OSV-2024-198 Heap-use-after-free in xmlCopyPropInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67586 Crash type: Heap-use-after-free READ 8 Crash state: xmlCopyPropInternal xmlCopyPropList xmlStaticCopyNode...

OSV-2024-195 Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67558 Crash type: Security exception Crash state: com.github.javaparser.ast.validator.TreeVisitorValidator.accept com.github.javaparser.ast.expr.FieldAccessExpr.getMetaModel...

OSV-2024-194 Heap-use-after-free in xmlDOMWrapNSNormAcquireNormalizedNs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67560 Crash type: Heap-use-after-free READ 8 Crash state: xmlDOMWrapNSNormAcquireNormalizedNs xmlDOMWrapReconcileNamespaces api.c...

OSV-2024-193 Use-of-uninitialized-value in api.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67552 Crash type: Use-of-uninitialized-value Crash state: api.c xmlSearchNsByHref...

OSV-2024-189 Negative-size-param in vcf_parse_format

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67431 Crash type: Negative-size-param Crash state: vcfparseformat vcfparse bcfread...

OSV-2024-187 Heap-buffer-overflow in pcre2_fuzzsupport.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67542 Crash type: Heap-buffer-overflow READ 4 Crash state: pcre2fuzzsupport.c...

OSV-2024-184 Security exception in org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67437 Crash type: Security exception Crash state: org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse java.base/sun.util.locale.provider.LocaleProviderAdapter.getAdapter...

OSV-2024-182 Heap-buffer-overflow in pcre2_fuzzsupport.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67475 Crash type: Heap-buffer-overflow READ 4 Crash state: pcre2fuzzsupport.c...

OSV-2024-181 Security exception in org.antlr.v4.runtime.atn.PredictionContext.fromRuleContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67461 Crash type: Security exception Crash state: org.antlr.v4.runtime.atn.PredictionContext.fromRuleContext org.antlr.v4.runtime.misc.MurmurHash.update org.antlr.v4.runtime.misc.MurmurHash.update...

OSV-2024-180 Heap-buffer-overflow in ixheaace_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67273 Crash type: Heap-buffer-overflow READ 1 Crash state: ixheaaceprocess xaacencfuzzer.cpp...

OSV-2024-179 UNKNOWN READ in gs_font_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67377 Crash type: UNKNOWN READ Crash state: gsfontfinalize chunkfreeobject pdfifreefonttype1...

OSV-2024-178 Global-buffer-overflow in dissect_dns_answer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67265 Crash type: Global-buffer-overflow WRITE 4 Crash state: dissectdnsanswer dissectdnscommon dissectdns...

OSV-2024-177 Heap-buffer-overflow in p11_rpc_buffer_get_date_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67383 Crash type: Heap-buffer-overflow WRITE 8 Crash state: p11rpcbuffergetdatevalue p11rpcmessagegetdatevalue p11rpcmessagegetattribute...

OSV-2024-173 Heap-buffer-overflow in pcre2_fuzzsupport.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67381 Crash type: Heap-buffer-overflow READ 4 Crash state: pcre2fuzzsupport.c...

OSV-2024-171 Security exception in org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67357 Crash type: Security exception Crash state: org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse java.base/sun.util.calendar.ZoneInfo.getLastRawOffset java.base/sun.util.calendar.ZoneInfo.getOffse...

OSV-2024-170 Use-of-uninitialized-value in pcpp::Packet::createFirstLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66333 Crash type: Use-of-uninitialized-value Crash state: pcpp::Packet::createFirstLayer pcpp::Packet::setRawPacket FuzzTarget.cpp...

OSV-2024-167 Security exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65974 Crash type: Security exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression java.base/java.lang.String.startsWith java.base/java.net.URL.isBuiltinStreamHandler...

OSV-2024-163 Stack-buffer-overflow in H5S_get_simple_extent_dims

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66627 Crash type: Stack-buffer-overflow WRITE 8 Crash state: H5Sgetsimpleextentdims H5Sgetsimpleextentdims MatH5ReadFieldNames...

OSV-2024-161 Heap-buffer-overflow in pcre2_fuzzsupport.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67297 Crash type: Heap-buffer-overflow READ 4 Crash state: pcre2fuzzsupport.c...

OSV-2024-157 Heap-buffer-overflow in gf_strmemstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67261 Crash type: Heap-buffer-overflow READ 13 Crash state: gfstrmemstr txtinprobedata gffilterpidrawnew...

OSV-2024-156 Stack-buffer-overflow in rtpin_satip_get_server_ip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67263 Crash type: Stack-buffer-overflow WRITE 1 Crash state: rtpinsatipgetserverip rtpininitialize gffilternewfinalize...

OSV-2024-153 Heap-buffer-overflow in od_ec_dec_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67184 Crash type: Heap-buffer-overflow READ 1 Crash state: odecdecinit aomreaderinit tileworkerhookinit...

OSV-2024-151 Heap-buffer-overflow in od_ec_dec_normalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67216 Crash type: Heap-buffer-overflow READ 1 Crash state: odecdecnormalize av1decodepalettetokens av1visitpalette...

OSV-2024-149 Heap-use-after-free in get_ls_tile_buffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67055 Crash type: Heap-use-after-free READ 1 Crash state: getlstilebuffers av1decodetgtilesandwrapup aomdecodeframefromobus...

OSV-2024-144 UNKNOWN READ in spvtools::val::ValidateAccessChain

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66956 Crash type: UNKNOWN READ Crash state: spvtools::val::ValidateAccessChain spvtools::val::MemoryPass spvtools::val::ValidateBinaryUsingContextAndValidationState...

OSV-2024-142 Heap-buffer-overflow in gf_gz_decompress_payload_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67043 Crash type: Heap-buffer-overflow WRITE 1 Crash state: gfgzdecompresspayloadex gfisomboxparseex gfisomboxarrayread...

OSV-2024-140 Container-overflow in WasmEdge::LLVM::Compiler::compile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67006 Crash type: Container-overflow READ 8 Crash state: WasmEdge::LLVM::Compiler::compile WasmEdge::LLVM::Compiler::compile WasmEdge::Driver::FuzzTool...

OSV-2024-138 Security exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67005 Crash type: Security exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression java.base/java.util.concurrent.ConcurrentHashMap.putVal java.base/java.util.concurrent.ConcurrentHashMap.putIfAbsent...

OSV-2024-137 Global-buffer-overflow in igraph_dl_yylex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66992 Crash type: Global-buffer-overflow READ 2 Crash state: igraphdlyylex igraphdlyyparse igraphreadgraphdl...

OSV-2024-135 Heap-buffer-overflow in BS_ReadByte

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66949 Crash type: Heap-buffer-overflow READ 1 Crash state: BSReadByte gfbsreadu8 dumpsei...

OSV-2024-123 Heap-use-after-free in dxf_tables_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66835 Crash type: Heap-use-after-free READ 8 Crash state: dxftablesread dwgreaddxf llvmfuzz.c...

OSV-2024-120 Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66743 Crash type: Security exception Crash state: com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer java.base/java.lang.StringCoding.encode java.base/java.lang.String.getBytes...

OSV-2024-118 Heap-buffer-overflow in sav_process_row

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66805 Crash type: Heap-buffer-overflow WRITE 1 Crash state: savprocessrow savreaddata readstatparsesav...

OSV-2024-117 Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66745 Crash type: Security exception Crash state: com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer java.base/java.nio.charset.CharsetEncoder. java.base/sun.nio.cs.CESU8$Encoder...

OSV-2024-114 Segv on unknown address in lj_BC_RET1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66384 Crash type: Segv on unknown address Crash state: ljBCRET1 luapcall luaLloadbufferfuzzer.cc...

OSV-2024-112 Stack-overflow in boost::read_graphviz_detail::parser::parse_subgraph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719 Crash type: Stack-overflow Crash state: boost::readgraphvizdetail::parser::parsesubgraph boost::readgraphvizdetail::parser::parseendpointrest boost::readgraphvizdetail::parser::parsestmt...

OSV-2024-104 Heap-buffer-overflow in mrb_memsearch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66689 Crash type: Heap-buffer-overflow READ 3 Crash state: mrbmemsearch strconvertrange mrbstraref...

OSV-2024-103 Heap-use-after-free in xmlRemoveID

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66679 Crash type: Heap-use-after-free READ 4 Crash state: xmlRemoveID xmlFreeProp xmlFreeNode...

OSV-2024-102 Heap-buffer-overflow in mrb_memsearch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66423 Crash type: Heap-buffer-overflow READ 2 Crash state: mrbmemsearch mrbstrsplitm mrbvmexec...

OSV-2024-98 UNKNOWN READ in PackLinuxElf32::adjABS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66287 Crash type: UNKNOWN READ Crash state: PackLinuxElf32::adjABS PackLinuxElf32::unasldynsym PackLinuxElf32::unshlib1...

OSV-2024-96 Heap-buffer-overflow in mrb_memsearch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66426 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbmemsearch strconvertrange mrbstraref...

OSV-2024-93 Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66540 Crash type: Security exception Crash state: com.github.javaparser.ast.validator.TreeVisitorValidator.accept java.base/java.util.Arrays.copyOf java.base/java.util.ArrayList.grow...

OSV-2024-89 Security exception in com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66429 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst java.base/java.util.stream.ReferencePipeline$3$1.accept...

OSV-2024-88 Heap-use-after-free in fuzzer_execute_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66538 Crash type: Heap-use-after-free READ 4 Crash state: fuzzerexecuteex ZENDDOFCALLSPECRETVALUNUSEDHANDLER fuzzerexecuteex...

OSV-2024-86 Security exception in org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66533 Crash type: Security exception Crash state: org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse java.base/java.text.DateFormatSymbols.getProviderInstance...

OSV-2024-85 Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66357 Crash type: Security exception Crash state: com.github.javaparser.ast.validator.TreeVisitorValidator.accept com.github.javaparser.ast.expr.FieldAccessExpr.getMetaModel...

OSV-2024-82 Heap-use-after-free in xmlValidatePopElement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66154 Crash type: Heap-use-after-free READ 8 Crash state: xmlValidatePopElement xmlTextReaderValidatePop xmlTextReaderRead...

OSV-2024-81 Heap-use-after-free in xmlRemoveID

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66502 Crash type: Heap-use-after-free READ 4 Crash state: xmlRemoveID xmlFreeProp xmlFreeNodeList...

OSV-2024-80 Stack-buffer-overflow in line_join_points

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66455 Crash type: Stack-buffer-overflow WRITE 4 Crash state: linejoinpoints strokeaddcompat gxstrokepathonly...

OSV-2024-79 Heap-double-free in supported_features

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66398 Crash type: Heap-double-free Crash state: supportedfeatures handleatcommand handleatcommandfortest...