OSV-2023-959 Heap-buffer-overflow in _dwarf_memcpy_noswap_bytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62943 Crash type: Heap-buffer-overflow READ 8 Crash state: dwarfmemcpynoswapbytes fillinuniarch64 dwarfmachosetup...

OSV-2023-957 Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62967 Crash type: Security exception Crash state: com.github.javaparser.ast.validator.TreeVisitorValidator.accept com.github.javaparser.ast.expr.FieldAccessExpr.getMetaModel...

OSV-2023-955 Security exception in org.apache.poi.ddf.EscherPropertyFactory$$Lambda$285/ADDRESS.apply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62924 Crash type: Security exception Crash state: org.apache.poi.ddf.EscherPropertyFactory$$Lambda$285/ADDRESS.apply org.apache.poi.ddf.EscherPropertyFactory.createProperties org.apache.poi.ddf.AbstractEscherOptRecord.fillFiel...

OSV-2023-953 Heap-buffer-overflow in xmlDictLookupInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62911 Crash type: Heap-buffer-overflow READ Crash state: xmlDictLookupInternal xmlDictLookup htmlParseNameComplex...

OSV-2023-952 Heap-buffer-overflow in back_passDoAction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62875 Crash type: Heap-buffer-overflow READ 10 Crash state: backpassDoAction loubackTranslate loubackTranslateString...

OSV-2023-948 Global-buffer-overflow in isvce_write_coeff4x4_cavlc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62896 Crash type: Global-buffer-overflow READ 1 Crash state: isvcewritecoeff4x4cavlc isvceencoderesidue isvcewritepslicembcavlc...

OSV-2023-942 Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62864 Crash type: Security exception Crash state: com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop java.base/sun.nio.cs.CESU8$Encoder.encodeLoo...

OSV-2023-940 Heap-buffer-overflow in _dwarf_memcpy_swap_bytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62842 Crash type: Heap-buffer-overflow READ 1 Crash state: dwarfmemcpyswapbytes fillinuniarch64 dwarfmachosetup...

OSV-2023-937 Heap-buffer-overflow in pack_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62822 Crash type: Heap-buffer-overflow READ 1 Crash state: packunpack mrbpackunpack mrbvmexec...

OSV-2023-936 Heap-buffer-overflow in Gfx::decode_bmp_pixel_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62782 Crash type: Heap-buffer-overflow READ 1 Crash state: Gfx::decodebmppixeldata Gfx::BMPImageDecoderPlugin::frame Gfx::ICOImageDecoderPlugin::loadicobitmap...

OSV-2023-934 Index-out-of-bounds in wabt::BinaryReaderObjdump::OnReloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42528652 Crash type: Index-out-of-bounds Crash state: wabt::BinaryReaderObjdump::OnReloc wabt::BinaryReader::ReadRelocSection wabt::BinaryReader::ReadCustomSection...

OSV-2023-930 Heap-buffer-overflow in OT::cvar::decompile_tuple_variations

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62774 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::cvar::decompiletuplevariations OT::cvar::subset bool trysubset...

OSV-2023-920 Security exception in com.github.javaparser.GeneratedJavaParser.Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62731 Crash type: Security exception Crash state: com.github.javaparser.GeneratedJavaParser.Expression java.base/sun.nio.cs.CESU8$Encoder.to3Bytes java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...

OSV-2023-905 Segv on unknown address in icu_74::UnicodeString::copyFrom

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62651 Crash type: Segv on unknown address Crash state: icu74::UnicodeString::copyFrom icu74::UnicodeString::UnicodeString icu74::number::impl::SimpleModifier::SimpleModifier...

OSV-2023-903 Heap-double-free in snmp_e2e_fuzzer.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62604 Crash type: Heap-double-free Crash state: snmpe2efuzzer.c netsnmpcleanupsession snmpe2efuzzer.c...

OSV-2023-901 UNKNOWN READ in icu_74::RelativeDateTimeFormatter::formatRelativeImpl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62601 Crash type: UNKNOWN READ Crash state: icu74::RelativeDateTimeFormatter::formatRelativeImpl icu74::FormattedRelativeDateTime icu74::RelativeDateTimeFormatter::doFormatToV icu74::RelativeDateTimeFormatter::formatToValue...

OSV-2023-899 Heap-buffer-overflow in cosm_create_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62613 Crash type: Heap-buffer-overflow READ 1 Crash state: cosmcreatekey scpkcs15initgeneratekey dogeneratekey...

OSV-2023-896 UNKNOWN READ in deliver_chunked_chunks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62609 Crash type: UNKNOWN READ Crash state: deliverchunkedchunks httpcb fuzz.c...

OSV-2023-894 Heap-double-free in dwg_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62561 Crash type: Heap-double-free Crash state: dwgfreeobject dwgfree llvmfuzz.c...

OSV-2023-893 Heap-buffer-overflow in initialize_encryption_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62542 Crash type: Heap-buffer-overflow READ Crash state: initializeencryptionkey cliole2extract cliscanole2...

OSV-2023-890 Heap-use-after-free in dwarf_dealloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62547 Crash type: Heap-use-after-free READ 2 Crash state: dwarfdealloc dwarffdedestructor tdestroyfreenode...

OSV-2023-889 Heap-double-free in regcomp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62529 Crash type: Heap-double-free Crash state: regcomp fileregcomp load1...

OSV-2023-885 UNKNOWN READ in bytes1_char_at

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62508 Crash type: UNKNOWN READ Crash state: bytes1charat asciiatlineend trymatch...

OSV-2023-883 Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62524 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.copyOfSubArray org.apache.lucene.util.BytesRef.deepCopyOf org.apache.lucene.index.Term...

OSV-2023-881 Heap-buffer-overflow in read_tmpl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62500 Crash type: Heap-buffer-overflow READ 1 Crash state: readtmpl mrbpackpack mrbvmexec...

OSV-2023-877 Heap-buffer-overflow in btf_ensure_modifiable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62465 Crash type: Heap-buffer-overflow READ 4 Crash state: btfensuremodifiable btfaddvar bpfobjectcollectexterns...

OSV-2023-874 Memcpy-param-overlap in bit_u_expand

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62461 Crash type: Memcpy-param-overlap Crash state: bituexpand bitTVtoutf8 dwgdecodeheadervariables...

OSV-2023-873 UNKNOWN WRITE in icu_74::Calendar::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62425 Crash type: UNKNOWN WRITE Crash state: icu74::Calendar::set calendarfuzzer.cpp...

OSV-2023-872 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62457 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

OSV-2023-869 Heap-buffer-overflow in Assimp::MD5::MD5MeshParser::MD5MeshParser

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62441 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::MD5::MD5MeshParser::MD5MeshParser Assimp::MD5Importer::LoadMD5MeshFile Assimp::MD5Importer::InternReadFile...

OSV-2023-870 Heap-buffer-overflow in icu_74::SimpleDateFormat::subFormat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62432 Crash type: Heap-buffer-overflow READ 4 Crash state: icu74::SimpleDateFormat::subFormat icu74::SimpleDateFormat::format icu74::SimpleDateFormat::format...

OSV-2023-867 Negative-size-param in http_cb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62389 Crash type: Negative-size-param Crash state: httpcb fuzz.c...

OSV-2023-865 UNKNOWN in WasmEdge::Loader::SharedLibrary::load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62387 Crash type: UNKNOWN Crash state: WasmEdge::Loader::SharedLibrary::load WasmEdge::Loader::Loader::loadModule WasmEdge::Loader::Loader::parseModule...

OSV-2023-862 Heap-use-after-free in g_datalist_get_flags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62381 Crash type: Heap-use-after-free READ 8 Crash state: gdatalistgetflags gobjectunref gstobjectunref...

OSV-2023-857 Segv on unknown address in FunctionCompiler::compileReturn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62375 Crash type: Segv on unknown address Crash state: FunctionCompiler::compileReturn WasmEdge::AOT::Compiler::compile WasmEdge::AOT::Compiler::compile...

OSV-2023-855 Heap-double-free in dwg_free_common_entity_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62367 Crash type: Heap-double-free Crash state: dwgfreecommonentitydata dwgfreePOINTCLOUD dwgfreevariablenoclass...

OSV-2023-850 Heap-buffer-overflow in bit_TV_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62363 Crash type: Heap-buffer-overflow WRITE 1 Crash state: bitTVtoutf8 jsoncquote dwgjsonLAYOUTprivate...

OSV-2023-849 Stack-buffer-overflow in ulocimp_toLanguageTag_74

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62348 Crash type: Stack-buffer-overflow WRITE 1 Crash state: ulocimptoLanguageTag74 icu74::Locale::toLanguageTag localemorphfuzzer.cpp...

OSV-2023-844 Heap-buffer-overflow in Video::VP9::Decoder::create_video_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62307 Crash type: Heap-buffer-overflow READ Crash state: Video::VP9::Decoder::createvideoframe Video::VP9::Decoder::decodeframe Video::VP9::Decoder::receivesample...

OSV-2023-840 Null-dereference READ in isvcd_parse_inter_slice_data_cavlc_enh_lyr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62290 Crash type: Null-dereference READ Crash state: isvcdparseinterslicedatacavlcenhlyr isvcdparseepslice isvcdparsedecodesliceextnal...

OSV-2023-839 Global-buffer-overflow in iusace_quantize_lines

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62261 Crash type: Global-buffer-overflow READ 4 Crash state: iusacequantizelines iusacequantizespec iusacefdencode...

OSV-2023-838 Use-of-uninitialized-value in wabt::BinaryReaderIR::OnOpcode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62267 Crash type: Use-of-uninitialized-value Crash state: wabt::BinaryReaderIR::OnOpcode wabt::BinaryReader::ReadInstructions wabt::ReadBinary...

OSV-2023-837 Heap-buffer-overflow in uint7_get_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62270 Crash type: Heap-buffer-overflow READ 1 Crash state: uint7get64 cramhuffmandecodeinit cramdecoderinit...

OSV-2023-819 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62167 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2023-813 UNKNOWN READ in parse_priv_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62188 Crash type: UNKNOWN READ Crash state: parseprivvalue parseprivacy fuzzparsemsg.c...

OSV-2023-811 Invalid-free in bit_chain_alloc_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62132 Crash type: Invalid-free Crash state: bitchainallocsize bitwriteRC bitHtodat...

OSV-2023-806 Heap-buffer-overflow in H5F__accum_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62135 Crash type: Heap-buffer-overflow READ Crash state: H5Faccumfree H5MFxfree H5MFfreeaggrs...

OSV-2023-800 Heap-buffer-overflow in XCFImageFormat::loadTileRLE

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62098 Crash type: Heap-buffer-overflow WRITE 1 Crash state: XCFImageFormat::loadTileRLE XCFImageFormat::loadLevel XCFImageFormat::loadHierarchy...

OSV-2023-798 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62081 Crash type: Memcpy-param-overlap Crash state: repeat repeat pere...

OSV-2023-797 Stack-buffer-overflow in QBuffer::readData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62075 Crash type: Stack-buffer-overflow WRITE Crash state: QBuffer::readData QIODevicePrivate::read QDataStream::readRawData...