OSV-2024-1128 Segv on unknown address in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368076871 Crash type: Segv on unknown address Crash state: udiv mrbbintmod mrbvmexec...

OSV-2024-1124 Heap-buffer-overflow in ih264d_read_coeff4x4_cabac

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538616 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dreadcoeff4x4cabac ih264dcabacparse8x8block ih264dparseresidual4x4cabac...

OSV-2024-1102 Security exception in java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.DOM2TO.parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538549 Crash type: Security exception Crash state: java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.DOM2TO.parse java.xml/com.sun.org.apache.xerces.internal.dom.ElementNSImpl...

OSV-2024-1090 UNKNOWN READ in ggml_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538517 Crash type: UNKNOWN READ Crash state: ggmlfree llamamodel::llamamodel llamaloadmodelfromfile...

OSV-2024-1076 Heap-buffer-overflow in readBytes48

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538426 Crash type: Heap-buffer-overflow READ 1 Crash state: readBytes48 SystemZLLVMgetInstruction SystemZgetInstruction...

OSV-2024-1071 Use-of-uninitialized-value in Poco::Dynamic::Var::~Var

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538385 Crash type: Use-of-uninitialized-value Crash state: Poco::Dynamic::Var::Var void Poco::JSON::Object::doStringifystd::1::mapstd::1::basicstringchar, Poco::JWT::Serializer::serialize...

OSV-2024-1066 Heap-buffer-overflow in StrLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71496 Crash type: Heap-buffer-overflow READ 2 Crash state: StrLen MangleFileName ToolChainHarnessLib.c...

OSV-2024-1062 UNKNOWN WRITE in std::__1::recursive_mutex::lock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538230 Crash type: UNKNOWN WRITE Crash state: std::1::recursivemutex::lock Catalog::getForm Page::getAnnots...

OSV-2024-1059 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538184 Crash type: UNKNOWN READ Crash state: chunkfreeobject fileclosefile sclose...

OSV-2024-1056 UNKNOWN WRITE in bfd_elf_get_str_section

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538161 Crash type: UNKNOWN WRITE Crash state: bfdelfgetstrsection bfdelfstringfromelfsection bfdelfsymname...

OSV-2024-1054 Bad-cast to Assimp::LogStream from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538150 Crash type: Bad-cast Crash state: Bad-cast to Assimp::LogStream from invalid vptr CallbackToLogRedirector Assimp::DefaultLogger::WriteToStreams...

OSV-2024-1053 Heap-buffer-overflow in gguf_get_tensor_offset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538148 Crash type: Heap-buffer-overflow READ 8 Crash state: ggufgettensoroffset llamamodelloader::llamatensorweight::llamatensorweight void std::1::vectorllamamodelloader::llamatensorweight, std::1::allocat...

OSV-2024-1045 UNKNOWN READ in glslang::TInfoSinkBase::location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71345 Crash type: UNKNOWN READ Crash state: glslang::TInfoSinkBase::location glslang::TParseContextBase::outputMessage glslang::TParseContextBase::error...

OSV-2024-1044 UNKNOWN READ in H5FL_reg_malloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538113 Crash type: UNKNOWN READ Crash state: H5FLregmalloc H5FLregcalloc H5Ocachechkdeserialize...

OSV-2024-1043 Heap-buffer-overflow in simdutf::haswell::implementation::convert_utf8_to_latin1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71307 Crash type: Heap-buffer-overflow WRITE Crash state: simdutf::haswell::implementation::convertutf8tolatin1 Conversion Conversion...

OSV-2024-1042 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538085 Crash type: UNKNOWN READ Crash state: chunkfreeobject streamdctfinalize chunkfreeobject...

OSV-2024-1041 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71296 Crash type: UNKNOWN READ Crash state: chunkfreeobject sfclose pdficlosefile...

OSV-2024-1036 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71250 Crash type: UNKNOWN READ Crash state: chunkfreeobject fileclosefile sclose...

OSV-2024-1034 Heap-buffer-overflow in simdutf::haswell::implementation::convert_utf8_to_utf16be

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71218 Crash type: Heap-buffer-overflow WRITE Crash state: simdutf::haswell::implementation::convertutf8toutf16be Conversion Conversion...

OSV-2024-1031 Use-of-uninitialized-value in Http3FrameFactory::create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537939 Crash type: Use-of-uninitialized-value Crash state: Http3FrameFactory::create Http3FrameFactory::fastcreate fuzzhttp3frame.cc...

OSV-2024-1029 Stack-buffer-overflow in gf_hevc_parse_nalu_bs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71146 Crash type: Stack-buffer-overflow WRITE 4 Crash state: gfhevcparsenalubs gfinspectdumpnaluinternal inspectprocess...

OSV-2024-1023 Use-of-uninitialized-value in pcpp::SomeIpLayer::parseSomeIpLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69526 Crash type: Use-of-uninitialized-value Crash state: pcpp::SomeIpLayer::parseSomeIpLayer pcpp::SomeIpLayer::parseNextLayer pcpp::Packet::setRawPacket...

OSV-2024-1018 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67071 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

OSV-2024-1010 UNKNOWN READ in H5SL_first

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69169 Crash type: UNKNOWN READ Crash state: H5SLfirst H5FSsectfind H5MFfindsect...

OSV-2024-1009 Heap-buffer-overflow in pcpp::Layer::shortenLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66778 Crash type: Heap-buffer-overflow WRITE 9 Crash state: pcpp::Layer::shortenLayer pcpp::TextBasedProtocolMessage::removeField readParsedPacket...

OSV-2024-1003 Security exception in org.json.JSONStringer.value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66272 Crash type: Security exception Crash state: org.json.JSONStringer.value org.json.JSONArray.writeTo org.json.JSONStringer.beforeValue...

OSV-2024-999 Stack-buffer-overflow in filter_apply_chain

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68846 Crash type: Stack-buffer-overflow READ 4 Crash state: filterapplychain filterapplychain readin...

OSV-2024-996 Use-of-uninitialized-value in cups_array_find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69548 Crash type: Use-of-uninitialized-value Crash state: cupsarrayfind cupsArrayFind cupsStrAlloc...

OSV-2024-994 Use-of-uninitialized-value in packet_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71124 Crash type: Use-of-uninitialized-value Crash state: packetparse packetget1 packetget...

OSV-2024-988 UNKNOWN WRITE in SHA224Result

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68417 Crash type: UNKNOWN WRITE Crash state: SHA224Result mdmapsh224 stack...

OSV-2024-987 Heap-buffer-overflow in pcpp::NDPNeighborAdvertisementLayer::toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66599 Crash type: Heap-buffer-overflow READ 16 Crash state: pcpp::NDPNeighborAdvertisementLayer::toString pcpp::Packet::toStringList pcpp::Packet::toString...

OSV-2024-985 Heap-double-free in libssh2_default_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69362 Crash type: Heap-double-free Crash state: libssh2defaultfree sessionfree libssh2sessionfree...

OSV-2024-983 UNKNOWN READ in ireclaim

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537430 Crash type: UNKNOWN READ Crash state: ireclaim interpreclaim gsmainfinit...

OSV-2024-978 Stack-buffer-overflow in narrow_conv_backprop

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537498 Crash type: Stack-buffer-overflow WRITE 4 Crash state: narrowconvbackprop narrowconvbackprop narrowconvbackprop...

OSV-2024-969 Security exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70881 Crash type: Security exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression java.base/java.lang.ClassLoader.defineClass1 java.base/java.lang.ClassLoader.defineClass...

OSV-2024-967 Heap-buffer-overflow in pcpp::byteArrayToHexString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68520 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::byteArrayToHexString pcpp::PacketTrailerLayer::toString FuzzTarget.cpp...

OSV-2024-965 Stack-buffer-overflow in FLAC__stream_encoder_init_ogg_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537419 Crash type: Stack-buffer-overflow READ 13 Crash state: FLACstreamencoderinitoggfile EncoderSessioninitencoder flacencodefile...

OSV-2024-964 Security exception in com.alibaba.fastjson2.JSONPathSegment$CycleNameSegment$MapLoop.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69767 Crash type: Security exception Crash state: com.alibaba.fastjson2.JSONPathSegment$CycleNameSegment$MapLoop.accept java.base/java.util.ArrayList.forEach java.base/java.nio.charset.CharsetEncoder...

OSV-2024-963 Heap-buffer-overflow in GfxTilingPattern::scanXObjectForBlendMode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68412 Crash type: Heap-buffer-overflow READ 1 Crash state: GfxTilingPattern::scanXObjectForBlendMode GfxTilingPattern::scanSoftMaskForBlendMode GfxTilingPattern::scanExtGStateForBlendMode...

OSV-2024-957 Heap-buffer-overflow in pcpp::computeChecksum

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66025 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::computeChecksum pcpp::computePseudoHdrChecksum pcpp::TcpLayer::calculateChecksum...

OSV-2024-955 Use-of-uninitialized-value in pcpp::IPv6Address::toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42536479 Crash type: Use-of-uninitialized-value Crash state: pcpp::IPv6Address::toString pcpp::NDPNeighborSolicitationLayer::toString pcpp::Packet::toStringList...

OSV-2024-954 Use-of-uninitialized-value in pcpp::MplsLayer::toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68950 Crash type: Use-of-uninitialized-value Crash state: pcpp::MplsLayer::toString FuzzTarget.cpp pcpp::RawPacket::RawPacket...

OSV-2024-953 UNKNOWN READ in pcpp::PcapNgFileReaderDevice::getNextPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69036 Crash type: UNKNOWN READ Crash state: pcpp::PcapNgFileReaderDevice::getNextPacket pcpp::PcapNgFileReaderDevice::getNextPacket FuzzTarget.cpp...

OSV-2024-952 Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42536579 Crash type: Security exception Crash state: org.bouncycastle.asn1.IndefiniteLengthInputStream.read org.bouncycastle.asn1.IndefiniteLengthInputStream.checkForEof org.bouncycastle.asn1.IndefiniteLengthInputStream.read...

OSV-2024-951 Index-out-of-bounds in hevc_ref_pic_lists_modification

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71054 Crash type: Index-out-of-bounds Crash state: hevcrefpiclistsmodification gfhevcparsenalubs gfinspectdumpnaluinternal...

OSV-2024-947 Heap-buffer-overflow in pcpp::SomeIpSdEntry::SomeIpSdEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=68654 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::SomeIpSdEntry::SomeIpSdEntry pcpp::SomeIpSdLayer::getEntries readParsedPacket...

OSV-2024-939 Security exception in org.apache.poi.util.LZWDecompresser.decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70377 Crash type: Security exception Crash state: org.apache.poi.util.LZWDecompresser.decompress org.apache.poi.util.LZWDecompresser.decompress org.apache.poi.hdgf.streams.CompressedStreamStore.decompress...

OSV-2024-930 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70893 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/sun.reflect.generics.reflectiveObjects.ParameterizedTypeImpl.hashCode...

OSV-2024-925 Index-out-of-bounds in derive_collocated_motion_vectors

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537038 Crash type: Index-out-of-bounds Crash state: derivecollocatedmotionvectors derivetemporallumavectorprediction getmergecandidatelistwithoutstep9...

OSV-2024-919 Heap-buffer-overflow in validate_relpath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66547 Crash type: Heap-buffer-overflow READ 2 Crash state: validaterelpath loadmodulemeta fmodulemeta...