OSV-2020-244 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20036 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::IndexArray::addindexesto...

OSV-2020-233 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20022 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-149 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator=

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21580 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::operator= OT::IntType::operator= bool OT::ClassDefFormat1::serializehbzipiterthbsortedarraytOT::HBGlyphI...

OSV-2020-107 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20944 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::gvar::getoffset...

OSV-2020-16 Heap-use-after-free in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20906 Crash type: Heap-use-after-free READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::GlyphVarData::hasdata...

harfbuzz/hb-subset-get-codepoints-fuzzer: Use-of-uninitialized-value in OT::OffsetTo<OT::ArrayOfM1<OT::ResourceTypeRecord, OT::IntType<unsigned short, 2

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5736539338833920 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-get-codepoints-fuzzer Fuzz target binary: hb-subset-get-codepoints-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux...

harfbuzz/hb-subset-fuzzer: Stack-use-after-return in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5669437462544384 Project: harfbuzz Fuzzer: aflharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Stack-use-after-return READ 1...

Debian Security Advisory DSA 1137-1 (tiff)

The remote host is missing an update to tiff announced via advisory DSA 1137-1. Tavis Ormandy of the Google Security Team discovered several problems in the TIFF library. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2006-3459 Several stack-buffer overflows...

CVE-2006-3463

The EstimateStripByteCounts function in TIFF library libtiff before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial of service via a large tdnstrips value, which triggers an infinite loop...

DSA-1137-1 tiff - several vulnerabilities

Bulletin has no description...