graphicsmagick/coder_DPX_fuzzer: Use-of-uninitialized-value in RGBTransformPackets

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5966363016298496 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderDPXfuzzer Fuzz target binary: coderDPXfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

gdal/gdal_fuzzer: Heap-buffer-overflow in PCIDSK::CPCIDSKGeoref::Load

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5443800485855232 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address:...

imagemagick/enhance_fuzzer: Use-of-uninitialized-value in EnhanceImage

Detailed report: https://oss-fuzz.com/testcase?key=5747783507116032 Project: imagemagick Fuzzer: libFuzzerimagemagickenhancefuzzer Fuzz target binary: enhancefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: EnhanceImag...

graphicsmagick/coder_DPX_fuzzer: Use-of-uninitialized-value in WriteDPXImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5116678160515072 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderDPXfuzzer Fuzz target binary: coderDPXfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

It was found that fix for CVE-2018-1088 introduced a new vulnerability in the way 'auth.allow' is implemented in glusterfs server. An unauthenticated gluster client could mount gluster storage volumes...

glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

It was found that fix for CVE-2018-1088 introduced a new vulnerability in the way 'auth.allow' is implemented in glusterfs server. An unauthenticated gluster client could mount gluster storage volumes...

imagemagick/encoder_heic_fuzzer: Use-of-uninitialized-value in void edge_filtering_luma_internal<unsigned char>

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5683349635989504 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderheicfuzzer Fuzz target binary: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

New Relic: User is able to access and create private synthetics locations without upgrading (regression of #276157)

It seems like the fix done for 276157 wasn't enough, as I'm able to bypass it and generate private synthetics locations without approval or the proper plan. This is the page that users see when they navigate to the private synthetics location: F291890 I'm able bypass this by navigating as an Admi...

imagemagick/encoder_heic_fuzzer: Heap-buffer-overflow in ReadHEICImage

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5459741290528768 Project: imagemagick Fuzzer: aflimagemagickencoderheicfuzzer Fuzz target binary: encoderheicfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

imagemagick/encoder_heic_fuzzer: Use-of-uninitialized-value in transform_4x4_luma_add_8_fallback

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5475693403045888 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderheicfuzzer Fuzz target binary: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

graphicsmagick/coder_XPM_fuzzer: Use-of-uninitialized-value in StringToListMod

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=4901535598247936 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderXPMfuzzer Fuzz target binary: coderXPMfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

graphicsmagick/coder_DPX_fuzzer: Use-of-uninitialized-value in WriteDPXImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5665839926738944 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderDPXfuzzer Fuzz target binary: coderDPXfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

libreoffice/ww6fuzzer: Stack-use-after-return in SwIndex::Init

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5465364275134464 Project: libreoffice Fuzzer: libFuzzerlibreofficeww6fuzzer Fuzz target binary: ww6fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

wget/wget_css_fuzzer: Heap-buffer-overflow in xstrndup

Project: https://git.savannah.gnu.org/git/wget.git Detailed report: https://oss-fuzz.com/testcase?key=6600180399865856 Project: wget Fuzzer: libFuzzerwgetcssfuzzer Fuzz target binary: wgetcssfuzzer Job Type: libfuzzerasanwget Platform Id: linux Crash Type: Heap-buffer-overflow READ 11 Crash...

envoy/server_fuzz_test: Heap-use-after-free in Envoy::Upstream::SubsetLoadBalancer::updateFallbackSubset

Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5705154446753792 Project: envoy Fuzzer: libFuzzerenvoyserverfuzztest Fuzz target binary: serverfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash...

curl/curl_fuzzer_http: Crash in http2_send

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=5998841491881984 Project: curl Fuzzer: libFuzzercurlfuzzerhttp Fuzz target binary: curlfuzzerhttp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x608000010000 Cras...

imagemagick/encoder_heic_fuzzer: Heap-buffer-overflow in ff_hevc_put_hevc_qpel_pixels_8_sse

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5358449251581952 Project: imagemagick Fuzzer: aflimagemagickencoderheicfuzzer Fuzz target binary: encoderheicfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

wireshark/fuzzshark_ip_proto-udp: Heap-buffer-overflow in dissect_ber_constrained_bitstring

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=4859050050191360 Project: wireshark Fuzzer: aflwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: aflasanwireshark Platform Id: linux Crash Type:...

CVE-2018-1112

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression...

curl/curl_fuzzer_rtsp: Heap-buffer-overflow in curl_mvsnprintf

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=5203560919728128 Project: curl Fuzzer: aflcurlfuzzerrtsp Fuzz target binary: curlfuzzerrtsp Job Type: aflasancurl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x606000000539...