OSV-2023-185 Global-buffer-overflow in xmlNextChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57073 Crash type: Global-buffer-overflow READ 1 Crash state: xmlNextChar htmlParseStartTag htmlParseChunk...

OSV-2023-151 UNKNOWN READ in mrb_vm_find_method

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56687 Crash type: UNKNOWN READ Crash state: mrbvmfindmethod mrbvmexec mrbvmrun...

OSV-2023-117 Heap-buffer-overflow in isvcd_nal_byte_swap_emulation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56386 Crash type: Heap-buffer-overflow WRITE 4 Crash state: isvcdnalbyteswapemulation isvcdnalparsenonvclnal isvcdpreparserefineau...

OSV-2023-28 Heap-buffer-overflow in sas_read2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55308 Crash type: Heap-buffer-overflow READ 2 Crash state: sasread2 sas7bcatparseblock readstatparsesas7bcat...

OSV-2023-14 Stack-buffer-overflow in AffixMgr::compound_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55191 Crash type: Stack-buffer-overflow READ 1 Crash state: AffixMgr::compoundcheck SuggestMgr::checkword SuggestMgr::testsug...

OSV-2022-1175 Stack-buffer-overflow in sc_path_print

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53417 Crash type: Stack-buffer-overflow READ 1 Crash state: scpathprint scselectfile scpkcs15initrmdir...

OSV-2022-1173 Heap-buffer-overflow in parse_content_length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53397 Crash type: Heap-buffer-overflow READ 1 Crash state: parsecontentlength gethdrfield parseheaders...

OSV-2022-1165 Heap-buffer-overflow in parse_content_length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53199 Crash type: Heap-buffer-overflow READ 1 Crash state: parsecontentlength gethdrfield parseheaders...

OSV-2022-1154 UNKNOWN READ in pcpp::SomeIpSdLayer::SomeIpSdLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53099 Crash type: UNKNOWN READ Crash state: pcpp::SomeIpSdLayer::SomeIpSdLayer pcpp::SomeIpLayer::parseSomeIpLayer pcpp::UdpLayer::parseNextLayer...

OSV-2022-1120 Heap-use-after-free in xmlXIncludeDoProcess

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52869 Crash type: Heap-use-after-free READ 4 Crash state: xmlXIncludeDoProcess xmlXIncludeProcessNode xmlTextReaderRead...

OSV-2022-1068 UNKNOWN READ in fp_cmp_mag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52565 Crash type: UNKNOWN READ Crash state: fpcmpmag crtmgrtrustlistlookup crtmgradd...

OSV-2022-1015 Heap-use-after-free in msFreeMap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52102 Crash type: Heap-use-after-free READ 8 Crash state: msFreeMap msLoadMap mapfuzzer.c...

OSV-2022-983 Heap-buffer-overflow in SkPathPriv::IsRectContour

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51909 Crash type: Heap-buffer-overflow READ 4 Crash state: SkPathPriv::IsRectContour SkPath::isRect SkCanvas::clipPath...

OSV-2022-981 Heap-buffer-overflow in SkPath::Iter::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51915 Crash type: Heap-buffer-overflow READ 8 Crash state: SkPath::Iter::next SkStroke::strokePath SkStrokeRec::applyToPath...

OSV-2022-878 Heap-double-free in flb_sds_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51132 Crash type: Heap-double-free Crash state: flbsdsdestroy flbparserconffile configrandomfuzzer.c...

OSV-2022-710 Heap-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50099 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcfffont...

OSV-2022-664 Heap-buffer-overflow in decode_preR13_section_hdr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49675 Crash type: Heap-buffer-overflow WRITE 4 Crash state: decodepreR13sectionhdr decodepreR13 dwgdecode...

OSV-2022-651 Heap-use-after-free in jsmn_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49552 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...

OSV-2022-644 Global-buffer-overflow in decode_CABAC_bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49538 Crash type: Global-buffer-overflow READ 1 Crash state: decodeCABACbit readcodingunit readcodingquadtree...

OSV-2022-643 Heap-use-after-free in gs_tifsSeekProc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49528 Crash type: Heap-use-after-free READ 8 Crash state: gstifsSeekProc TIFFWriteDirectorySec TIFFRewriteDirectory...

OSV-2022-624 Heap-buffer-overflow in Assimp::MD5::MD5Parser::ParseHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49422 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::MD5::MD5Parser::ParseHeader Assimp::MD5::MD5Parser::MD5Parser Assimp::MD5Importer::LoadMD5MeshFile...

OSV-2022-606 Heap-buffer-overflow in mrb_bint_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49282 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbbintadd mrbintadd intadd...

OSV-2022-523 Segv on unknown address in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48528 Crash type: Segv on unknown address Crash state: chunkfreeobject gxttfMemoryfree ContextDestroy...

OSV-2022-493 Segv on unknown address in jxl::N_AVX2::XYBStage<jxl::N_AVX2::PerChannelOp<jxl::N_AVX2::Op709> >::ProcessRo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48132 Crash type: Segv on unknown address Crash state: jxl::NAVX2::XYBStage ::ProcessRo jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-455 Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47796 Crash type: Uncaught exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.lang.String.getChars java.base/java.io.StringReader.read...

OSV-2022-450 Heap-buffer-overflow in Curl_headers_push

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47767 Crash type: Heap-buffer-overflow WRITE 5 Crash state: Curlheaderspush Curlclientwrite Curlhttpreadwriteheaders...

OSV-2022-415 UNKNOWN READ in pdfi_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47499 Crash type: UNKNOWN READ Crash state: pdfifreeobject pdficlearcontext pdfifreecontext...

OSV-2022-413 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47483 Crash type: Heap-buffer-overflow READ 4 Crash state: genericunpack exrdecodingrun Imf32::checkCoreFile...

OSV-2022-410 Heap-buffer-overflow in Assimp::ASE::Parser::ParseLV1SoftSkinBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47392 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::ASE::Parser::ParseLV1SoftSkinBlock Assimp::ASE::Parser::Parse Assimp::ASEImporter::InternReadFile...

OSV-2022-400 Heap-double-free in dwg_free_XRECORD_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300 Crash type: Heap-double-free Crash state: dwgfreeXRECORDprivate dwgfreeXRECORD dwgfreeobject...

OSV-2022-388 Segv on unknown address in dwg_ref_get_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47151 Crash type: Segv on unknown address Crash state: dwgrefgetobject dwggeojsonfeature dwggeojsonobject...

OSV-2022-377 Heap-buffer-overflow in decode_preR13_section_hdr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46983 Crash type: Heap-buffer-overflow WRITE 4 Crash state: decodepreR13sectionhdr decodepreR13 dwgdecode...

OSV-2022-367 Segv on unknown address in jxl::N_SSE4::WriteToU8Stage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46915 Crash type: Segv on unknown address Crash state: jxl::NSSE4::WriteToU8Stage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-363 Heap-use-after-free in dwg_free_TABLEGEOMETRY_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46847 Crash type: Heap-use-after-free READ 8 Crash state: dwgfreeTABLEGEOMETRYprivate dwgfreeTABLEGEOMETRY dwgfreevariablenoclass...

OSV-2022-270 Stack-buffer-overflow in fn_ElIn_evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45886 Crash type: Stack-buffer-overflow WRITE 4 Crash state: fnElInevaluate pdfisettransfer GSTR...

OSV-2022-259 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45671 Crash type: Heap-double-free Crash state: readconfig readglob readconfig...

OSV-2022-248 Uncaught exception in java.base/java.nio.Bits.reserveMemory

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45563 Crash type: Uncaught exception Crash state: java.base/java.nio.Bits.reserveMemory java.base/java.nio.DirectByteBuffer. java.base/java.nio.ByteBuffer.allocateDirect...

OSV-2022-245 Heap-buffer-overflow in grk::PacketIter::genPrecinctInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45548 Crash type: Heap-buffer-overflow READ 4 Crash state: grk::PacketIter::genPrecinctInfo grk::PacketManager::PacketManager grk::T2Decompress::decompressPackets...

OSV-2022-218 UNKNOWN READ in pdfi_read_cff_font

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45222 Crash type: UNKNOWN READ Crash state: pdfireadcfffont pdfiloadfont pdfireadtype0font...

OSV-2022-181 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44885 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2022-149 Heap-buffer-overflow in read_xref_stream_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44610 Crash type: Heap-buffer-overflow WRITE 8 Crash state: readxrefstreamentries pdfiprocessxrefstream pdfireadxrefstreamdict...

OSV-2022-134 Heap-use-after-free in RDKit::Chirality::cleanupStereoGroups

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44520 Crash type: Heap-use-after-free READ 1 Crash state: RDKit::Chirality::cleanupStereoGroups RDKit::MolOps::assignStereochemistry RDKit::SmilesToMol...

OSV-2022-129 Heap-buffer-overflow in dwg_free_HATCH_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44481 Crash type: Heap-buffer-overflow READ 8 Crash state: dwgfreeHATCHprivate dwgfreeHATCH dwgfreeobject...

OSV-2022-97 Heap-buffer-overflow in gs_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44123 Crash type: Heap-buffer-overflow WRITE 16 Crash state: gsinterpret gsmainrunstringwithlength gsmainrunstring...

OSV-2021-1806 Stack-buffer-overflow in pdfi_open_CIDFont_substitute_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44034 Crash type: Stack-buffer-overflow WRITE Crash state: pdfiopenCIDFontsubstitutefile pdfiloadfont pdfireadtype0font...

OSV-2022-33 Heap-buffer-overflow in ndlz8_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43519 Crash type: Heap-buffer-overflow READ 8 Crash state: ndlz8decompress bloscd dojob...

OSV-2022-3 UNKNOWN READ in pdfi_free_array

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43255 Crash type: UNKNOWN READ Crash state: pdfifreearray pdfifreeobject pdfifreedict...

OSV-2022-1 Heap-use-after-free in pdfi_dereference

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43268 Crash type: Heap-use-after-free READ 4 Crash state: pdfidereference pdfidictnext pdficheckResources...

OSV-2021-1748 Heap-buffer-overflow in jxl::N_AVX2::FloatToRGBA8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42839 Crash type: Heap-buffer-overflow WRITE 1 Crash state: jxl::NAVX2::FloatToRGBA8 jxl::FinalizeImageRect jxl::ThreadPool::RunCallStatejxl::FinalizeFrameDecoding...

OSV-2021-1695 Heap-buffer-overflow in flexbuffers::Verifier::VerifyRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42373 Crash type: Heap-buffer-overflow READ 4 Crash state: flexbuffers::Verifier::VerifyRef flexbuffers::Verifier::VerifyVector flexbuffers::Verifier::VerifyRef...