OSV-2022-210 UNKNOWN READ in pdfi_count_cff_index

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45173 Crash type: UNKNOWN READ Crash state: pdficountcffindex pdfireadcfffont pdfiloadfont...

OSV-2022-209 Heap-buffer-overflow in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45161 Crash type: Heap-buffer-overflow READ 4 Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2022-206 Heap-buffer-overflow in spgetcc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45049 Crash type: Heap-buffer-overflow READ Crash state: spgetcc gsscantoken gsinterpret...

OSV-2022-199 Stack-buffer-overflow in check_user_password_preR5

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44983 Crash type: Stack-buffer-overflow READ Crash state: checkuserpasswordpreR5 pdfiinitialiseDecryption pdfisetinputstream...

OSV-2022-197 Heap-buffer-overflow in doemit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44978 Crash type: Heap-buffer-overflow WRITE 8 Crash state: doemit doinsert pere...

OSV-2022-193 UNKNOWN READ in GC_generic_malloc_many

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44961 Crash type: UNKNOWN READ Crash state: GCgenericmallocmany GCmallockind Strnewsize...

OSV-2022-191 Heap-buffer-overflow in ndpi_handle_ipv6_extension_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44942 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpihandleipv6extensionheaders ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2022-188 Incorrect-function-pointer-type in cv::split

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44937 Crash type: Incorrect-function-pointer-type Crash state: cv::split cv::split TestSplitAndMerge...

OSV-2022-185 Heap-use-after-free in Segment::write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44951 Crash type: Heap-use-after-free READ 1 Crash state: Segment::write Doublewrite::writepages Doublewrite::flushtodisk...

OSV-2022-183 Heap-buffer-overflow in evax_bfd_print_dst

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44864 Crash type: Heap-buffer-overflow READ 1 Crash state: evaxbfdprintdst evaxbfdprintimage vmsbfdprintprivatebfddata...

OSV-2022-181 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44885 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2022-180 Heap-buffer-overflow in row_mt_worker_hook

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44862 Crash type: Heap-buffer-overflow WRITE 4 Crash state: rowmtworkerhook threadloop...

OSV-2022-179 Heap-buffer-overflow in row_mt_worker_hook

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44856 Crash type: Heap-buffer-overflow WRITE 4 Crash state: rowmtworkerhook execute av1decodetgtilesandwrapup...

OSV-2022-177 UNKNOWN READ in gx_dc_default_fill_masked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44855 Crash type: UNKNOWN READ Crash state: gxdcdefaultfillmasked copyportrait imagerendersimple...

OSV-2022-165 Stack-buffer-overflow in fmt::v8::basic_memory_buffer<unsigned int, 32ul, std::__1::allocator<unsigned in

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44763 Crash type: Stack-buffer-overflow READ 4 Crash state: fmt::v8::basicmemorybufferunsigned int, 32ul, std::1::allocatorunsigned in fmt::v8::detail::bigint::square fmt::v8::detail::bigint::assignpow10...

OSV-2022-158 Heap-buffer-overflow in parse_primitive

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44695 Crash type: Heap-buffer-overflow READ 1 Crash state: parseprimitive plistfromjson jplistfuzzer.cc...

Improper input validation in umoci

Impact umoci 0.4.6 and earlier can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/". Because umoci deletes inodes if they change types, this results in the rootfs directory being replaced with an attacker-controlled symlink. Subsequent...

GHSA-9M95-8HX6-7P9V Improper input validation in umoci

Impact umoci 0.4.6 and earlier can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/". Because umoci deletes inodes if they change types, this results in the rootfs directory being replaced with an attacker-controlled symlink. Subsequent...

OSV-2022-152 UNKNOWN WRITE

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44641 Crash type: UNKNOWN WRITE Crash state: NULL...

OSV-2022-151 Heap-buffer-overflow in extensionObjectOrder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44623 Crash type: Heap-buffer-overflow READ 4 Crash state: extensionObjectOrder extensionObjectOrder extensionObjectOrder...