CVE-2017-5651

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in t...

imagemagick:crop_fuzzer: Use-of-uninitialized-value in LibRaw::open_datastream

Detailed Report: https://oss-fuzz.com/testcase?key=5724383278792704 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: cropfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::opendatastream LibRaw::openfi...

quickjs:fuzz_compile: Heap-use-after-free in JS_ReadObjectRec

Project: https://github.com/horhof/quickjs.git https://github.com/bellard/quickjs.git Detailed Report: https://oss-fuzz.com/testcase?key=5676100190732288 Project: quickjs Fuzzing Engine: honggfuzz Fuzz Target: fuzzcompile Job Type: honggfuzzasanquickjs Platform Id: linux Crash Type:...

ffmpeg:ffmpeg_BSF_TRACE_HEADERS_fuzzer: Index-out-of-bounds in cbs_jpeg_read_dht

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5766121576988672 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFTRACEHEADERSfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_G2M_fuzzer: Index-out-of-bounds in epic_decode_run_length

Detailed Report: https://oss-fuzz.com/testcase?key=5199357982015488 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDG2Mfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: epicdecoderunlength epicdecodetile...

arrow:parquet-arrow-fuzz: Heap-buffer-overflow in virtual thunk to parquet::ByteStreamSplitDecoder<parquet::PhysicalType<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4890562181464064 Project: arrow Fuzzing Engine: afl Fuzz Target: parquet-arrow-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60f0000003df Crash...

llvm:llvm-isel-fuzzer--wasm32-O2: Use-of-uninitialized-value in llvm::TargetOptions::ShouldEmitDebugEntryValues

Detailed Report: https://oss-fuzz.com/testcase?key=5693528329158656 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-isel-fuzzer--wasm32-O2 Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

sqlite3:ossfuzz: Use-of-uninitialized-value in sqlite3Atoi64

Detailed Report: https://oss-fuzz.com/testcase?key=5676952943067136 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sqlite3Atoi64 computeNumericType numericType...

mysql-server:fuzz_docommand: Heap-buffer-overflow in acl_authenticate

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=5755547623358464 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzdocommand Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

gnutls:gnutls_psk_client_fuzzer: Use-of-uninitialized-value in __gmpz_clear

Project: https://gitlab.com/gnutls/gnutls.git Detailed Report: https://oss-fuzz.com/testcase?key=6296663875649536 Project: gnutls Fuzzing Engine: libFuzzer Fuzz Target: gnutlspskclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cra...

openvswitch:odp_target: Use-of-uninitialized-value in format_u8x

Detailed Report: https://oss-fuzz.com/testcase?key=5717478543196160 Project: openvswitch Fuzzing Engine: libFuzzer Fuzz Target: odptarget Job Type: libfuzzermsanopenvswitch Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: formatu8x formatodptungtpuopt...

matio:matio_fuzzer: Heap-buffer-overflow in ReadInt32DataDouble

Detailed Report: https://oss-fuzz.com/testcase?key=5668218489536512 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzerasani386matio Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0xf29ff7fc Crash State: ReadInt32DataDouble ReadInt32Da...

ghostscript:gstoraster_fuzzer: Segv on unknown address in s_DCTD_process

Detailed Report: https://oss-fuzz.com/testcase?key=5631964637036544 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: sDCTDprocess sreadbuf...

imagemagick:enhance_fuzzer: Use-of-uninitialized-value in EnhanceImage

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5633720850841600 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: enhancefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

libcbor:cbor_load_fuzzer: Segv on unknown address in cbor_typeof

Project: https://github.com/PJK/libcbor.git Detailed Report: https://oss-fuzz.com/testcase?key=5666344138964992 Project: libcbor Fuzzing Engine: afl Fuzz Target: cborloadfuzzer Job Type: aflasanlibcbor Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: cbortypeof...

libcbor:cbor_load_fuzzer: Segv on unknown address in cbor_decref

Project: https://github.com/PJK/libcbor.git Detailed Report: https://oss-fuzz.com/testcase?key=5650964532166656 Project: libcbor Fuzzing Engine: afl Fuzz Target: cborloadfuzzer Job Type: aflasanlibcbor Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: cbordecref...

libreoffice:ww6fuzzer: Heap-use-after-free in SfxItemSet::Count

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5128759322869760 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: ww6fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_netbios_name_interpret

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5184066036170752 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6040000000ba...

Flaw in `realloc` allows reading unknown memory

When reallocing, if we allocate new space, we need to copy the old allocation's bytes into the new space. There are oldsize number of bytes in the old allocation, but we were accidentally copying newsize number of bytes, which could lead to copying bytes into the realloc'd space from past the chu...

USN-4134-3: IBus vulnerability

USN-4134-1 fixed a vulnerability in IBus. The update caused a regression in some Qt applications and the fix was subsequently reverted in USN-4134-2. The regression has since been resolved and so this update fixes the original vulnerability. We apologize for the inconvenience. Original advisory...