OSV-2023-1343 Heap-buffer-overflow in _libssh2_kex_agree_instr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65212 Crash type: Heap-buffer-overflow READ Crash state: libssh2kexagreeinstr libssh2packetadd fullpacket...

OSV-2023-1338 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65230 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/sun.nio.cs.UTF8.updatePositions java.base/sun.nio.cs.UTF8$Encoder.encodeArrayLoop...

OSV-2023-1329 Stack-buffer-overflow in decNaNs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65130 Crash type: Stack-buffer-overflow WRITE 2 Crash state: decNaNs decCompareOp decNumberCompare...

OSV-2023-1328 Stack-buffer-overflow in icu_75::TZDBTimeZoneNames::getMetaZoneNames

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65128 Crash type: Stack-buffer-overflow WRITE 1 Crash state: icu75::TZDBTimeZoneNames::getMetaZoneNames icu75::TZDBTimeZoneNames::getMetaZoneDisplayName TestNames...

OSV-2023-1327 Security exception in com.github.javaparser.CommentsInserter.insertComments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65140 Crash type: Security exception Crash state: com.github.javaparser.CommentsInserter.insertComments java.base/java.util.Objects.equals com.github.javaparser.Position.equals...

OSV-2023-1326 Security exception in java.base/java.lang.reflect.Array.newArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65139 Crash type: Security exception Crash state: java.base/java.lang.reflect.Array.newArray java.base/java.lang.reflect.Array.newInstance java.base/java.io.ObjectInputStream.readArray...

OSV-2023-1325 UNKNOWN WRITE in zero

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65135 Crash type: UNKNOWN WRITE Crash state: zero zendexecute fuzzerdorequestfrombuffer...

OSV-2023-1324 Heap-use-after-free in memory_bclose

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65104 Crash type: Heap-use-after-free READ 8 Crash state: memorybclose bfdclosealldone fuzzdwarf.c...

OSV-2023-1322 UNKNOWN READ in ih264d_filter_boundary_left_nonmbaff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65132 Crash type: UNKNOWN READ Crash state: ih264dfilterboundaryleftnonmbaff ih264ddeblockmbnonmbaff ih264ddecoderecontfrnmb...

OSV-2023-1320 Heap-use-after-free in memory_bstat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65108 Crash type: Heap-use-after-free READ 8 Crash state: memorybstat bfdgetsize bfdgetfilesize...

OSV-2023-1315 Heap-use-after-free in htmlParseDocument

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65112 Crash type: Heap-use-after-free READ 1 Crash state: htmlParseDocument htmlDoRead htmlCtxtReadMemory...

OSV-2023-1313 Heap-buffer-overflow in isvcd_start_of_pic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65060 Crash type: Heap-buffer-overflow WRITE Crash state: isvcdstartofpic isvcdparsedecodeslice isvcdparsenalunit...

OSV-2023-1312 Heap-buffer-overflow in ih264d_format_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65059 Crash type: Heap-buffer-overflow WRITE Crash state: ih264dformatconvert isvcdvideodecode isvcdapifunction...

OSV-2023-1311 Heap-buffer-overflow in ih264d_format_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65057 Crash type: Heap-buffer-overflow WRITE Crash state: ih264dformatconvert ih264ddecodepicturethread...

OSV-2023-1307 UNKNOWN READ in init_struct_ops_maps

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65047 Crash type: UNKNOWN READ Crash state: initstructopsmaps bpfobjectinitmaps bpfobjectopen...

OSV-2023-1306 Heap-use-after-free in pcpp::TLVRecordReader<pcpp::DhcpOption>::getTLVRecord

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65051 Crash type: Heap-use-after-free READ 1 Crash state: pcpp::TLVRecordReader::getTLVRecord pcpp::DhcpLayer::toString pcpp::Packet::toStringList...

OSV-2023-1305 Check failed in CheckUnwind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65035 Crash type: Check failed Crash state: CheckUnwind ivalignedfree ih264dfreedynamicbufs...

OSV-2023-1303 Heap-use-after-free in htmlCurrentChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65043 Crash type: Heap-use-after-free READ 1 Crash state: htmlCurrentChar htmlParseComment htmlParseDocument...

OSV-2023-1302 Global-buffer-overflow in pcre_get_compiled_regex_cache_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65030 Crash type: Global-buffer-overflow READ 1 Crash state: pcregetcompiledregexcacheex phpreplaceinsubject pregreplacecommon...

OSV-2023-1301 Global-buffer-overflow in xmlDictLookupInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65012 Crash type: Global-buffer-overflow READ 1 Crash state: xmlDictLookupInternal xmlDictLookupHashed xmlParseNCName...

OSV-2023-1300 Security exception in com.fasterxml.jackson.core.JsonParser.currentName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65024 Crash type: Security exception Crash state: com.fasterxml.jackson.core.JsonParser.currentName com.fasterxml.jackson.dataformat.yaml.YAMLParser.currentName com.fasterxml.jackson.dataformat.yaml.YAMLParser.getCurrentName...

OSV-2023-1299 Global-buffer-overflow in pcre_get_compiled_regex_cache_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65021 Crash type: Global-buffer-overflow READ 1 Crash state: pcregetcompiledregexcacheex phpdopcrematch zifpregmatch...

OSV-2023-1298 Heap-buffer-overflow in loongarch_split_args_by_comma

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65018 Crash type: Heap-buffer-overflow READ 1 Crash state: loongarchsplitargsbycomma printinsnloongarch disassemblesection...

OSV-2023-1295 Global-buffer-overflow in libraw_tagtype_dataunit_bytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65027 Crash type: Global-buffer-overflow READ 4 Crash state: librawtagtypedataunitbytes checkedbuffert::tiffsget LibRaw::parseSonySR2...

OSV-2023-1294 Heap-buffer-overflow in ih264d_compute_bs_non_mbaff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65031 Crash type: Heap-buffer-overflow READ 1 Crash state: ih264dcomputebsnonmbaff ih264dmvpredreftfrnby2pmb isvcdmarkerrsliceskip...

OSV-2023-1291 Security exception in org.apache.poi.poifs.crypt.binaryrc4.BinaryRC4Decryptor.initCipherForBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64979 Crash type: Security exception Crash state: org.apache.poi.poifs.crypt.binaryrc4.BinaryRC4Decryptor.initCipherForBlock org.apache.poi.poifs.crypt.binaryrc4.BinaryRC4Decryptor.initCipherForBlock...

OSV-2023-1286 Security exception in java.base/sun.security.util.DerInputStream.getUnalignedBitString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64975 Crash type: Security exception Crash state: java.base/sun.security.util.DerInputStream.getUnalignedBitString java.base/sun.security.x509.X509Key.parse java.base/sun.security.x509.CertificateX509Key...

OSV-2023-1276 Heap-use-after-free in authentic_emu_update_tokeninfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 Crash type: Heap-use-after-free READ 8 Crash state: authenticemuupdatetokeninfo scpkcs15initupdatetokeninfo scpkcs15initupdatelastupdate...

OSV-2023-1272 Heap-buffer-overflow in OT::cff2::accelerator_templ_t<CFF::cff2_private_dict_opset_t, CFF::cff2_private_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64859 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::cff2::acceleratortempltCFF::cff2privatedictopsett, CFF::cff2private hbotdrawglyph hbfontdrawglyph...

OSV-2023-1271 Heap-buffer-overflow in is_decl_requires_met

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64849 Crash type: Heap-buffer-overflow READ 8 Crash state: isdeclrequiresmet enableavrules linkmodules...

OSV-2023-1268 Stack-buffer-overflow in decNaNs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771 Crash type: Stack-buffer-overflow WRITE 2 Crash state: decNaNs decCompareOp decNumberCompare...

OSV-2023-1267 Heap-buffer-overflow in dwg_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64829 Crash type: Heap-buffer-overflow READ 8 Crash state: dwgfreeobject dwgfree llvmfuzz.c...

OSV-2023-1266 Security exception in java.base/javax.crypto.spec.SecretKeySpec.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64768 Crash type: Security exception Crash state: java.base/javax.crypto.spec.SecretKeySpec. org.apache.poi.poifs.crypt.binaryrc4.BinaryRC4Decryptor.initCipherForBlock...

OSV-2023-1265 Security exception in org.apache.poi.hdgf.streams.ChunkStream.findChunks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64782 Crash type: Security exception Crash state: org.apache.poi.hdgf.streams.ChunkStream.findChunks org.apache.poi.hdgf.streams.PointerContainingStream.findChildren...

OSV-2023-1263 Heap-buffer-overflow in js_is_live_code

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64726 Crash type: Heap-buffer-overflow READ 1 Crash state: jsislivecode jsparsestatementordecl jsparseblock...

OSV-2023-1259 Use-of-uninitialized-value in std::__1::__stdoutbuf<char>::xsputn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64693 Crash type: Use-of-uninitialized-value Crash state: std::1::stdoutbuf::xsputn std::1::ostreambufiterator std::1::pa std::1::basicostream & std::1::putcha...

OSV-2023-1256 Heap-buffer-overflow in H5T__bit_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64665 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Tbitcopy H5Tbitgetd H5Tconvff...

OSV-2023-1247 Heap-buffer-overflow in r_bin_coff_new_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64638 Crash type: Heap-buffer-overflow READ 4 Crash state: rbincoffnewbuf load rbinobjectnew...

OSV-2023-1244 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64641 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

OSV-2023-1243 Heap-use-after-free in zend_reference_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64579 Crash type: Heap-use-after-free READ 4 Crash state: zendreferencedestroy rcdtorfunc zendleavehelperSPEC...

OSV-2023-1240 UNKNOWN READ in MqttProps_Free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64570 Crash type: UNKNOWN READ Crash state: MqttPropsFree HandleProps MqttClientDecodePacket...

OSV-2023-1239 Heap-buffer-overflow in decToString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574 Crash type: Heap-buffer-overflow WRITE 1 Crash state: decToString decNumberToString jvnumbergetliteral...

OSV-2023-1232 Heap-buffer-overflow in pcpp::TLSECPointFormatExtension::getECPointFormatList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64543 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::TLSECPointFormatExtension::getECPointFormatList pcpp::SSLClientHelloMessage::generateTLSFingerprint readParsedPacket...

OSV-2023-1231 Global-buffer-overflow in iaace_estimate_scfs_chan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64532 Crash type: Global-buffer-overflow READ 4 Crash state: iaaceestimatescfschan iaenhaacplusencqcmain iaenhaacplusencaaccoreencode...

OSV-2023-1228 Stack-buffer-overflow in asn1_decode_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64522 Crash type: Stack-buffer-overflow READ 8 Crash state: asn1decodeentry asn1decode scasn1decode...

OSV-2023-1227 Stack-buffer-overflow in io_memory_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64529 Crash type: Stack-buffer-overflow WRITE 11 Crash state: iomemoryread riopluginread riodescread...

OSV-2023-1223 Heap-buffer-overflow in H5O__shared_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64525 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Oshareddecode H5Odtypeshareddecode H5Omsgreadoh...

OSV-2023-1222 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64514 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.nio.ByteBuffer.position java.base/sun.nio.cs.UTF8.updatePositions...

OSV-2023-1221 Security exception in jaz.Zer.reportFinding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64488 Crash type: Security exception Crash state: jaz.Zer.reportFinding jaz.Zer.reportFindingIfEnabled jaz.Zer.readObject...

OSV-2023-1214 Heap-buffer-overflow in NetworkInterface::dissectPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64454 Crash type: Heap-buffer-overflow READ 2 Crash state: NetworkInterface::dissectPacket fuzzdissectpacket.cpp...