OSV-2023-795 Security exception in org.apache.poi.hwpf.converter.AbstractWordConverter.processNoteAnchor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62068 Crash type: Security exception Crash state: org.apache.poi.hwpf.converter.AbstractWordConverter.processNoteAnchor org.apache.poi.hwpf.converter.AbstractWordConverter.processCharacters...

OSV-2023-793 Security exception in org.apache.lucene.util.BytesRefBuilder.<init>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62034 Crash type: Security exception Crash state: org.apache.lucene.util.BytesRefBuilder. org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone...

OSV-2023-783 Use-after-poison in parser_yylex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61941 Crash type: Use-after-poison READ 8 Crash state: parseryylex rubyyyparse yycompile0...

OSV-2023-779 Use-of-uninitialized-value in dev_io_capture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61919 Crash type: Use-of-uninitialized-value Crash state: deviocapture deviorun audioiothread...

OSV-2023-777 Heap-buffer-overflow in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61901 Crash type: Heap-buffer-overflow READ 1 Crash state: dxffixupstring dxfheaderwrite dwgwritedxf...

OSV-2023-776 Heap-buffer-overflow in ndpi_domain_classify_contains

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61882 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpidomainclassifycontains ndpigetcustomcategorymatch ndpimatchhostsubprotocol...

OSV-2023-775 Security exception in com.github.javaparser.CommentsInserter.insertComments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61895 Crash type: Security exception Crash state: com.github.javaparser.CommentsInserter.insertComments java.base/java.util.Objects.equals com.github.javaparser.Position.equals...

OSV-2023-769 Index-out-of-bounds in derive_spatial_luma_vector_prediction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61844 Crash type: Index-out-of-bounds Crash state: derivespatiallumavectorprediction filllumamotionvectorpredictors motionvectorsandrefindices...

OSV-2023-764 Heap-buffer-overflow in pim_pim_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61854 Crash type: Heap-buffer-overflow READ 2 Crash state: pimpimpacket pimmain.c...

OSV-2023-761 Heap-buffer-overflow in ICMPinfo::dissectICMP

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61836 Crash type: Heap-buffer-overflow READ 4 Crash state: ICMPinfo::dissectICMP NetworkInterface::processPacket NetworkInterface::dissectPacket...

OSV-2023-758 Heap-double-free in bit_TV_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61818 Crash type: Heap-double-free Crash state: bitTVtoutf8 jsoncquote jsonheaderwriteprivate...

OSV-2023-756 Heap-buffer-overflow in rawspeed::DngDecoder::decodeMetaDataInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61800 Crash type: Heap-buffer-overflow READ 4 Crash state: rawspeed::DngDecoder::decodeMetaDataInternal rawspeed::RawDecoder::decodeMetaData...

OSV-2023-754 Heap-buffer-overflow in H5O__chunk_protect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61803 Crash type: Heap-buffer-overflow READ 8 Crash state: H5Ochunkprotect H5Ochunkdelete H5Ocontdelete...

OSV-2023-753 Stack-buffer-overflow in iasecc_crt_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61797 Crash type: Stack-buffer-overflow READ 1 Crash state: iasecccrtparse iaseccseparse iaseccsegetinfo...

OSV-2023-750 Security exception in org.antlr.v4.runtime.atn.PredictionContext.fromRuleContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61786 Crash type: Security exception Crash state: org.antlr.v4.runtime.atn.PredictionContext.fromRuleContext java.base/jdk.internal.misc.Unsafe.weakCompareAndSetInt java.base/jdk.internal.misc.Unsafe.getAndAddInt...

OSV-2023-748 Segv on unknown address in dwg_encode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61795 Crash type: Segv on unknown address Crash state: dwgencode llvmfuzz.c...

OSV-2023-747 Segv on unknown address in kh_get_ucl_hash_caseless_node

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61794 Crash type: Segv on unknown address Crash state: khgetuclhashcaselessnode uclhashsearch uclincludefilesingle...

OSV-2023-745 Heap-buffer-overflow in pcpp::SomeIpSdLayer::isDataValid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61774 Crash type: Heap-buffer-overflow READ 4 Crash state: pcpp::SomeIpSdLayer::isDataValid pcpp::SomeIpLayer::parseSomeIpLayer pcpp::UdpLayer::parseNextLayer...

OSV-2023-744 Stack-buffer-overflow in sc_color_fprintf_va

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61750 Crash type: Stack-buffer-overflow READ Crash state: sccolorfprintfva scdologva scdolog...

OSV-2023-743 Out-of-memory in QueryParserFuzzer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61742 Crash type: Out-of-memory Crash state: QueryParserFuzzer...

OSV-2023-742 Security exception in org.json.JSONArray.writeTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61747 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...

OSV-2023-741 Heap-buffer-overflow in Flow::dissectBittorrent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61737 Crash type: Heap-buffer-overflow READ 1 Crash state: Flow::dissectBittorrent NetworkInterface::processPacket NetworkInterface::dissectPacket...

OSV-2023-739 UNKNOWN READ in OT::glyph_variations_t::create_from_glyphs_var_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61724 Crash type: UNKNOWN READ Crash state: OT::glyphvariationst::createfromglyphsvardata OT::gvar::decompileglyphvariations OT::gvar::instantiate...

OSV-2023-738 Use-of-uninitialized-value in _PyFunction_FromConstructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61721 Crash type: Use-of-uninitialized-value Crash state: PyFunctionFromConstructor PyEvalEvalCode execcodeinmodule...

OSV-2023-736 Heap-buffer-overflow in HeifContext::interpret_heif_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61718 Crash type: Heap-buffer-overflow READ 4 Crash state: HeifContext::interpretheiffile HeifContext::readfrommemory heifcontextreadfrommemory...

OSV-2023-734 Container-overflow in libbrotlidec.so.1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61675 Crash type: Container-overflow WRITE Crash state: libbrotlidec.so.1 BrotliDecoderDecompressStream Exiv2::BmffImage::brotliUncompress...

OSV-2023-728 Use-of-uninitialized-value in aesEncryptBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61670 Crash type: Use-of-uninitialized-value Crash state: aesEncryptBlock EncryptStream::lookChar BaseCryptStream::getChar...

OSV-2023-726 Heap-buffer-overflow in Flow::dissectNetBIOS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61648 Crash type: Heap-buffer-overflow READ 1 Crash state: Flow::dissectNetBIOS NetworkInterface::processPacket NetworkInterface::dissectPacket...

OSV-2023-723 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61626 Crash type: Heap-buffer-overflow WRITE Crash state: H5MMmemcpy H5Dscattermem H5Dscatgathread...

OSV-2023-722 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61625 Crash type: Heap-buffer-overflow READ Crash state: H5MMmemcpy H5Ocachechkserialize H5Cgenerateimage...

OSV-2023-721 Stack-buffer-overflow in crc24q_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61617 Crash type: Stack-buffer-overflow READ 1 Crash state: crc24qcheck packetparse FuzzPacket.c...

OSV-2023-719 Security exception in org.apache.commons.jxpath.ri.compiler.CoreFunction.toString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61597 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.compiler.CoreFunction.toString java.base/java.lang.String.valueOf java.base/java.lang.StringBuilder.append...

OSV-2023-717 Heap-buffer-overflow in bit_TV_to_utf8_codepage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61593 Crash type: Heap-buffer-overflow READ 1 Crash state: bitTVtoutf8codepage bitTVtoutf8 dwgdecodeLAYOUTprivate...

OSV-2023-716 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61603 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.core.convert.support.GenericConversionService$ConverterCache...

OSV-2023-715 Stack-use-after-scope in ulocimp_addLikelySubtags_74

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61582 Crash type: Stack-use-after-scope READ 3 Crash state: ulocimpaddLikelySubtags74 ulocisRightToLeft74 ulocisrighttoleftfuzzer.cpp...

OSV-2023-714 Security exception in org.apache.poi.ddf.EscherContainerRecord.fillFields

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61562 Crash type: Security exception Crash state: org.apache.poi.ddf.EscherContainerRecord.fillFields java.base/java.util.HashMap.getNode java.base/java.util.HashMap.get...

OSV-2023-710 Heap-buffer-overflow in Flow::dissectMDNS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61538 Crash type: Heap-buffer-overflow READ 10 Crash state: Flow::dissectMDNS NetworkInterface::processPacket NetworkInterface::dissectPacket...

OSV-2023-709 Heap-buffer-overflow in QOIHandler::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61528 Crash type: Heap-buffer-overflow READ 1 Crash state: QOIHandler::read kimgiofuzzer.cc...

OSV-2023-705 Security exception in org.apache.lucene.util.automaton.RegExp.toAutomaton

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61493 Crash type: Security exception Crash state: org.apache.lucene.util.automaton.RegExp.toAutomaton java.base/java.util.BitSet.ensureCapacity java.base/java.util.BitSet.expandTo...

OSV-2023-697 Heap-buffer-overflow in IEC104Stats::processPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61443 Crash type: Heap-buffer-overflow READ 1 Crash state: IEC104Stats::processPacket Flow::processIEC60870Packet NetworkInterface::processPacket...

OSV-2023-696 Security exception in org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61423 Crash type: Security exception Crash state: org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone org.apache.lucene.analysis.tokenattributes.PackedTokenAttributeImpl.clone...

OSV-2023-693 Security exception in org.json.JSONArray.writeTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61399 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...

OSV-2023-692 Invalid-free in reset_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61397 Crash type: Invalid-free Crash state: resetcontext finishmetric cmtdecodeprometheusparse...

OSV-2023-689 Use-of-uninitialized-value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61380 Crash type: Use-of-uninitialized-value Crash state: NULL...

OSV-2023-688 Invalid-free in Flow::~Flow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61361 Crash type: Invalid-free Crash state: Flow::Flow Flow::Flow GenericHash::cleanup...

OSV-2023-685 Invalid-free in reset_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61339 Crash type: Invalid-free Crash state: resetcontext cmtdecodeprometheuscreate cmetricsdecodefuzz.c...

OSV-2023-684 Heap-use-after-free in __xmlRaiseError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61337 Crash type: Heap-use-after-free READ 2 Crash state: xmlRaiseError htmlParseErr htmlCurrentChar...

OSV-2023-680 Security exception in org.apache.poi.hdgf.streams.PointerContainingStream.findChildren

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61372 Crash type: Security exception Crash state: org.apache.poi.hdgf.streams.PointerContainingStream.findChildren...

OSV-2023-676 Security exception in com.github.javaparser.ast.visitor.CloneVisitor.visit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61313 Crash type: Security exception Crash state: com.github.javaparser.ast.visitor.CloneVisitor.visit com.github.javaparser.ast.type.ClassOrInterfaceType.accept com.github.javaparser.ast.visitor.CloneVisitor.cloneNode...

OSV-2023-675 Heap-use-after-free in parse_options

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61292 Crash type: Heap-use-after-free WRITE 4 Crash state: parseoptions appendnewoperation parseoptions...