OSV-2023-340 Heap-double-free in grk::DecompressCodeblock::release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58285 Crash type: Heap-double-free Crash state: grk::DecompressCodeblock::release grk::t1part1::T1Part1::decompress std::1::function::funcgrk::DecompressScheduler::scheduleBlocks...

OSV-2023-337 Heap-buffer-overflow in PyBytes_FromStringAndSize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58225 Crash type: Heap-buffer-overflow READ Crash state: PyBytesFromStringAndSize domkvalue vabuildstack...

OSV-2023-335 Security exception in org.json.JSONArray.writeTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58204 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...

OSV-2023-334 Heap-buffer-overflow in unicode_decode_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58201 Crash type: Heap-buffer-overflow READ 1 Crash state: unicodedecodeutf8 PyUnicodeDecodeUTF8 PyPegenformattedvalue...

OSV-2023-332 Heap-buffer-overflow in RegionGeometry_Polygon::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58183 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionGeometryPolygon::parse RegionItem::parse heif::HeifContext::interpretheiffile...

OSV-2023-330 Heap-buffer-overflow in RegionItem::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58150 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionItem::parse heif::HeifContext::interpretheiffile heif::HeifContext::readfrommemory...

OSV-2023-328 Heap-buffer-overflow in RegionItem::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58152 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionItem::parse heif::HeifContext::interpretheiffile heif::HeifContext::read...

CVE-2023-30612 Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor

Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hypervisor process via sending malicious HTTP request through the HTTP API socket. As a result, the Cloud Hypervisor process can be easily...

OSV-2023-327 Heap-double-free in HashMgr::~HashMgr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58133 Crash type: Heap-double-free Crash state: HashMgr::HashMgr HunspellImpl::HunspellImpl Hunspell::Hunspell...

OSV-2023-326 Heap-use-after-free in dynsec_clients__find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58108 Crash type: Heap-use-after-free READ 8 Crash state: dynsecclientsfind clientfreeitem dynsecclientscleanup...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...

Thunderbird: Hang when processing certain OpenPGP messages

The Mozilla Foundation Security Advisory describes this flaw as: Certain malformed OpenPGP messages could trigger incorrect parsing of PKESK/SKESK packets due to a bug in the Ribose RNP library used by Thunderbird up to version 102.9.1, which would cause the Thunderbird user interface to hang. Th...

OSV-2023-323 Heap-buffer-overflow in OT::glyf_impl::SubsetGlyph::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58071 Crash type: Heap-buffer-overflow WRITE 2 Crash state: OT::glyfimpl::SubsetGlyph::serialize OT::glyf::subset bool trysubset...

OSV-2023-322 Use-after-poison in str_new_frozen_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58079 Crash type: Use-after-poison READ 8 Crash state: strnewfrozenbuffer fstrupdatecallback rbstupdate...

OSV-2023-321 Heap-use-after-free in ucl_hash_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58069 Crash type: Heap-use-after-free READ 8 Crash state: uclhashfunc khresizeuclhashnode khputuclhashnode...

OSV-2023-319 Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035 Crash type: Heap-buffer-overflow READ 8 Crash state: ZSTDdecompressSequencesLongbmi2 ZSTDdecompressSequencesLong ZSTDdecompressBlockinternal...

OSV-2023-316 Segv on unknown address in dwg_ref_get_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57981 Crash type: Segv on unknown address Crash state: dwgrefgetobject dwggeojsonfeature dwggeojsonobject...

CVE-2023-2004

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

OSV-2023-314 Heap-buffer-overflow in dwg_encode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57969 Crash type: Heap-buffer-overflow READ 8 Crash state: dwgencode llvmfuzz.c...