OSV-2018-90 Heap-buffer-overflow in wireguard_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11279 Crash type: Heap-buffer-overflow READ 8 Crash state: wireguarddone netdevfree netdevunref...

OSV-2018-89 Heap-use-after-free in TunnelIPv6Interface::remove_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10864 Crash type: Heap-use-after-free READ 4 Crash state: TunnelIPv6Interface::removeaddress nl::wpantund::NCPInstanceBase::unicastaddresswasremoved nl::wpantund::NCPInstanceBase::onmeshprefixwasremoved...

OSV-2018-83 Heap-buffer-overflow in encode_LEARN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12328 Crash type: Heap-buffer-overflow READ Crash state: encodeLEARN ofpactsputopenflowactions ofputilencodeflowmod...

OSV-2018-82 Heap-buffer-overflow in OT::LigatureSubstFormat1::closure

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10081 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::LigatureSubstFormat1::closure hbvoidt const OT::hbclosurecontextt::dispatch OT::hbclosurecontextt::returnt OT::LigatureSubst::dispatchOT::hbclosureco...

OSV-2018-79 Use-of-uninitialized-value in g_dbus_message_new_from_blob

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9825 Crash type: Use-of-uninitialized-value Crash state: gdbusmessagenewfromblob fuzzdbusmessage.c gdbusmessagenewfromblob...

OSV-2018-75 Heap-buffer-overflow in ref_oneandzero_unpad

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10628 Crash type: Heap-buffer-overflow READ 1 Crash state: refoneandzerounpad fuzz fuzzers.h...

OSV-2018-73 Stack-buffer-overflow in hb_array_t<char const>::cmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11908 Crash type: Stack-buffer-overflow READ 4 Crash state: hbarrayt::cmp OT::post::acceleratort::cmpkey hbbsearchr...

OSV-2018-74 Heap-use-after-free in yr_re_ast_extract_literal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11753 Crash type: Heap-use-after-free READ 4 Crash state: yrreastextractliteral yrparserwritestring yrparserreducestringdeclaration...

OSV-2018-72 Use-of-uninitialized-value in read_pbkdf2_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10143 Crash type: Use-of-uninitialized-value Crash state: readpbkdf2params gnutlsreadpkcsschemaparams pkcs8keydecrypt...

OSV-2018-70 Heap-buffer-overflow in learn_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11862 Crash type: Heap-buffer-overflow READ 2 Crash state: learncheck ofpactscheck parseofpstr...

OSV-2018-68 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12817 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber parsetables...

OSV-2018-62 Heap-buffer-overflow in parse_odp_key_mask_attr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11170 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr parseodpaction odpactionsfromstring...

OSV-2018-64 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11522 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int void hbsanitizecontextt::setobject::sanitize...

OSV-2018-61 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12312 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::OffsetTo...

OSV-2018-58 Heap-buffer-overflow in tag_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10999 Crash type: Heap-buffer-overflow READ 2 Crash state: tagparse gittagparseraw gitobjectfromraw...

OSV-2018-59 Heap-use-after-free in read_uncompressed_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10200 Crash type: Heap-use-after-free WRITE 2 Crash state: readuncompressedheader av1decodeframeheadersandsetup aomdecodeframefromobus...

OSV-2018-56 UNKNOWN READ in OT::propagate_attachment_offsets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11013 Crash type: UNKNOWN READ Crash state: OT::propagateattachmentoffsets OT::propagateattachmentoffsets OT::GPOS::positionfinishoffsets...

OSV-2018-55 Heap-buffer-overflow in ot::MeshForwarder::GetFramePriority

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11376 Crash type: Heap-buffer-overflow READ 8 Crash state: ot::MeshForwarder::GetFramePriority ot::MeshForwarder::HandleFragment ot::MeshForwarder::HandleReceivedFrame...

OSV-2018-54 UNKNOWN READ in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11305 Crash type: UNKNOWN READ Crash state: BEInt::operator short AAT::KerxSubTableFormat1::drivercontextt::transition void AAT::StateTableDriver::EntryDat...

OSV-2017-14 Use-of-uninitialized-value in Archive::ConvertFileHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4614 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertFileHeader Archive::ReadHeader15 Archive::ReadHeader...