OSV-2024-77 Heap-use-after-free in xmlRemoveID

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66446 Crash type: Heap-use-after-free READ 8 Crash state: xmlRemoveID xmlFreeProp xmlFreeNodeList...

OSV-2024-74 Heap-buffer-overflow in hts_log

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66369 Crash type: Heap-buffer-overflow READ Crash state: htslog processoneread cramencodecontainer...

OSV-2024-73 Heap-buffer-overflow in pdf_finalize_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66093 Crash type: Heap-buffer-overflow READ 1 Crash state: pdffinalizestring clipdf cliscanpdf...

OSV-2024-72 UNKNOWN READ in LLVMFuzzerRunDriver

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66204 Crash type: UNKNOWN READ Crash state: LLVMFuzzerRunDriver...

OSV-2024-68 Heap-buffer-overflow in gsfdmx_probe_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66169 Crash type: Heap-buffer-overflow READ 3 Crash state: gsfdmxprobedata gffilterpidrawnew fileinprocess...

OSV-2024-66 Heap-buffer-overflow in mrb_memsearch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66209 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbmemsearch strconvertrange mrbstraref...

OSV-2024-65 Heap-buffer-overflow in mrb_memsearch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66208 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbmemsearch mrbstrsplitm mrbvmexec...

OSV-2024-64 Global-buffer-overflow in ReadVariantArrayBuiltInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66311 Crash type: Global-buffer-overflow READ 8 Crash state: ReadVariantArrayBuiltInType SOPCVariantReadInternal SOPCEncodeableObjectDecode...

OSV-2024-48 Security exception in java.base/java.util.Arrays.copyOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66178 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOf java.base/java.util.Arrays.copyOf java.base/java.util.ArrayList.grow...

OSV-2024-42 Heap-double-free in dwg_free_common_entity_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66111 Crash type: Heap-double-free Crash state: dwgfreecommonentitydata dwgfreePLANESURFACE dwgfreevariablenoclass...

OSV-2024-39 Heap-buffer-overflow in simdutf::westmere::implementation::convert_utf8_to_utf32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66063 Crash type: Heap-buffer-overflow WRITE 16 Crash state: simdutf::westmere::implementation::convertutf8toutf32 roundtrip.cc...

OSV-2024-38 Heap-buffer-overflow in json_HEADER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66046 Crash type: Heap-buffer-overflow WRITE 2 Crash state: jsonHEADER dwgreadjson llvmfuzz.c...

OSV-2024-36 Heap-use-after-free in LLVMFuzzerRunDriver

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65647 Crash type: Heap-use-after-free READ 4 Crash state: LLVMFuzzerRunDriver absl::ltsNUMBER::randominternal::InitDiscreteDistribution absl::ltsNUMBER::discretedistribution::paramtype::init...

OSV-2024-33 Heap-buffer-overflow in ctxload_probe_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66032 Crash type: Heap-buffer-overflow READ Crash state: ctxloadprobedata gffilterpidrawnew fileinprocess...

OSV-2024-30 Heap-buffer-overflow in mrb_memsearch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66000 Crash type: Heap-buffer-overflow READ 3 Crash state: mrbmemsearch mrbstrbyteindexm mrbvmexec...

OSV-2024-29 Heap-buffer-overflow in mrb_memsearch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65996 Crash type: Heap-buffer-overflow READ Crash state: mrbmemsearch strconvertrange mrbstraref...

OSV-2024-28 Security exception in java.base/java.util.Arrays.copyOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65930 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOf java.base/java.util.ArrayList.grow java.base/java.util.ArrayList.grow...

OSV-2024-25 Stack-buffer-overflow in icu_75::PluralRuleParser::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65873 Crash type: Stack-buffer-overflow WRITE 1 Crash state: icu75::PluralRuleParser::parse icu75::PluralRules::createRules plurrulefuzzer.cpp...

OSV-2024-24 Security exception in java.base/java.util.Arrays.copyOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65740 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOf com.fasterxml.jackson.core.util.TextBuffer.expandCurrentSegment com.fasterxml.jackson.dataformat.cbor.CBORParser.finishShortText...

OSV-2024-22 Heap-use-after-free in ucl_hash_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65868 Crash type: Heap-use-after-free READ 8 Crash state: uclhashfunc khresizeuclhashnode khputuclhashnode...

OSV-2024-20 Heap-buffer-overflow in bam_aux_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65820 Crash type: Heap-buffer-overflow READ 1 Crash state: bamauxget processoneread cramencodecontainer...

OSV-2024-18 Heap-use-after-free in QPDF::read_xref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65777 Crash type: Heap-use-after-free READ 8 Crash state: QPDF::readxref QPDF::reconstructxref QPDF::parse...

OSV-2024-17 Heap-use-after-free in iasecc_delete_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65684 Crash type: Heap-use-after-free READ 4 Crash state: iaseccdeletefile scdeletefile iaseccpkcs15deletefile...

OSV-2024-10 Heap-buffer-overflow in __string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65632 Crash type: Heap-buffer-overflow READ 2 Crash state: string...

OSV-2024-9 Stack-buffer-overflow in _canonicalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65635 Crash type: Stack-buffer-overflow READ Crash state: canonicalize ulocimpgetBaseName75 uresopenWithType...

OSV-2024-7 Heap-buffer-overflow in icu_75::Locale::Locale

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65534 Crash type: Heap-buffer-overflow READ 1 Crash state: icu75::Locale::Locale plurrulefuzzer.cpp...

OSV-2024-6 Global-buffer-overflow in void jxl::N_AVX2::WriteToOutputStage::StoreUnsignedRow<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65533 Crash type: Global-buffer-overflow READ 16 Crash state: void jxl::NAVX2::WriteToOutputStage::StoreUnsignedRow jxl::NAVX2::WriteToOutputStage::OutputBuffers jxl::NAVX2::WriteToOutputStage::ProcessRow...

OSV-2024-4 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65484 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.nio.CharBuffer.wrap java.base/sun.nio.cs.StreamEncoder.implWrite...

OSV-2024-3 Stack-buffer-overflow in icu_75::TZDBTimeZoneNames::getMetaZoneNames

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65486 Crash type: Stack-buffer-overflow WRITE 1 Crash state: icu75::TZDBTimeZoneNames::getMetaZoneNames icu75::TZDBTimeZoneNames::getMetaZoneDisplayName TestNames...

OSV-2023-1382 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65429 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/sun.nio.cs.UTF8.updatePositions java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop...

OSV-2023-1381 Heap-buffer-overflow in NetworkInterface::processPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65428 Crash type: Heap-buffer-overflow READ 10 Crash state: NetworkInterface::processPacket NetworkInterface::dissectPacket fuzzdissectpacket.cpp...

OSV-2023-1378 Heap-buffer-overflow in ih264d_get_bits_h264

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65418 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dgetbitsh264 ih264dparsefgc ih264dparseseipayload...

OSV-2023-1377 UNKNOWN READ in FuzzedFileProvider::seek

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65417 Crash type: UNKNOWN READ Crash state: FuzzedFileProvider::seek IOdowrite IOfilecloseit...

OSV-2023-1375 Heap-buffer-overflow in IEC104Stats::processPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65402 Crash type: Heap-buffer-overflow READ 1 Crash state: IEC104Stats::processPacket Flow::processIEC60870Packet NetworkInterface::processPacket...

OSV-2023-1373 Heap-use-after-free in xmlRemoveID

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65409 Crash type: Heap-use-after-free READ 8 Crash state: xmlRemoveID xmlFreeProp xmlFreeNodeList...

OSV-2023-1372 Heap-use-after-free in JS_NewObjectFromShape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65393 Crash type: Heap-use-after-free WRITE 8 Crash state: JSNewObjectFromShape jsparsetemplate jsparsepostfixexpr...

OSV-2023-1370 Heap-buffer-overflow in process_one_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65383 Crash type: Heap-buffer-overflow READ 1 Crash state: processoneread cramencodecontainer cramflushcontainermt...

OSV-2023-1365 Heap-use-after-free in xmlStaticCopyNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65363 Crash type: Heap-use-after-free READ 8 Crash state: xmlStaticCopyNode xmlDocCopyNode xmlParseReference...

OSV-2023-1364 Heap-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65362 Crash type: Heap-buffer-overflow READ 2 Crash state: processClientServerHello processTLSBlock ndpisearchtlsudp...

OSV-2023-1363 Security exception in com.github.javaparser.CommentsInserter.insertComments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65361 Crash type: Security exception Crash state: com.github.javaparser.CommentsInserter.insertComments java.base/java.util.Objects.equals com.github.javaparser.Position.equals...

OSV-2023-1361 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65333 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/sun.nio.cs.UTF8.updatePositions java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop...

OSV-2023-1360 Heap-buffer-overflow in NetworkInterface::dissectPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65332 Crash type: Heap-buffer-overflow READ 2 Crash state: NetworkInterface::dissectPacket fuzzdissectpacket.cpp...

OSV-2023-1358 Heap-buffer-overflow in js_free_function_def

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65317 Crash type: Heap-buffer-overflow READ 4 Crash state: jsfreefunctiondef jsparsefunctiondecl2 jsparsepostfixexpr...

OSV-2023-1357 Heap-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65307 Crash type: Heap-buffer-overflow READ 2 Crash state: processClientServerHello processtls fuzzquicgetcryptodata.c...

OSV-2023-1356 Heap-buffer-overflow in rawspeed::DngDecoder::parseWhiteBalance

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65309 Crash type: Heap-buffer-overflow READ 4 Crash state: rawspeed::DngDecoder::parseWhiteBalance rawspeed::DngDecoder::decodeMetaDataInternal rawspeed::RawDecoder::decodeMetaData...

OSV-2023-1354 Heap-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65304 Crash type: Heap-buffer-overflow READ 2 Crash state: processClientServerHello processTLSBlock ndpisearchtlsudp...

OSV-2023-1353 Security exception in org.apache.poi.ddf.EscherContainerRecord.fillFields

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65303 Crash type: Security exception Crash state: org.apache.poi.ddf.EscherContainerRecord.fillFields org.apache.poi.hslf.record.Record.findChildRecords org.apache.poi.hslf.record.DummyPositionSensitiveRecordWithChildren...

OSV-2023-1352 Heap-buffer-overflow in Flow::dissectMDNS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65271 Crash type: Heap-buffer-overflow READ Crash state: Flow::dissectMDNS NetworkInterface::processPacket NetworkInterface::dissectPacket...

OSV-2023-1350 Heap-buffer-overflow in inflate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236 Crash type: Heap-buffer-overflow READ 1 Crash state: inflate uncompress2 uncompress...

OSV-2023-1344 Heap-buffer-overflow in jv_string_vfmt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65198 Crash type: Heap-buffer-overflow READ 2 Crash state: jvstringvfmt jvstringfmt jvget...