OSV-2022-726 Heap-use-after-free in gx_device_forward_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50307 Crash type: Heap-use-after-free READ 8 Crash state: gxdeviceforwardfinalize gxdevicefinalize allocrestorestepin...

OSV-2022-625 Heap-buffer-overflow in WriteSeqID

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49441 Crash type: Heap-buffer-overflow READ 8 Crash state: WriteSeqID WritePositionTable TypeProfileSequenceIdWrite...

OSV-2022-615 Heap-buffer-overflow in TetrahedralInterp16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49386 Crash type: Heap-buffer-overflow READ 2 Crash state: TetrahedralInterp16 cmsPipelineEval16 FixWhiteMisalignment...

OSV-2022-607 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49289 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2022-578 Heap-buffer-overflow in mrb_bint_to_s

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49045 Crash type: Heap-buffer-overflow WRITE 1 Crash state: mrbbinttos inttos mrbvmexec...

OSV-2022-551 Heap-buffer-overflow in fixup_pcap_pkthdr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48863 Crash type: Heap-buffer-overflow READ 1 Crash state: fixuppcappkthdr pcapnextpacket pcapofflineread...

OSV-2022-475 Heap-double-free in nft_set_context_free_many

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47973 Crash type: Heap-double-free Crash state: nftsetcontextfreemany networkunref networkloadone...

OSV-2022-451 Heap-buffer-overflow in myeid_create_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47769 Crash type: Heap-buffer-overflow WRITE Crash state: myeidcreatekey scpkcs15initstoresecretkey dostoresecretkey...

OSV-2022-434 Segv on unknown address in sc_aux_data_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47655 Crash type: Segv on unknown address Crash state: scauxdatafree scpkcs15freeprkeyinfo scpkcs15freeobject...

OSV-2022-395 Uncaught exception in com.alibaba.fastjson.JSONPath.deepScan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47192 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.JSONPath.deepScan java.base/java.lang.Boolean.valueOf com.alibaba.fastjson.parser.ParserConfig$2.apply...

OSV-2022-361 UNKNOWN READ in sc_pkcs15_decode_pubkey_ec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46852 Crash type: UNKNOWN READ Crash state: scpkcs15decodepubkeyec scpkcs15decodepubkey fuzzpkcs15decode.c...

OSV-2022-346 Heap-buffer-overflow in cli_sigopts_handler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46680 Crash type: Heap-buffer-overflow READ 1 Crash state: clisigoptshandler readdbparseldbsubsignature loadoneldb...

OSV-2022-340 Heap-buffer-overflow in cli_ac_addsig

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46646 Crash type: Heap-buffer-overflow READ 2 Crash state: cliacaddsig cliaddcontentmatchpattern readdbparseldbsubsignature...

OSV-2022-226 Heap-buffer-overflow in vips_rect_intersectrect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45353 Crash type: Heap-buffer-overflow READ 4 Crash state: vipsrectintersectrect vipsforeignloadpdfgenerate vipsregionpreparetogenerate...

OSV-2022-214 Heap-buffer-overflow in cli_bcomp_freemeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45194 Crash type: Heap-buffer-overflow READ 8 Crash state: clibcompfreemeta clibcompaddpatt readdbparseldbsubsignature...

OSV-2022-85 UNKNOWN READ in pdfi_setcolorN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43994 Crash type: UNKNOWN READ Crash state: pdfisetcolorN pdfiinterpretstreamoperator pdfiinterpretcontentstream...

OSV-2022-66 Heap-buffer-overflow in cli_ac_addsig

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43832 Crash type: Heap-buffer-overflow READ 2 Crash state: cliacaddsig cliparseadd clisigoptshandler...

OSV-2021-1706 Segv on unknown address in gx_adjust_color_Pattern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42453 Crash type: Segv on unknown address Crash state: gxadjustcolorPattern gssetcolor pdfisetfillcolor...

OSV-2021-1687 Segv on unknown address in cs_adjust_counts_icc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42290 Crash type: Segv on unknown address Crash state: csadjustcountsicc gstateclonecore gsgsave...

OSV-2020-2324 Heap-buffer-overflow in archive_read_format_cpio_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21048 Crash type: Heap-buffer-overflow READ Crash state: archivereadformatcpioreadheader archivereadnextheader2 archivereadnextheader...

OSV-2020-2320 UNKNOWN WRITE in cpu_arm_exec_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20220 Crash type: UNKNOWN WRITE Crash state: cpuarmexecarm tcgexecallarm qemutcgcpuloop...

OSV-2021-1625 Heap-buffer-overflow in junkscan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41390 Crash type: Heap-buffer-overflow READ 16 Crash state: junkscan seturl parseurl...

OSV-2021-1564 Heap-buffer-overflow in bfd_getl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40908 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetl32 bfdmipselfsectionfromshdr bfdsectionfromshdr...

OSV-2021-1473 Global-buffer-overflow in fr_unix_time_from_tm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40118 Crash type: Global-buffer-overflow READ 2 Crash state: frunixtimefromtm frunixtimefromstr frvalueboxfromstr...

OSV-2021-1457 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39996 Crash type: Heap-buffer-overflow READ 4 Crash state: genericunpack exrdecodingrun Imf31::checkCoreFile...

OSV-2021-1381 Heap-buffer-overflow in OT::MathValueRecord::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39225 Crash type: Heap-buffer-overflow READ 4 Crash state: OT::MathValueRecord::copy OT::MathGlyphAssembly::subset OT::MathGlyphConstruction::subset...

OSV-2021-1340 Heap-buffer-overflow in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38989 Crash type: Heap-buffer-overflow READ 1 Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2021-1301 Use-of-uninitialized-value in std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<std:

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38823 Crash type: Use-of-uninitialized-value Crash state: std::1::hashiteratorstd::1::hashnodestd::1::hashvaluetypestd: opencensus::tags::TagKeyRegistry::Register opencensus::tags::TagKey::Register...

OSV-2021-1239 Heap-buffer-overflow in stbi__load_and_postprocess_8bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38394 Crash type: Heap-buffer-overflow READ 2 Crash state: stbiloadandpostprocess8bit stbimage.h...

OSV-2021-1168 Heap-buffer-overflow in exif_get_slong

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37570 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetslong exifgetlong exifgetrational...

OSV-2021-1127 Heap-use-after-free in zebra_nhg_hash_equal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37164 Crash type: Heap-use-after-free READ 4 Crash state: zebranhghashequal hashget hashlookup...

OSV-2021-1033 Stack-buffer-overflow in unicodize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36312 Crash type: Stack-buffer-overflow WRITE 1 Crash state: unicodize ntlmphase3 establishhttpproxypassthru...

OSV-2021-1027 Index-out-of-bounds in sd_read_byte

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36240 Crash type: Index-out-of-bounds Crash state: sdreadbyte sdbusreaddata sdhcireadblockfromcard...

OSV-2021-1024 Global-buffer-overflow in GetSsmlAttribute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36228 Crash type: Global-buffer-overflow READ 1 Crash state: GetSsmlAttribute GetVoiceAttributes ProcessSsmlTag...

OSV-2021-990 Heap-use-after-free in uhci_handle_td

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36117 Crash type: Heap-use-after-free READ 8 Crash state: uhcihandletd uhciprocessframe uhciframetimer...

OSV-2021-955 Stack-buffer-overflow in Buffer_AppendIndentUnchecked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009 Crash type: Stack-buffer-overflow WRITE 1 Crash state: BufferAppendIndentUnchecked encode encode...

OSV-2021-925 Stack-buffer-overflow in is_same_net6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35889 Crash type: Stack-buffer-overflow READ Crash state: issamenet6 dhcp6mayberelay dhcp6mayberelay...

OSV-2021-870 Stack-use-after-return in v9fs_co_lgetxattr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35290 Crash type: Stack-use-after-return READ 8 Crash state: v9fscolgetxattr v9fsxattrwalk coroutinetrampoline...

OSV-2021-767 Heap-buffer-overflow in string_decoder_getc_utf_8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34299 Crash type: Heap-buffer-overflow READ 1 Crash state: stringdecodergetcutf8 textdecodergetc GetC...

OSV-2021-692 UNKNOWN READ in qpaintengineex_lineTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33678 Crash type: UNKNOWN READ Crash state: qpaintengineexlineTo bool qtstrokeside QStroker::processCurrentSubpath...

OSV-2021-614 Heap-buffer-overflow in ossl_aria_set_encrypt_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33022 Crash type: Heap-buffer-overflow READ 1 Crash state: osslariasetencryptkey cipherhwariainitkey ciphergenericinitinternal...

OSV-2021-532 UNKNOWN READ in address_space_lookup_region

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32125 Crash type: UNKNOWN READ Crash state: addressspacelookupregion addressspacetranslateinternal flatviewdotranslate...

OSV-2021-496 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31710 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-454 Heap-buffer-overflow in irc_parse_message_tags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31443 Crash type: Heap-buffer-overflow READ 8 Crash state: ircparsemessagetags ircservereventtags signalemitreal...

OSV-2021-385 Heap-buffer-overflow in grk::BitIO::bytein

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30863 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::BitIO::bytein grk::BitIO::read grk::T2Decompress::readpacketheader...

OSV-2021-362 Heap-use-after-free in DestroyPicBuff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30770 Crash type: Heap-use-after-free WRITE 4 Crash state: DestroyPicBuff WelsRequestMem SyncPictureResolutionExt...

OSV-2021-289 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30351 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug doaction parsedata...

OSV-2021-273 Heap-use-after-free in sctp_sorecvmsg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30215 Crash type: Heap-use-after-free WRITE 4 Crash state: sctpsorecvmsg usrsctprecvv handleupcall...

OSV-2021-242 Heap-buffer-overflow in rans_uncompress_to_4x16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29939 Crash type: Heap-buffer-overflow READ 1 Crash state: ransuncompressto4x16 ransdecode uncompress...

OSV-2021-203 Memcpy-param-overlap in flatview_write_continue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29586 Crash type: Memcpy-param-overlap Crash state: flatviewwritecontinue flatviewwrite addressspacewrite...