OSV-2023-328 Heap-buffer-overflow in RegionItem::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58152 Crash type: Heap-buffer-overflow READ 1 Crash state: RegionItem::parse heif::HeifContext::interpretheiffile heif::HeifContext::read...

OSV-2023-322 Use-after-poison in str_new_frozen_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58079 Crash type: Use-after-poison READ 8 Crash state: strnewfrozenbuffer fstrupdatecallback rbstupdate...

OSV-2023-285 Stack-buffer-overflow in fn_ElIn_evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57745 Crash type: Stack-buffer-overflow WRITE 4 Crash state: fnElInevaluate pdfisetblackgeneration GSBG...

OSV-2023-182 Heap-buffer-overflow in FLAC__bitwriter_write_rice_signed_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57071 Crash type: Heap-buffer-overflow WRITE 4 Crash state: FLACbitwriterwritericesignedblock addresidualpartitionedrice FLACsubframeaddfixed...

OSV-2023-156 Heap-use-after-free in HashMgr::add_word

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56737 Crash type: Heap-use-after-free READ 2 Crash state: HashMgr::addword HashMgr::loadtables HashMgr::HashMgr...

OSV-2023-152 UNKNOWN READ in dissect_oran_c_section

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56724 Crash type: UNKNOWN READ Crash state: dissectorancsection dissectoran calldissectorwork...

OSV-2023-119 Use-of-uninitialized-value in rename_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56401 Crash type: Use-of-uninitialized-value Crash state: renameprocess safeforkfull parsetimestamp...

OSV-2023-118 Heap-use-after-free in mrb_gc_mark

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56406 Crash type: Heap-use-after-free READ 4 Crash state: mrbgcmark mrbgcmarkiv gcmarkchildren...

OSV-2023-107 Heap-buffer-overflow in DecodeBasicOcspResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56308 Crash type: Heap-buffer-overflow READ Crash state: DecodeBasicOcspResponse OcspResponseDecode ocsp.c...

OSV-2023-104 Heap-buffer-overflow in H5FS__sect_link

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56234 Crash type: Heap-buffer-overflow READ 8 Crash state: H5FSsectlink H5FSsectadd H5MFaddsect...

OSV-2023-90 Heap-buffer-overflow in LibRaw_buffer_datastream::scanf_one

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56160 Crash type: Heap-buffer-overflow READ 1 Crash state: LibRawbufferdatastream::scanfone LibRaw::parsemos LibRaw::parsetiffifd...

OSV-2023-66 Heap-buffer-overflow in mosquitto__strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56008 Crash type: Heap-buffer-overflow READ Crash state: mosquittostrdup configreadfilecore configreadfile...

OSV-2023-13 Heap-buffer-overflow in wc_AesCbcEncrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55161 Crash type: Heap-buffer-overflow WRITE 16 Crash state: wcAesCbcEncrypt evpCipherBlock wolfSSLEVPCipherUpdate...

OSV-2023-6 Heap-buffer-overflow in parse_skip_ws

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55035 Crash type: Heap-buffer-overflow READ 1 Crash state: parseskipws nodefromopenstep parsedictdata...

OSV-2022-1251 Heap-buffer-overflow in bit_read_B

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54162 Crash type: Heap-buffer-overflow READ 1 Crash state: bitreadB dwgdecodeheadervariables decodeR13RNUMBER...

OSV-2022-1229 UNKNOWN WRITE in gdev_mem_open_scan_lines_interleaved

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53903 Crash type: UNKNOWN WRITE Crash state: gdevmemopenscanlinesinterleaved memopen gssetdevicenoerase...

OSV-2022-1196 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53627 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.lang.Module.canRead java.base/sun.invoke.util.VerifyAccess.isModuleAccessible...

OSV-2022-1193 Heap-buffer-overflow in archive_read_has_encrypted_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53594 Crash type: Heap-buffer-overflow READ 8 Crash state: archivereadhasencryptedentries libarchivefuzzer.cc...

OSV-2022-1181 Heap-use-after-free in template_execute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53469 Crash type: Heap-use-after-free READ 1 Crash state: templateexecute msgpackunpacknext cbstdoutflush...

OSV-2022-1174 Heap-buffer-overflow in crc64_clmul

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53423 Crash type: Heap-buffer-overflow READ 16 Crash state: crc64clmul lzmacrc64 lzmacheckupdate...

OSV-2022-1160 Index-out-of-bounds in str_init_embed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53173 Crash type: Index-out-of-bounds Crash state: strinitembed strnew mrbstrnew...

OSV-2022-1153 Heap-buffer-overflow in parse_via_param

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53080 Crash type: Heap-buffer-overflow READ 1 Crash state: parseviaparam parsevia gethdrfield...

OSV-2022-1149 Heap-buffer-overflow in gbNUMBER_mbc_enc_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53036 Crash type: Heap-buffer-overflow READ 1 Crash state: gbNUMBERmbcenclen matchat searchinrange...

OSV-2022-1128 Heap-buffer-overflow in void rawspeed::DngOpcodes::PixelOpcode::applyOP<unsigned short, rawspeed::DngOpc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52944 Crash type: Heap-buffer-overflow READ 4 Crash state: void rawspeed::DngOpcodes::PixelOpcode::applyOPunsigned short, rawspeed::DngOpc rawspeed::DngOpcodes::applyOpCodes rawspeed::DngDecoder::handleMetadata...

OSV-2022-1112 Heap-buffer-overflow in wmem_strbuf_append_vprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52797 Crash type: Heap-buffer-overflow READ Crash state: wmemstrbufappendvprintf wmemstrbufappendprintf dissectdibs...

OSV-2022-1110 Heap-buffer-overflow in parse_classes_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52807 Crash type: Heap-buffer-overflow READ 1 Crash state: parseclasses64 classes rbinobjectsetitems...

OSV-2022-1107 Heap-buffer-overflow in LibRaw::kodak_rgb_load_raw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52802 Crash type: Heap-buffer-overflow WRITE 2 Crash state: LibRaw::kodakrgbloadraw LibRaw::kodakthumbloader LibRaw::unpackthumb...

OSV-2022-1098 Heap-buffer-overflow in fasthuf_initialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52730 Crash type: Heap-buffer-overflow READ 1 Crash state: fasthufinitialize internalhufdecompress internalexrundopiz...

OSV-2022-1097 Stack-use-after-return in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52691 Crash type: Stack-use-after-return READ 4 Crash state: gstype2interpret pdficffglyphoutline gsdefaultglyphinfo...

OSV-2022-1074 Invalid-free in _dealloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52587 Crash type: Invalid-free Crash state: dealloc PyDECREF framedealloc...

OSV-2022-1067 Security exception in jaz.Zer.<clinit>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52546 Crash type: Security exception Crash state: jaz.Zer. java.base/java.lang.Class.forName0 java.base/java.lang.Class.forName...

OSV-2022-1055 UNKNOWN READ in ndpi_search_irc_tcp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52435 Crash type: UNKNOWN READ Crash state: ndpisearchirctcp checkndpidetectionfunc ndpidetectionprocesspacket...

OSV-2022-1029 Heap-buffer-overflow in dprint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52204 Crash type: Heap-buffer-overflow READ 13 Crash state: dprint gethdrfield parseheaders...

OSV-2022-1021 Stack-buffer-underflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52145 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype2interpret gstype1glyphinfo pdficffglyphinfo...

OSV-2022-993 Stack-use-after-return in check_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51910 Crash type: Stack-use-after-return READ 1 Crash state: checkbuffer rbingetbinpluginbybuffer rbinfilenewfrombuffer...

OSV-2022-972 Use-of-uninitialized-value in SkFindQuadMaxCurvature

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51876 Crash type: Use-of-uninitialized-value Crash state: SkFindQuadMaxCurvature AAHairlineOp::onPrepareDraws GrMeshDrawOp::onPrepare...

OSV-2022-934 Index-out-of-bounds in LibRaw::parse_tiff_ifd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51657 Crash type: Index-out-of-bounds Crash state: LibRaw::parsetiffifd LibRaw::parsetiff LibRaw::identify...

OSV-2022-892 Segv on unknown address in ddsi_config_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51292 Crash type: Segv on unknown address Crash state: ddsiconfiginit fuzzconfiginit.c...

OSV-2022-888 Stack-buffer-overflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51275 Crash type: Stack-buffer-overflow READ 4 Crash state: gstype2interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2022-855 UNKNOWN WRITE in Ins_ISECT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51045 Crash type: UNKNOWN WRITE Crash state: InsISECT RunIns InstanceReset...

OSV-2022-835 Use-of-uninitialized-value in json_buildv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50949 Crash type: Use-of-uninitialized-value Crash state: jsonbuildv jsonbuild showbootentries...

OSV-2022-770 Stack-buffer-overflow in get_transaction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50477 Crash type: Stack-buffer-overflow READ 2 Crash state: gettransaction dissectasp calldissectorworkerror...

OSV-2022-768 Security exception in org.apache.commons.jxpath.ri.axes.UnionContext.setPosition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50506 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.axes.UnionContext.setPosition org.apache.commons.jxpath.ri.axes.NodeSetContext.nextNode org.apache.commons.jxpath.ri.axes.PredicateContext.nextNode...

OSV-2022-674 Use-of-uninitialized-value in cdef_filter_block_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49787 Crash type: Use-of-uninitialized-value Crash state: cdeffilterblockc cdeffilterblock8x8c dav1dcdefbrow8bpc...

OSV-2022-661 Heap-buffer-overflow in dissect_softether_ip_port

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49638 Crash type: Heap-buffer-overflow READ 4 Crash state: dissectsoftetheripport ndpisearchsoftether checkndpidetectionfunc...

OSV-2022-626 Heap-buffer-overflow in Write16bitTables

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49461 Crash type: Heap-buffer-overflow READ 2 Crash state: Write16bitTables TypeLUT16Write SaveTags...

OSV-2022-621 Segv on unknown address in mpz_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49427 Crash type: Segv on unknown address Crash state: mpzadd mrbbintadd intadd...

OSV-2022-612 Heap-buffer-overflow in fxGetNextEntity

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49357 Crash type: Heap-buffer-overflow WRITE 1 Crash state: fxGetNextEntity fxGetNextTokenJSXChild fxJSXElement...

OSV-2022-590 Heap-use-after-free in .tmpoLlNv4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49166 Crash type: Heap-use-after-free READ 8 Crash state: .tmpoLlNv4 .tmpoLlNv4 wasmtimesetjmp...

OSV-2022-586 Heap-use-after-free in op_pci_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49107 Crash type: Heap-use-after-free READ 4 Crash state: oppciwrite genericfuzz fuzz.c...