4483 matches found
OSV-2022-759 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50428 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/sun.nio.cs.CESU8.updatePositions java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...
OSV-2022-743 Security exception in org.apache.commons.jxpath.ri.parser.XPathParser.MultiplicativeExpr
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50363 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.parser.XPathParser.MultiplicativeExpr org.apache.commons.jxpath.ri.parser.XPathParser.SubtractiveExpr...
OSV-2022-632 Segv on unknown address in mrb_bint_cmp
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49470 Crash type: Segv on unknown address Crash state: mrbbintcmp inteql mrbfuncallwithblock...
OSV-2022-343 Uncaught exception in com.alibaba.fastjson.JSONPath.getPropertyValue
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46696 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.JSONPath.getPropertyValue java.base/jdk.internal.math.FDBigInteger.multByPow52 java.base/jdk.internal.math.FloatingDecimal$ASCIIToBinaryBuffer.floatValue...
OSV-2022-281 Heap-use-after-free in jsmn_parse
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45984 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...
OSV-2022-279 Heap-double-free in flb_pack_state_reset
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45978 Crash type: Heap-double-free Crash state: flbpackstatereset inlibcollect flbinputcollectorfd...
OSV-2022-254 Heap-use-after-free in jsmn_parse
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45651 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...
OSV-2022-191 Heap-buffer-overflow in ndpi_handle_ipv6_extension_headers
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44942 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpihandleipv6extensionheaders ndpiworkflowprocesspacket fuzzndpireader.c...
OSV-2022-150 Heap-buffer-overflow in coap_split_uri_sub
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44611 Crash type: Heap-buffer-overflow READ 1 Crash state: coapspliturisub coapgeturipath...
OSV-2022-11 Heap-buffer-overflow in dhcp_reply
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43300 Crash type: Heap-buffer-overflow WRITE Crash state: dhcpreply dhcppacket FuzzDhcp...
OSV-2021-1758 Heap-buffer-overflow in seturl
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42892 Crash type: Heap-buffer-overflow READ Crash state: seturl parseurl curlurlset...
OSV-2021-1636 Stack-buffer-overflow in MatchRule
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41504 Crash type: Stack-buffer-overflow READ 1 Crash state: MatchRule TranslateRules TranslateWord3...
OSV-2021-1633 Heap-buffer-overflow in mk_string_copy_substr
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41448 Crash type: Heap-buffer-overflow READ Crash state: mkstringcopysubstr mkrconfread mkrconfopen...
OSV-2021-1631 Stack-buffer-overflow in TranslateNumber
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41437 Crash type: Stack-buffer-overflow READ 1 Crash state: TranslateNumber TranslateWord3 TranslateWord...
OSV-2021-1605 Heap-use-after-free in perfetto::trace_processor::SliceTracker::GetStackHash
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41226 Crash type: Heap-use-after-free READ 8 Crash state: perfetto::traceprocessor::SliceTracker::GetStackHash perfetto::traceprocessor::SliceTracker::StartSlice perfetto::traceprocessor::SliceTracker::Scoped...
OSV-2021-1479 Heap-buffer-overflow in hufDecode
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40231 Crash type: Heap-buffer-overflow READ 1 Crash state: hufDecode internalhufdecompress internalexrundopiz...
OSV-2021-1449 UNKNOWN WRITE in void QtPrivate::QPodArrayOps<QPainterPath::Element>::emplace<QPainterPath::Eleme
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39957 Crash type: UNKNOWN WRITE Crash state: void QtPrivate::QPodArrayOps::emplaceQPainterPath::Eleme QPainterPath::lineTo QOutlineMapper::clipElements...
OSV-2021-1387 Container-overflow in std::__1::__function::__func<LLVMFuzzerTestOneInput::$_0, std::__1::allocator<LL
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39335 Crash type: Container-overflow READ 1 Crash state: std::1::function::func, std:: std::1::function::funcLLVMFuzzerTestOneInput::$1, std::1::allocatorLL...
OSV-2021-1238 UNKNOWN READ in cdf_read_property_info
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38393 Crash type: UNKNOWN READ Crash state: cdfreadpropertyinfo cdfunpacksummaryinfo cdfchecksummaryinfo...
OSV-2021-1186 Segv on unknown address in helper_uc_tracecode
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37856 Crash type: Segv on unknown address Crash state: helpeructracecode...
OSV-2021-1083 Heap-buffer-overflow in flb_hash_get_by_id
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36718 Crash type: Heap-buffer-overflow READ Crash state: flbhashgetbyid utilsfuzzer.c...
OSV-2021-841 Heap-use-after-free in AK::StringImpl::create
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34973 Crash type: Heap-use-after-free READ Crash state: AK::StringImpl::create AK::String::String AK::URLParser::parsedataurl...
OSV-2021-822 Heap-buffer-overflow in AK::Formatter<char const*, void>::format
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34863 Crash type: Heap-buffer-overflow READ 3 Crash state: AK::Formatter::format void AK::formatvalue AK::vformatimpl...
OSV-2021-808 Global-buffer-overflow in DoEmbedded2
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34718 Crash type: Global-buffer-overflow READ 4 Crash state: DoEmbedded2 CalcLengths SpeakNextClause...
OSV-2021-702 Heap-double-free in flb_free
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33750 Crash type: Heap-double-free Crash state: flbfree flbparserjsondo flbparserdo...
OSV-2021-678 UNKNOWN WRITE in CompileBlock
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33555 Crash type: UNKNOWN WRITE Crash state: CompileBlock CompileLoopOrBlock CompileBlockStatements...
OSV-2021-607 Heap-buffer-overflow in TextPool::getPool
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32952 Crash type: Heap-buffer-overflow READ 8 Crash state: TextPool::getPool TextPage::coalesce TextOutputDev::endPage...
OSV-2021-600 Heap-buffer-overflow in gif_internal_decode_frame
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32855 Crash type: Heap-buffer-overflow WRITE Crash state: gifinternaldecodeframe gifdecodeframe vipsforeignloadnsgifgenerate...
OSV-2021-573 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32555 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::RangeRecord::intersects...
OSV-2021-503 Use-after-poison in std::__1::unique_ptr<SkSL::Expression, std::__1::default_delete<SkSL::Expression
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31765 Crash type: Use-after-poison READ 8 Crash state: std::1::uniqueptrSkSL::Expression, std::1::defaultdeleteSkSL::Expression SkSL::DefinitionMap::getKnownDefinition SkSL::VariableReference::constantPropagate...
OSV-2021-443 Segv on unknown address in Imf_2_5::copyIntoFrameBuffer
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31293 Crash type: Segv on unknown address Crash state: Imf25::copyIntoFrameBuffer Imf25::LineBufferTask::execute IlmThread::NullThreadPoolProvider::addTask...
OSV-2021-430 Stack-buffer-overflow in tvb_memcpy
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31198 Crash type: Stack-buffer-overflow WRITE Crash state: tvbmemcpy compositememcpy tvbgetnstringz...
OSV-2021-386 Stack-buffer-overflow in ot::Coap::Message::AppendUintOption
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30831 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::Coap::Message::AppendUintOption ot::Coap::Message::AppendBlockOption otCoapMessageAppendBlock2Option...
OSV-2021-371 Heap-buffer-overflow in frame_get_lazychunk
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30772 Crash type: Heap-buffer-overflow READ 4 Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...
OSV-2021-282 Heap-buffer-overflow in LibRaw_buffer_datastream::read
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30324 Crash type: Heap-buffer-overflow WRITE Crash state: LibRawbufferdatastream::read LibRaw::uncompressedfpdngloadraw LibRaw::unpack...
OSV-2020-2303 Use-of-uninitialized-value in Splash::pipeRunSimpleXBGR8
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29651 Crash type: Use-of-uninitialized-value Crash state: Splash::pipeRunSimpleXBGR8 Splash::drawSpan Splash::fillWithPattern...
OSV-2016-4 Global-buffer-overflow in vte_write_debug
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=174 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug doexecute doaction...
OSV-2018-426 UNKNOWN READ in jpx_read_image
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8866 Crash type: UNKNOWN READ Crash state: jpxreadimage fzloadjpx pdfloadjpx...
OSV-2018-301 Use-of-uninitialized-value in fz_paint_triangle
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5641 Crash type: Use-of-uninitialized-value Crash state: fzpainttriangle dopainttri fzprocessshadetype4...
OSV-2018-284 Stack-buffer-overflow in pdf_lookup_cmap_full
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5494 Crash type: Stack-buffer-overflow WRITE 4 Crash state: pdflookupcmapfull pdfremapcmaprange pdfremapcmap...
OSV-2018-274 Use-of-uninitialized-value in pdf_lex
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5600 Crash type: Use-of-uninitialized-value Crash state: pdflex pdfprocessstream pdfprocesscontents...
OSV-2018-237 Use-of-uninitialized-value in sfnt_open_font
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5603 Crash type: Use-of-uninitialized-value Crash state: sfntopenfont sfntinitface ttfaceinit...
OSV-2017-109 Use-of-uninitialized-value in Unpack::MakeDecodeTables
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4298 Crash type: Use-of-uninitialized-value Crash state: Unpack::MakeDecodeTables Unpack::ReadTables20 Unpack::Unpack20...
OSV-2017-110 Use-of-uninitialized-value in ExtractUnixLink30
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4309 Crash type: Use-of-uninitialized-value Crash state: ExtractUnixLink30 ExtractSymlink CmdExtract::ExtractCurrentFile...
OSV-2017-66 UNKNOWN READ in cfree
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4561 Crash type: UNKNOWN READ Crash state: cfree copyAttributeIntoNode UAServereditNode...
OSV-2017-58 Heap-use-after-free in UA_Array_copy
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4300 Crash type: Heap-use-after-free READ Crash state: UAArraycopy copynoInit NodeIdcopy...
OSV-2017-55 Heap-double-free in ExtensionObject_deleteMembers
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4296 Crash type: Heap-double-free Crash state: ExtensionObjectdeleteMembers UAArraydelete ArraydecodeBinary...
OSV-2018-179 Heap-buffer-overflow in OT::post::accelerator_t::cmp_gids
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11290 Crash type: Heap-buffer-overflow READ 5 Crash state: OT::post::acceleratort::cmpgids sortrcmpswap sortrsimple...
OSV-2018-160 Heap-buffer-overflow in do_uncompress_block
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11011 Crash type: Heap-buffer-overflow WRITE 1 Crash state: douncompressblock processblock douncompressfile...