OSV-2021-891 Heap-buffer-overflow in __cil_cat_expr_range_to_bitmap_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35492 Crash type: Heap-buffer-overflow READ 4 Crash state: cilcatexprrangetobitmaphelper cilexprtobitmap evaluatecatexpression...

[SECURITY] Fedora 34 Update: audacity-3.0.2-3.fc34

Audacity is a cross-platform multitrack audio editor. It allows you to record sounds directly or to import files in various formats. It features a few simple effects, all of the editing features you should need, and unlimited undo. The GUI was built with wxWidgets and the audio I/O supports...

OSV-2021-887 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35436 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-882 Uncaught exception

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35392 Crash type: Uncaught exception Crash state: NULL...

OSV-2021-875 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35337 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-872 Heap-buffer-overflow in ndpi_set_detected_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35300 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisetdetectedprotocol ndpiinthttpaddconnection checkcontenttypeandchangeprotocol...

OSV-2021-871 Heap-use-after-free in jxl::ImageBlender::PrepareBlending

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35293 Crash type: Heap-use-after-free READ 8 Crash state: jxl::ImageBlender::PrepareBlending jxl::FinalizeFrameDecoding jxl::FrameDecoder::Flush...

OSV-2021-870 Stack-use-after-return in v9fs_co_lgetxattr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35290 Crash type: Stack-use-after-return READ 8 Crash state: v9fscolgetxattr v9fsxattrwalk coroutinetrampoline...

OSV-2021-868 Heap-buffer-overflow in ndpi_set_detected_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35288 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisetdetectedprotocol ndpimatchhostnameprotocol processClientServerHello...

OSV-2021-863 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35251 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-859 Heap-buffer-overflow in FSE_writeNCount_generic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35209 Crash type: Heap-buffer-overflow WRITE 1 Crash state: FSEwriteNCountgeneric FSEwriteNCount HUFcompressWeights...

OSV-2021-857 Heap-buffer-overflow in mk_string_copy_substr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35202 Crash type: Heap-buffer-overflow READ Crash state: mkstringcopysubstr mkrconfmetaadd mkrconfread...

OSV-2021-853 Heap-buffer-overflow in jxl::ThreadPool::RunCallState<jxl::ConvertToExternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35172 Crash type: Heap-buffer-overflow WRITE 4 Crash state: jxl::ThreadPool::RunCallStatejxl::ConvertToExternal jpegxl::ThreadParallelRunner::ThreadFunc void std::1::threadproxystd::1::tuplestd::1::uniqueptrstd::1::...

OSV-2021-852 Heap-buffer-overflow in parseInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35153 Crash type: Heap-buffer-overflow READ 1 Crash state: parseInternal JavaExampleFuzzerNativeparse...

OSV-2021-850 Heap-buffer-overflow in proto_item_append_text

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35102 Crash type: Heap-buffer-overflow READ 8 Crash state: protoitemappendtext dissectpfcp3gppenterpriseies calldissectorwork...

OSV-2021-849 Negative-size-param in mrb_str_format

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35109 Crash type: Negative-size-param Crash state: mrbstrformat mrbfsprintf mrbvmexec...

OSV-2021-843 Use-after-poison in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35038 Crash type: Use-after-poison READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

OSV-2021-841 Heap-use-after-free in AK::StringImpl::create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34973 Crash type: Heap-use-after-free READ Crash state: AK::StringImpl::create AK::String::String AK::URLParser::parsedataurl...

OSV-2021-840 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34971 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-838 Heap-use-after-free in multiline_parser_conf_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34960 Crash type: Heap-use-after-free READ 8 Crash state: multilineparserconffile flbparserconffile configfuzzer.c...