OSV-2023-660 Security exception in org.apache.poi.hwpf.model.StyleSheet.createPap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61252 Crash type: Security exception Crash state: org.apache.poi.hwpf.model.StyleSheet.createPap org.apache.poi.util.BitField.getRawValue org.apache.poi.util.BitField.getValue...

OSV-2023-650 Heap-use-after-free in yr_parser_lookup_loop_variable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61164 Crash type: Heap-use-after-free READ 1 Crash state: yrparserlookuploopvariable yarayyparse yrlexparserulesfile...

OSV-2023-648 Stack-buffer-overflow in parse_regex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61131 Crash type: Stack-buffer-overflow READ 1 Crash state: parseregex parseregex parseregex...

OSV-2023-645 Segv on unknown address in decUnitCompare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61050 Crash type: Segv on unknown address Crash state: decUnitCompare decCompare decCompareOp...

OSV-2022-1280 Heap-buffer-overflow in Canvas5Structure::NIBDecoder::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61081 Crash type: Heap-buffer-overflow READ 1 Crash state: Canvas5Structure::NIBDecoder::decode Canvas5Structure::decodeZone5 Canvas5Parser::decode...

OSV-2023-636 Security exception in jflex.core.NFA.insertNFA

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61028 Crash type: Security exception Crash state: jflex.core.NFA.insertNFA jflex.core.NFA.insertNFA jflex.core.NFA.insertNFA...

OSV-2023-634 Heap-buffer-overflow in bit_read_BB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60993 Crash type: Heap-buffer-overflow READ 1 Crash state: bitreadBB bitreadBS dwgdecodeATTDEFprivate...

OSV-2023-631 Heap-buffer-overflow in test_verify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60971 Crash type: Heap-buffer-overflow READ Crash state: testverify fuzzpkcs11.c...

OSV-2023-627 Security exception in org.apache.lucene.util.automaton.RegExp.toAutomaton

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60964 Crash type: Security exception Crash state: org.apache.lucene.util.automaton.RegExp.toAutomaton java.base/java.util.BitSet.ensureCapacity java.base/java.util.BitSet.expandTo...

OSV-2023-623 Heap-use-after-free in Elf32_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60863 Crash type: Heap-use-after-free READ 8 Crash state: Elf32free destroy rbinfilefree...

OSV-2023-619 Security exception in java.base/java.util.regex.Pattern$GroupTail.match

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60846 Crash type: Security exception Crash state: java.base/java.util.regex.Pattern$GroupTail.match java.base/java.io.BufferedWriter.ensureOpen java.base/java.io.BufferedWriter.write...

[slackware-security] kernel-firmware

New kernel-firmware packages are available for Slackware 14.2, 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/kernel-firmware-2023072459fbffa-noarch-1.txz: Upgraded. AMD microcode updated to fix a use-after-free in AMD Zen2...

OSV-2023-610 Security exception in org.apache.lucene.util.automaton.RegExp.toAutomaton

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60782 Crash type: Security exception Crash state: org.apache.lucene.util.automaton.RegExp.toAutomaton java.base/java.util.BitSet.ensureCapacity java.base/java.util.BitSet.expandTo...

OSV-2023-606 Heap-buffer-overflow in ZSTD_decompressMultiFrame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778 Crash type: Heap-buffer-overflow READ Crash state: ZSTDdecompressMultiFrame ZSTDdecompressusingDDict zstdwrapdecompress...

OSV-2023-604 Segv on unknown address in ucl_object_free_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60789 Crash type: Segv on unknown address Crash state: uclobjectfreeinternal uclparserfree ucladdstringfuzzer.c...

OSV-2023-599 Negative-size-param in passDoAction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60723 Crash type: Negative-size-param Crash state: passDoAction translateString loutranslate...

OSV-2023-598 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60734 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2023-586 Heap-buffer-overflow in setcos_create_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60672 Crash type: Heap-buffer-overflow READ 1 Crash state: setcoscreatekey scpkcs15initgeneratekey dogeneratekey...

OSV-2023-583 Segv on unknown address in ucl_hash_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60678 Crash type: Segv on unknown address Crash state: uclhashdestroy uclobjectdtorunrefsingle uclobjectdtorunref...

OSV-2023-581 Heap-buffer-overflow in wwunpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60655 Crash type: Heap-buffer-overflow WRITE 1 Crash state: wwunpack cliscanpe climagicscan...