OSV-2023-382 Use-of-uninitialized-value in wabt::BinaryReaderObjdump::PrintInitExpr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58694 Crash type: Use-of-uninitialized-value Crash state: wabt::BinaryReaderObjdump::PrintInitExpr wabt::BinaryReaderObjdump::EndInitExpr wabt::BinaryReaderObjdump::EndGlobalInitExpr...

OSV-2023-381 UNKNOWN READ in H5FL__blk_gc_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58701 Crash type: UNKNOWN READ Crash state: H5FLblkgclist H5FLgarbagecoll H5FLtermpackage...

OSV-2023-380 UNKNOWN WRITE in bool OT::Layout::Common::Coverage::serialize<hb_map_iter_t<hb_map_iter_t<hb_filt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58663 Crash type: UNKNOWN WRITE Crash state: bool OT::Layout::Common::Coverage::serialize::subset hbsubsetcontextt::returnt OT::Layout::GSUBimpl::SubstLookupSubTable::dispat...

OSV-2023-379 Heap-buffer-overflow in void sort_r_simple<>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58662 Crash type: Heap-buffer-overflow READ 1 Crash state: void sortrsimple bool OT::ClassDef::serializehbsortedarraythbpairtunsigned int, unsigned OT::ClassDefremapandserialize...

OSV-2023-377 UNKNOWN WRITE in bool OT::Layout::Common::CoverageFormat2_4<OT::Layout::MediumTypes>::serialize<h

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58671 Crash type: UNKNOWN WRITE Crash state: bool OT::Layout::Common::CoverageFormat24::serialize::subset...

OSV-2023-375 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58658 Crash type: Heap-buffer-overflow WRITE Crash state: H5MMmemcpy H5Oallocchunk H5Oalloc...

OSV-2023-372 UNKNOWN WRITE in hb_ot_layout_substitute_start

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58626 Crash type: UNKNOWN WRITE Crash state: hbotlayoutsubstitutestart hbotshape hbshapeplanexecute...

OSV-2023-371 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58625 Crash type: Memcpy-param-overlap Crash state: repeat pere cliregcompreal...

OSV-2023-366 Heap-use-after-free in gc_mark_children

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58577 Crash type: Heap-use-after-free READ 4 Crash state: gcmarkchildren incrementalgc mrbfullgc...

OSV-2023-364 Heap-double-free in HashMgr::~HashMgr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58553 Crash type: Heap-double-free Crash state: HashMgr::HashMgr HunspellImpl::HunspellImpl Hunspell::Hunspell...

OSV-2023-361 Heap-buffer-overflow in tok_get_normal_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58510 Crash type: Heap-buffer-overflow WRITE 1 Crash state: tokgetnormalmode PyTokenizerGet PyPegentokenizefullsourcetocheckforerrors...

OSV-2023-358 Heap-double-free in wolfCrypt_custom_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58484 Crash type: Heap-double-free Crash state: wolfCryptcustomfree wolfSSLFree FreeOcspRequest...

OSV-2023-357 Heap-buffer-overflow in flac__analyze_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58481 Crash type: Heap-buffer-overflow READ 4 Crash state: flacanalyzeframe writecallback writeaudioframetoclient...

OSV-2023-356 Heap-buffer-overflow in pdf_nextobject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58475 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfnextobject findlength pdfextractobj...

OSV-2023-353 Stack-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58405 Crash type: Stack-buffer-overflow WRITE 1 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcfffont...

OSV-2023-350 UNKNOWN READ in cli_html_normalise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58398 Crash type: UNKNOWN READ Crash state: clihtmlnormalise htmlnormalisemap cliscanhtml...

OSV-2023-346 UNKNOWN WRITE in void std::__1::allocator_traits<std::__1::allocator<wabt::interp::HandlerDesc> >

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58344 Crash type: UNKNOWN WRITE Crash state: void std::1::allocatortraits void std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::inter std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::interp::Ha...

OSV-2023-344 Heap-buffer-overflow in tok_get_normal_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58295 Crash type: Heap-buffer-overflow WRITE 1 Crash state: tokgetnormalmode PyTokenizerGet PyPegentokenizefullsourcetocheckforerrors...

OSV-2023-343 Heap-buffer-overflow in _libssh2_ntohu32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58291 Crash type: Heap-buffer-overflow READ 1 Crash state: libssh2ntohu32 packetauthagentopen libssh2packetadd...

OSV-2023-342 Heap-use-after-free in ih264_inter_pred_luma_vert_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58278 Crash type: Heap-use-after-free READ 16 Crash state: ih264interpredlumavertssse3 ih264dmotioncompensatemp isvcddecoderecontfrnmbnonbaselyr...