crash state: org.apache.poi.hwpf.converter.AbstractWordConverter.processNoteAnchor org.apache.poi.hwpf.converter.AbstractWordConverter.processCharacters...

OSV-2023-793 Security exception in org.apache.lucene.util.BytesRefBuilder.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62034 Crash type: Security exception Crash state: org.apache.lucene.util.BytesRefBuilder. org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone...