OSV-2021-1076 UNKNOWN READ in ParseXMLElement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36671 Crash type: UNKNOWN READ Crash state: ParseXMLElement prvTidyParseXMLDocument prvTidyDocParseStream...

OSV-2021-1075 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36677 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-1074 Use-of-uninitialized-value in SkBaseDevice::save

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36647 Crash type: Use-of-uninitialized-value Crash state: SkBaseDevice::save SkCanvas::internalSave SkCanvas::internalSaveLayer...

OSV-2021-1071 Heap-use-after-free in SkCanvas::MCRec::MCRec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36644 Crash type: Heap-use-after-free READ 8 Crash state: SkCanvas::MCRec::MCRec SkCanvas::MCRec& SkTArray::emplacebackSkCanvas::MCRec& SkCanvas::internalSave...

OSV-2021-1070 Heap-buffer-overflow in ZSTD_decompressBlock_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623 Crash type: Heap-buffer-overflow READ 4 Crash state: ZSTDdecompressBlockinternal ZSTDdecompressMultiFrame ZSTDdecompressDCtx...

OSV-2021-1068 Heap-buffer-overflow in ucl_object_free_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36572 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectfreeinternal uclobjectdtorunrefsingle uclobjectdtorunref...

OSV-2021-1066 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36571 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-1055 UNKNOWN WRITE in jxl::ModularFrameDecoder::DecodeGroup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36456 Crash type: UNKNOWN WRITE Crash state: jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup jxl::ThreadPool::RunCallStatejxl::FrameDecoder::ProcessSections...

OSV-2021-1054 Heap-buffer-overflow in jxl::N_SCALAR::SingleFromSingle

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36490 Crash type: Heap-buffer-overflow WRITE 4 Crash state: jxl::NSCALAR::SingleFromSingle jxl::ThreadPool::SequentialRunnerStatic jxl::ModularFrameDecoder::ModularImageToDecodedRect...

OSV-2021-1049 Container-overflow in jxl::InvSqueeze

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36485 Crash type: Container-overflow READ 8 Crash state: jxl::InvSqueeze jxl::Transform::Inverse jxl::Image::undotransforms...

OSV-2021-1046 UNKNOWN READ in helper_ret_stb_mmu_x86_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36453 Crash type: UNKNOWN READ Crash state: helperretstbmmux8664 stack...

OSV-2021-1045 Heap-buffer-overflow in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36464 Crash type: Heap-buffer-overflow READ 1 Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2021-1041 Global-buffer-overflow in SetUpPhonemeTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36412 Crash type: Global-buffer-overflow READ 4 Crash state: SetUpPhonemeTable SelectPhonemeTable TranslateWord2...

OSV-2021-1039 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36388 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

CVE-2021-36976

libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring called from douncompressblock and processblock...

OSV-2021-1033 Stack-buffer-overflow in unicodize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36312 Crash type: Stack-buffer-overflow WRITE 1 Crash state: unicodize ntlmphase3 establishhttpproxypassthru...

OSV-2021-1027 Index-out-of-bounds in sd_read_byte

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36240 Crash type: Index-out-of-bounds Crash state: sdreadbyte sdbusreaddata sdhcireadblockfromcard...

OSV-2021-1024 Global-buffer-overflow in GetSsmlAttribute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36228 Crash type: Global-buffer-overflow READ 1 Crash state: GetSsmlAttribute GetVoiceAttributes ProcessSsmlTag...

OSV-2021-1017 Stack-buffer-overflow in piv_compute_signature

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36200 Crash type: Stack-buffer-overflow WRITE Crash state: pivcomputesignature sccomputesignature usekey...

OSV-2021-1015 Dynamic-stack-buffer-overflow in VP8SetSegmentParams

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36191 Crash type: Dynamic-stack-buffer-overflow WRITE Crash state: VP8SetSegmentParams SetLoopParams OneStatPass...