OSV-2021-1183 UNKNOWN WRITE in draco::DepthFirstTraverser<draco::CornerTable, draco::MeshAttributeIndicesEncodi

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37864 Crash type: UNKNOWN WRITE Crash state: draco::DepthFirstTraverserdraco::CornerTable, draco::MeshAttributeIndicesEncodi draco::MeshTraversalSequencerdraco::DepthFirstTraverserdraco::CornerTable, dra...

OPENSUSE-SU-2021:1168-1 Security update for c-ares

This update for c-ares fixes the following issues: Version update to git snapshot 1.17.1+20200724: - CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers bsc1188881 - If aresgetaddrinfo was terminated by an aresdestroy, it would cause crash - Crash in sortaddrinfo if...

OSV-2021-1137 Uncaught exception in com.alibaba.fastjson.parser.DefaultJSONParser.parseObject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37237 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.parser.DefaultJSONParser.parseObject java.base/java.util.HashMap.tableSizeFor java.base/java.util.HashMap...

CVE-2021-33056

Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message...

Belledonne Belle-sip 环境问题漏洞

Belledonne Belle-sip is a library that implements the SIP RFC 3261 transport, transaction, and conversation layers from Belledonne, France. A security vulnerability exists in Belledonne Belle-sip versions prior to 4.5.20, which stems from invalid information in SIP message headers, and can be...

Denial Of Service (DoS)

firefox is vulnerable to denial of service. An exploitable crash is possible from incorrect instruction reordering during JIT optimization...

OSV-2021-1027 Index-out-of-bounds in sd_read_byte

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36240 Crash type: Index-out-of-bounds Crash state: sdreadbyte sdbusreaddata sdhcireadblockfromcard...

OSV-2021-899 Heap-buffer-overflow in synth_name_to_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35548 Crash type: Heap-buffer-overflow READ 8 Crash state: synthnametopath v9fsconametopath v9fscompleterename...

Heap-based Buffer Overflow in rup0rt/pcapfix

Description A heap over flow was found in pcapfix in function fixpcapng in pcapng.c at line 1571 Test version : 1.1.6 2fe168e Test env: gcc 9.3.0 ubuntu 20.04 x86-64 Proof of Concept CFLAGS="-fsanitize=address" make ./pcapfix poc poc is attatched in reference link c ==618350==ERROR:...

Heap-based Buffer Overflow in rup0rt/pcapfix

Description A heap over flow was found in pcapfix in function fixpcapng in pcapng.c at line 216 Test version : 1.1.6 2fe168e Test env: gcc 9.3.0 ubuntu 20.04 x86-64 Proof of Concept CFLAGS="-fsanitize=address" make ./pcapfix poc poc is attatched in reference link c ==603793==ERROR:...

Regular Expression Denial Of Service (ReDoS)

color-string is vulnerable to regular expression denial of service. An attacker parsing a malicious crafted string that consist of more than 5000 characters into the hwb or hsl function will cause the system to crash...

Heap-based Buffer Overflow in squell/id3

✍️ Description When running the id3 app built from commit 51e738 with Clang 13 +ASan on Ubuntu 20.04.2 against the test data file encoding.tag, a heap-buffer-overflow is triggered at https://github.com/squell/id3/blob/51e738e7575c54fd7fdd54c931a155b25c3f2d30/id3v2.cL104. static ulong ul4uchar n4...

OSV-2021-811 Segv on unknown address in GetASNHeader_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34719 Crash type: Segv on unknown address Crash state: GetASNHeaderex GetASNHeader GetASNInt...

Stack-based Buffer Overflow in codeplea/tinyexpr

✍️ Description Whilst experimenting with repl built from commit 61af1d, with Clang 10 +ASan on Ubuntu 20.04.2 LTS, we discovered an expression containing 4 null characters after a newline which, due to insufficient bounds checking, triggers a stack-buffer-overflow. 🕵️‍♂️ Proof of Concept echo...

OSV-2021-727 UNKNOWN READ in MEM_read32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33956 Crash type: UNKNOWN READ Crash state: MEMread32 ZSTDcompressBlockgreedyextDictrow ZSTDldmblockCompress...

CVE-2020-7731

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

OSV-2021-688 Segv on unknown address in std::__Fuzzer::basic_string<char, std::__Fuzzer::char_traits<char>, std::__Fuzze

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33682 Crash type: Segv on unknown address Crash state: std::Fuzzer::basicstring, std::Fuzze std::Fuzzer::moneypunctbyname::init...

Exiv2 Out-of-Bounds Read Vulnerability

Exiv2 is a cross-platform C++ library and command line utility for managing image metadata. Exiv2 0.27.3 and earlier versions have an out-of-bounds read vulnerability when writing metadata to specially crafted image files. An attacker could exploit this vulnerability via a specially crafted image...

Denial of service vulnerability in c-aff4

c-aff4 is an open source format for storing digital evidence and data. A denial of service vulnerability exists in c-aff4. An attacker could exploit the vulnerability to cause a software crash...

CVE-2021-3443

A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened...