PT-2023-35911 · Git +1 · Opensc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, as indicated by an OSS-Fuzz report. The crash state involves several functions: cosm new file, cosm...

OSV-2023-573 Negative-size-param in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60605 Crash type: Negative-size-param Crash state: checkcontenttypeandchangeprotocol processresponse ndpicheckhttptcp...

OSV-2023-568 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60565 Crash type: Memcpy-param-overlap Crash state: repeat repeat pere...

OSV-2023-567 Stack-buffer-overflow in initialize_encryption_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60563 Crash type: Stack-buffer-overflow READ Crash state: initializeencryptionkey cliole2extract cliscanole2...

OSV-2023-566 Heap-buffer-overflow in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60557 Crash type: Heap-buffer-overflow READ 1 Crash state: checkcontenttypeandchangeprotocol processresponse ndpicheckhttptcp...

OSV-2023-562 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60538 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::EvaluateValue...

OSV-2023-555 Heap-buffer-overflow in Gfx::InputStreamer::read_u24

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60465 Crash type: Heap-buffer-overflow READ 1 Crash state: Gfx::InputStreamer::readu24 AK::Function Gfx::BMPImageDecoderPlugin::frame...

OSV-2023-554 Heap-buffer-overflow in OT::CmapSubtable::get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60475 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::CmapSubtable::getglyph bool OT::cmap::acceleratort::getglyphfrom hbotgetnominalglyphs...

OSV-2023-547 UNKNOWN READ in r_str_ncpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60407 Crash type: UNKNOWN READ Crash state: rstrncpy Elf32rbinelfloadsymbolsandimports Elf32loadsymbols...

OSV-2023-538 Heap-buffer-overflow in Gfx::BooleanDecoder::initialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60262 Crash type: Heap-buffer-overflow READ 7 Crash state: Gfx::BooleanDecoder::initialize Video::VP9::FrameContext::createrangedecoder Video::VP9::Parser::compressedheader...

OSV-2023-536 Heap-buffer-overflow in Assimp::MD5::MD5Parser::ParseHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60274 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::MD5::MD5Parser::ParseHeader Assimp::MD5::MD5Parser::MD5Parser Assimp::MD5Importer::LoadMD5MeshFile...

OSV-2023-533 Security exception in org.apache.lucene.util.ArrayUtil.growExact

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60248 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.growExact org.apache.lucene.util.ArrayUtil.grow org.apache.lucene.util.BytesRefBuilder.grow...

OSV-2023-528 Memcpy-param-overlap in pdfi_copy_truetype_font

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60204 Crash type: Memcpy-param-overlap Crash state: pdficopytruetypefont pdfiloadfont pdfiloaddictfont...

OSV-2023-527 Heap-buffer-overflow in default_get_outline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60207 Crash type: Heap-buffer-overflow READ 4 Crash state: defaultgetoutline pdfifapigetglyph getfapiglyphdata...

OSV-2023-525 Security exception in jaz.Zer.reportFinding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60167 Crash type: Security exception Crash state: jaz.Zer.reportFinding jaz.Zer.reportFindingIfEnabled jaz.Zer...

OSV-2023-522 Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60156 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf com.codeintelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrfSocket...

OSV-2023-521 Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60179 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf com.codeintelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrfSocket...

OSV-2023-518 Security exception in com.code_intelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60148 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute org.hamcrest.xml.HasXPath.compiledXPath org.hamcrest.xml.HasXPath...

FreeBSD : OpenEXR -- heap buffer overflow in internal_huf_decompress (06428d91-152e-11ee-8b14-dbdd62da85fb)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 06428d91-152e-11ee-8b14-dbdd62da85fb advisory. - oss-fuzz reports: heap buffer overflow in internalhufdecompress. Cary Phillips reports: v3.1.9 - Patc...

OSV-2023-517 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60112 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/sun.reflect.generics.reflectiveObjects.TypeVariableImpl.hashCode java.base/java.util.Arrays.hashCode...