OSV-2018-126 UNKNOWN READ in BEInt<int, 4>::operator int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10900 Crash type: UNKNOWN READ Crash state: BEInt::operator int AAT::KerxSubTableFormat6::getkerning hbkernmachinet::kern...

OSV-2018-124 UNKNOWN READ in netdev_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11314 Crash type: UNKNOWN READ Crash state: netdevget configparsenetdev nextassignment...

OSV-2018-127 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10341 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::Offset, true::isnull OT::OffsetToOT::ArrayOfM1OT::ResourceTypeRecord, OT::IntTypeunsigned short, 2...

OSV-2018-117 Heap-buffer-overflow in Envoy::StringUtil::itoa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10038 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Envoy::StringUtil::itoa Envoy::Http::HeaderString::setInteger Envoy::TestOneProtoInput...

OSV-2018-115 Global-buffer-overflow in CFF::BlendArg::set_blends

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11691 Crash type: Global-buffer-overflow READ 8 Crash state: CFF::BlendArg::setblends CFF::CFF2CSOpSet::proc CFF::CSInterpreter::int...

OSV-2018-116 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11060 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-113 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11466 Crash type: Use-of-uninitialized-value Crash state: iclip applytorowuv dav1dapplygrain8bpc...

OSV-2018-114 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10933 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat2::getkerning...

OSV-2018-112 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10356 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::BinSearchHeader::operator unsigned int OT::OffsetTable::findtableindex...

OSV-2018-111 Heap-buffer-overflow in format_generic_odp_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10850 Crash type: Heap-buffer-overflow READ 1 Crash state: formatgenericodpkey checkattrlen formatodpkeyattr...

OSV-2018-109 Heap-use-after-free in ssl_get_prev_session

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8241 Crash type: Heap-use-after-free READ 4 Crash state: sslgetprevsession tlsearlypostprocessclienthello tlspostprocessclienthello...

OSV-2018-108 UNKNOWN READ in BEInt<int, 4>::operator int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10898 Crash type: UNKNOWN READ Crash state: BEInt::operator int hbkernmachinet::kern AAT::KerxSubTableFormat6::apply...

OSV-2018-105 UNKNOWN READ in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11300 Crash type: UNKNOWN READ Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2018-106 Stack-use-after-return in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10082 Crash type: Stack-use-after-return READ 1 Crash state: BEInt::operator unsigned short OT::CoverageFormat2::Iter::more OT::SingleSubstFormat2::closure...

OSV-2018-102 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11303 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rbinfilegetstrings rbinobjectsetitems...

OSV-2018-101 Heap-buffer-overflow in r_bin_mdmp_init_pe_bins

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11361 Crash type: Heap-buffer-overflow READ 8 Crash state: rbinmdmpinitpebins rbinmdmpinit rbinmdmpnewbuf...

OSV-2018-99 Heap-buffer-overflow in git__strntol64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11173 Crash type: Heap-buffer-overflow READ 1 Crash state: gitstrntol64 gitsignatureparse gitcommitparseraw...

OSV-2018-97 Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11713 Crash type: Heap-buffer-overflow READ Crash state: CFF::CFF2VariationStore::serialize writecff2 hbsubsetcff2...

OSV-2018-95 Heap-use-after-free in Envoy::FakeConnectionBase::close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8783 Crash type: Heap-use-after-free READ 1 Crash state: Envoy::FakeConnectionBase::close Envoy::Event::DispatcherImpl::runPostCallbacks eventprocessactivesinglequeue...

OSV-2018-91 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10881 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::kern::hasdata hbotlayouthaskerning...