OSV-2020-822 Use-of-uninitialized-value in jbig2_arith_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23762 Crash type: Use-of-uninitialized-value Crash state: jbig2arithdecode jbig2decoderefinementTPGRON jbig2decoderefinementregion...

OSV-2020-813 Use-of-uninitialized-value in inflate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17121 Crash type: Use-of-uninitialized-value Crash state: inflate InflateRankDims ReadNextStructField...

OSV-2020-810 Use-of-uninitialized-value in pcap_filter_with_aux_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22220 Crash type: Use-of-uninitialized-value Crash state: pcapfilterwithauxdata pcapfilter pcapofflinefilter...

OSV-2020-806 Segv on unknown address in process_ndpi_collected_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22122 Crash type: Segv on unknown address Crash state: processndpicollectedinfo packetprocessing ndpiworkflowprocesspacket...

OSV-2020-804 Use-of-uninitialized-value in read_markers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23581 Crash type: Use-of-uninitialized-value Crash state: readmarkers consumemarkers jpegconsumeinput...

OSV-2020-789 Heap-use-after-free in llvm_ks::X86Operand::getToken

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22850 Crash type: Heap-use-after-free READ 4 Crash state: llvmks::X86Operand::getToken X86AsmParser::MatchAndEmitATTInstruction X86AsmParser::MatchAndEmitInstruction...

OSV-2020-791 UNKNOWN READ in BZ2_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15639 Crash type: UNKNOWN READ Crash state: BZ2decompress BZ2bzDecompress ftbzip2filefilloutput...

OSV-2020-780 Segv on unknown address in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22676 Crash type: Segv on unknown address Crash state: ndpistrdup processndpicollectedinfo packetprocessing...

OSV-2020-774 Heap-buffer-overflow in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23021 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchkerberos checkndpiudpflowfunc ndpicheckflowfunc...

OSV-2020-748 Heap-buffer-overflow in OGR_RawField_IsUnset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23705 Crash type: Heap-buffer-overflow READ 4 Crash state: OGRRawFieldIsUnset OGRFeature::IsFieldSetAndNotNull OGRFeature::OGRFeature...

OSV-2020-739 UNKNOWN READ in str_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18756 Crash type: UNKNOWN READ Crash state: strdecref objfree mrbgcdestroy...

OSV-2020-725 Heap-buffer-overflow in walk_exports

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18321 Crash type: Heap-buffer-overflow READ 2 Crash state: walkexports getsymbols getmain...

OSV-2020-692 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18458 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::SlidingWindow WelsDec::WelsMarkAsRef...

OSV-2020-698 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18515 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf, OT::IntType ::...

OSV-2020-681 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18459 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsDelLongFromListSetUnref WelsDec::MMCOProcess...

OSV-2020-673 UNKNOWN WRITE in htp_connp_res_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19323 Crash type: UNKNOWN WRITE Crash state: htpconnpresbuffer htpconnpRESLINE htpconnpresdata...

OSV-2020-633 Global-buffer-overflow in ne_find_element

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15056 Crash type: Global-buffer-overflow READ 8 Crash state: nefindelement neparse nestegginit...

OSV-2020-624 Heap-buffer-overflow in LZ4_write32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941 Crash type: Heap-buffer-overflow WRITE 4 Crash state: LZ4write32 LZ4compressfastextState LZ4compressfast...

OSV-2020-631 Stack-use-after-return in ihevcd_process_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17500 Crash type: Stack-use-after-return READ 8 Crash state: ihevcdprocessthread startthread...

OSV-2020-605 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14232 Crash type: Global-buffer-overflow READ 4 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

OSV-2020-614 Use-of-uninitialized-value in __RefHead_ZIP_INSERT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15133 Crash type: Use-of-uninitialized-value Crash state: RefHeadZIPINSERT RefHeadZIPINSERT RefTreeadd...

OSV-2020-599 Index-out-of-bounds in prepare_macpads

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14768 Crash type: Index-out-of-bounds Crash state: preparemacpads gcrymdsetkey gcrymacsetkey...

OSV-2020-564 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17031 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcdnalunit ihevcddecode...

OSV-2020-574 Negative-size-param in r_buf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14832 Crash type: Negative-size-param Crash state: rbufread binpegetcertificate binpeinit...

OSV-2020-533 Heap-buffer-overflow in r_utf8_strlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13726 Crash type: Heap-buffer-overflow READ 1 Crash state: rutf8strlen getstr parseclass...

OSV-2020-541 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15391 Crash type: UNKNOWN READ Crash state: fini...

OSV-2020-514 UNKNOWN READ in asn1_item_print_ctx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14546 Crash type: UNKNOWN READ Crash state: asn1itemprintctx asn1templateprintctx asn1itemprintctx...

OSV-2020-410 Global-buffer-overflow in lex_multiline_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18455 Crash type: Global-buffer-overflow READ 1 Crash state: lexmultilinestring lexnext parseconfig...

OSV-2020-398 Stack-buffer-overflow in ihevcd_ref_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17029 Crash type: Stack-buffer-overflow WRITE 4 Crash state: ihevcdreflist ihevcdparsesliceheader ihevcdnalunit...

OSV-2020-360 Heap-use-after-free in read_chunks_after_idat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16081 Crash type: Heap-use-after-free READ Crash state: readchunksafteridat spngdecodeimage spngreadfuzzer.cc...

OSV-2020-374 Heap-use-after-free in wmem_strbuf_get_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17305 Crash type: Heap-use-after-free READ 8 Crash state: wmemstrbufgetstr dissectrrcPLMNIdentityWithOptionalMCCr6 dissectperconstrainedsequenceof...

OSV-2020-342 UNKNOWN READ in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19175 Crash type: UNKNOWN READ Crash state: ndpisearchkerberos checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-352 Heap-buffer-overflow in searchObjectForKeyRec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14619 Crash type: Heap-buffer-overflow READ 4 Crash state: searchObjectForKeyRec searchObjectForKeyRec searchObjectForKeyRec...

OSV-2020-343 Stack-use-after-return in ot::MeshCoP::ChannelMaskEntryBase::GetChannelPage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13741 Crash type: Stack-use-after-return READ 1 Crash state: ot::MeshCoP::ChannelMaskEntryBase::GetChannelPage ot::MeshCoP::ChannelMaskTlv::GetChannelMask ot::MeshCoP::ChannelMaskTlv::GetChannelMask...

OSV-2020-344 Heap-buffer-overflow in spng_decode_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16091 Crash type: Heap-buffer-overflow READ Crash state: spngdecodeimage spngreadfuzzer.cc...

OSV-2020-333 Heap-buffer-overflow in sas_read8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13262 Crash type: Heap-buffer-overflow READ 8 Crash state: sasread8 sas7bdatparsesubheaderpointer sas7bdatparsepagepass2...

OSV-2020-327 Heap-buffer-overflow in sas_read8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12662 Crash type: Heap-buffer-overflow READ 8 Crash state: sasread8 sas7bdatparsepagepass2 sas7bdatparseallpagespass2...

OSV-2020-289 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17147 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendNetworkData...

OSV-2020-257 Heap-use-after-free in ihevcd_jobq_lock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17553 Crash type: Heap-use-after-free READ 4 Crash state: ihevcdjobqlock ihevcdjobqyield ihevcdjobqdequeue...

OSV-2020-232 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20021 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf...

OSV-2020-214 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20437 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure Variantclear...

OSV-2020-201 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22453 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

OSV-2020-204 Negative-size-param in parquet::ColumnReaderImplBase<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20698 Crash type: Negative-size-param Crash state: parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalType parquet::arrow::LeafReader::NextBatch...

OSV-2020-179 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20832 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

OSV-2020-148 Use-of-uninitialized-value in AES_encrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23015 Crash type: Use-of-uninitialized-value Crash state: AESencrypt AESwrapkey aeswrapcipher...

OSV-2020-68 Heap-double-free in ares_parse_soa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21176 Crash type: Heap-double-free Crash state: aresparsesoareply ares-test-fuzz.c aresparsesoareply...

OSV-2020-3 UNKNOWN WRITE in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22962 Crash type: UNKNOWN WRITE Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...

OSV-2026-1297 UNKNOWN READ in janet_to_string_b

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=562551214 Crash type: UNKNOWN READ Crash state: janettostringb janetformatbv janetpanicf...

OSV-2026-1293 UNKNOWN READ in md_is_link_title

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=561822522 Crash type: UNKNOWN READ Crash state: mdislinktitle mdanalyzeinlines mdprocessnormalblockcontents...

OSV-2026-896 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=521163865 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...