OSV-2022-680 Heap-use-after-free in UA_Server_networkCallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49836 Crash type: Heap-use-after-free READ 4 Crash state: UAServernetworkCallback fuzzbinarymessage.cc UAmemoryManagerfree...

OSV-2022-665 Use-of-uninitialized-value in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49676 Crash type: Use-of-uninitialized-value Crash state: udiv mpzmdiv mrbbintdiv...

OSV-2022-663 Heap-buffer-overflow in av1_read_mode_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49652 Crash type: Heap-buffer-overflow WRITE 1 Crash state: av1readmodeinfo parsedecodeblock decodepartition...

OSV-2022-662 UNKNOWN READ in pdfi_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49662 Crash type: UNKNOWN READ Crash state: pdfifreeobject pdfifreefontcidtype2 pdfifreefont...

OSV-2022-654 Heap-buffer-overflow in dwg_geojson_feature

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49618 Crash type: Heap-buffer-overflow READ 8 Crash state: dwggeojsonfeature dwggeojsonobject dwgwritegeojson...

OSV-2022-637 Segv on unknown address in mrb_bint_cmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49493 Crash type: Segv on unknown address Crash state: mrbbintcmp cmpnum numcmp...

OSV-2022-636 UNKNOWN READ in fp_cmp_mag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49510 Crash type: UNKNOWN READ Crash state: fpcmpmag crtmgrtrustlistlookup crtmgradd...

OSV-2022-611 Heap-use-after-free in cras_iodev_list_disable_dev

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49368 Crash type: Heap-use-after-free READ 4 Crash state: crasiodevlistdisabledev crasiodevlistrmoutput a2dppcmiodevdestroy...

OSV-2022-603 Heap-buffer-overflow in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49259 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2022-577 Heap-use-after-free in jsmn_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49033 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...

OSV-2022-551 Heap-buffer-overflow in fixup_pcap_pkthdr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48863 Crash type: Heap-buffer-overflow READ 1 Crash state: fixuppcappkthdr pcapnextpacket pcapofflineread...

OSV-2022-550 Heap-use-after-free in mrb_bint_new_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48873 Crash type: Heap-use-after-free READ 1 Crash state: mrbbintnewstr mrbvmexec mrbvmrun...

OSV-2022-532 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48658 Crash type: Null-dereference READ Crash state: NULL...

OSV-2022-519 Stack-buffer-overflow in LookupThousands

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48470 Crash type: Stack-buffer-overflow WRITE Crash state: LookupThousands LookupNum3 TranslateNumber...

OSV-2022-515 Uncaught exception in com.github.javaparser.CommentsInserter.insertComments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48408 Crash type: Uncaught exception Crash state: com.github.javaparser.CommentsInserter.insertComments java.base/java.util.TreeMap.compare java.base/java.util.TreeMap.addEntryToEmptyMap...

OSV-2022-508 Heap-buffer-overflow in coap_split_uri_sub

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48362 Crash type: Heap-buffer-overflow READ 1 Crash state: coapspliturisub coapgeturipath...

OSV-2022-494 Heap-buffer-overflow in ucl_hash_search

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48156 Crash type: Heap-buffer-overflow READ 1 Crash state: uclhashsearch uclparserprocessobjectelement uclstatemachine...

OSV-2022-472 Heap-double-free in nft_set_context_free_many

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47963 Crash type: Heap-double-free Crash state: nftsetcontextfreemany configparsenftsetcontext configparsedhcppdnftsetcontext...

OSV-2022-467 Security exception in jaz.Zer.<clinit>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47914 Crash type: Security exception Crash state: jaz.Zer. java.base/java.lang.Class.forName0 java.base/java.lang.Class.forName...

OSV-2022-446 Uncaught exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47737 Crash type: Uncaught exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression com.github.javaparser.Range.range com.github.javaparser.JavaToken...

OSV-2022-435 Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47657 Crash type: Uncaught exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.lang.StringUTF16.checkBoundsOffCount java.base/java.lang.StringUTF16.getChars...

OSV-2021-1815 Global-buffer-overflow in xstrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47626 Crash type: Global-buffer-overflow READ 1 Crash state: xstrdup scanopenobjfile scanobjfile...

OSV-2022-432 Stack-use-after-return in conversation_match_element_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47624 Crash type: Stack-use-after-return READ 4 Crash state: conversationmatchelementlist wmemmaplookup findconversationbyid...

OSV-2022-383 Heap-use-after-free in r_asm_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47113 Crash type: Heap-use-after-free READ 4 Crash state: rasmfree rcorefini rcorefree...

OSV-2022-372 Heap-buffer-overflow in dwg_encode_VERTEX_2D

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994 Crash type: Heap-buffer-overflow READ 8 Crash state: dwgencodeVERTEX2D dwgencodeaddobject dwgencode...

OSV-2022-359 Heap-use-after-free in Segment::write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46788 Crash type: Heap-use-after-free READ 1 Crash state: Segment::write Doublewrite::writepages Doublewrite::flushtodisk...

OSV-2022-345 Stack-buffer-overflow in sc_hsm_list_files

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46679 Crash type: Stack-buffer-overflow READ Crash state: schsmlistfiles sclistfiles fuzzcard.c...

OSV-2022-341 Heap-buffer-overflow in krb_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46670 Crash type: Heap-buffer-overflow READ 2 Crash state: krbparse ndpisearchkerberos checkndpidetectionfunc...

OSV-2022-337 Heap-double-free in cli_extract_xlm_macros_and_images

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46586 Crash type: Heap-double-free Crash state: cliextractxlmmacrosandimages cliole2scantempdir climagicscan...

OSV-2022-323 Heap-buffer-overflow in ConvertRGB24ToY_SSE41

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46436 Crash type: Heap-buffer-overflow READ 1 Crash state: ConvertRGB24ToYSSE41 ImportYUVAFromRGBA Import...

OSV-2022-322 Heap-buffer-overflow in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46460 Crash type: Heap-buffer-overflow READ Crash state: framegetmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2022-320 Heap-buffer-overflow in lwan_h2_huffman_decode_for_fuzzing

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46506 Crash type: Heap-buffer-overflow READ 8 Crash state: lwanh2huffmandecodeforfuzzing h2huffmanfuzzer.cc...

OSV-2022-311 Heap-use-after-free in decode_mcu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46354 Crash type: Heap-use-after-free READ 4 Crash state: decodemcu decompressonepass processdatasimplemain...

OSV-2022-299 Heap-use-after-free in read_data_compressed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46279 Crash type: Heap-use-after-free READ 4 Crash state: readdatacompressed archivereadformatrarreaddata archivereaddatablock...

OSV-2022-288 Segv on unknown address in flb_ra_translate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46082 Crash type: Segv on unknown address Crash state: flbratranslate recordacfuzzer.c...

OSV-2022-276 Segv on unknown address in sc_file_clear_acl_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45969 Crash type: Segv on unknown address Crash state: scfileclearaclentries scfilefree scprofilefree...

OSV-2022-237 Stack-buffer-overflow in sc_format_oid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45459 Crash type: Stack-buffer-overflow READ Crash state: scformatoid dostoredataobject fuzzpkcs15init.c...

OSV-2022-235 Heap-buffer-overflow in zend_gc_collect_cycles

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45369 Crash type: Heap-buffer-overflow READ 1 Crash state: zendgccollectcycles fuzzerrequestshutdown fuzzerdorequestfrombuffer...

OSV-2022-231 Heap-buffer-overflow in do_fileid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45430 Crash type: Heap-buffer-overflow WRITE 2 Crash state: dofileid processcommand processblock...

OSV-2022-185 Heap-use-after-free in Segment::write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44951 Crash type: Heap-use-after-free READ 1 Crash state: Segment::write Doublewrite::writepages Doublewrite::flushtodisk...

OSV-2022-136 Heap-buffer-overflow in cli_js_parse_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44490 Crash type: Heap-buffer-overflow READ 4 Crash state: clijsparsedone clihtmlnormalise htmlnormalisemap...

OSV-2022-133 Heap-buffer-overflow in coap_split_uri_sub

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44503 Crash type: Heap-buffer-overflow READ 1 Crash state: coapspliturisub coapgeturipath...

OSV-2022-111 Heap-use-after-free in OT::CoverageFormat1::intersected_coverage_glyphs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44257 Crash type: Heap-use-after-free READ 4 Crash state: OT::CoverageFormat1::intersectedcoverageglyphs OT::ChainContextFormat3::closure OT::hbclosurecontextt::returnt OT::SubstLookupSubTable::dispatchOT::hbclos...

OSV-2022-105 Heap-buffer-overflow in parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44199 Crash type: Heap-buffer-overflow READ 4 Crash state: parseobject parseobject parseobject...

OSV-2022-104 Heap-use-after-free in hb_bit_set_invertible_t::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44198 Crash type: Heap-use-after-free READ 1 Crash state: hbbitsetinvertiblet::intersects OT::CoverageFormat2::intersectedcoverageglyphs OT::ChainContextFormat1::closure...

OSV-2022-91 Heap-buffer-overflow in pixCountArbInRect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44008 Crash type: Heap-buffer-overflow READ 1 Crash state: pixCountArbInRect pix3fuzzer.cc...

OSV-2022-90 Heap-double-free in cli_extract_xlm_macros_and_images

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44040 Crash type: Heap-double-free Crash state: cliextractxlmmacrosandimages cliole2scantempdir cliscanole2...

OSV-2022-85 UNKNOWN READ in pdfi_setcolorN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43994 Crash type: UNKNOWN READ Crash state: pdfisetcolorN pdfiinterpretstreamoperator pdfiinterpretcontentstream...

OSV-2022-84 Heap-buffer-overflow in Core::Stream::File::open_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43978 Crash type: Heap-buffer-overflow READ Crash state: Core::Stream::File::openpath Core::Stream::File::open Audio::FlacLoaderPlugin::FlacLoaderPlugin...

OSV-2022-57 Heap-buffer-overflow in _estrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43736 Crash type: Heap-buffer-overflow READ 15 Crash state: estrdup exifprocessusercomment exifprocessIFDTAGimpl...