OSV-2023-674 Heap-buffer-overflow in get_grouplength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61269 Crash type: Heap-buffer-overflow WRITE 4 Crash state: getgrouplength getbranchlength getgrouplength...

OSV-2023-673 Heap-buffer-overflow in match

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61268 Crash type: Heap-buffer-overflow READ 1 Crash state: match pcre2match8 pcre2fuzzsupport.c...

OSV-2023-665 Security exception in org.apache.poi.hdgf.streams.PointerContainingStream.findChildren

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61256 Crash type: Security exception Crash state: org.apache.poi.hdgf.streams.PointerContainingStream.findChildren org.apache.poi.util.IOUtils.checkLength org.apache.poi.util.IOUtils.safelyAllocateCheck...

OSV-2023-663 Segv on unknown address in decUnitCompare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61235 Crash type: Segv on unknown address Crash state: decUnitCompare decCompare decCompareOp...

OSV-2023-662 Security exception in org.apache.commons.io.IOUtils.byteArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61254 Crash type: Security exception Crash state: org.apache.commons.io.IOUtils.byteArray org.apache.commons.io.output.AbstractByteArrayOutputStream.needNewBuffer org.apache.commons.io.output.UnsynchronizedByteArrayOutputStrea...

OSV-2023-660 Security exception in org.apache.poi.hwpf.model.StyleSheet.createPap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61252 Crash type: Security exception Crash state: org.apache.poi.hwpf.model.StyleSheet.createPap org.apache.poi.util.BitField.getRawValue org.apache.poi.util.BitField.getValue...

OSV-2023-650 Heap-use-after-free in yr_parser_lookup_loop_variable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61164 Crash type: Heap-use-after-free READ 1 Crash state: yrparserlookuploopvariable yarayyparse yrlexparserulesfile...

OSV-2023-648 Stack-buffer-overflow in parse_regex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61131 Crash type: Stack-buffer-overflow READ 1 Crash state: parseregex parseregex parseregex...

OSV-2023-645 Segv on unknown address in decUnitCompare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61050 Crash type: Segv on unknown address Crash state: decUnitCompare decCompare decCompareOp...

OSV-2023-640 Stack-buffer-overflow in initialize_encryption_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61039 Crash type: Stack-buffer-overflow READ Crash state: initializeencryptionkey cliole2extract cliscanole2...

OSV-2022-1280 Heap-buffer-overflow in Canvas5Structure::NIBDecoder::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61081 Crash type: Heap-buffer-overflow READ 1 Crash state: Canvas5Structure::NIBDecoder::decode Canvas5Structure::decodeZone5 Canvas5Parser::decode...

OSV-2023-639 Heap-buffer-overflow in ucl_hash_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61062 Crash type: Heap-buffer-overflow READ 8 Crash state: uclhashdestroy uclobjectdtorunrefsingle uclobjectdtorunref...

OSV-2023-636 Security exception in jflex.core.NFA.insertNFA

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61028 Crash type: Security exception Crash state: jflex.core.NFA.insertNFA jflex.core.NFA.insertNFA jflex.core.NFA.insertNFA...

OSV-2023-634 Heap-buffer-overflow in bit_read_BB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60993 Crash type: Heap-buffer-overflow READ 1 Crash state: bitreadBB bitreadBS dwgdecodeATTDEFprivate...

OSV-2023-631 Heap-buffer-overflow in test_verify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60971 Crash type: Heap-buffer-overflow READ Crash state: testverify fuzzpkcs11.c...

OSV-2023-627 Security exception in org.apache.lucene.util.automaton.RegExp.toAutomaton

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60964 Crash type: Security exception Crash state: org.apache.lucene.util.automaton.RegExp.toAutomaton java.base/java.util.BitSet.ensureCapacity java.base/java.util.BitSet.expandTo...

OSV-2023-623 Heap-use-after-free in Elf32_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60863 Crash type: Heap-use-after-free READ 8 Crash state: Elf32free destroy rbinfilefree...

OSV-2023-619 Security exception in java.base/java.util.regex.Pattern$GroupTail.match

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60846 Crash type: Security exception Crash state: java.base/java.util.regex.Pattern$GroupTail.match java.base/java.io.BufferedWriter.ensureOpen java.base/java.io.BufferedWriter.write...

OSV-2023-618 Security exception in java.base/java.util.regex.Pattern$Loop.match

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60845 Crash type: Security exception Crash state: java.base/java.util.regex.Pattern$Loop.match java.base/java.util.regex.Pattern$GroupTail.match java.base/java.util.regex.Pattern$BranchConn.match...

OSV-2023-617 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60844 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.Exception. java.base/java.lang.RuntimeException...

OSV-2023-610 Security exception in org.apache.lucene.util.automaton.RegExp.toAutomaton

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60782 Crash type: Security exception Crash state: org.apache.lucene.util.automaton.RegExp.toAutomaton java.base/java.util.BitSet.ensureCapacity java.base/java.util.BitSet.expandTo...

OSV-2023-609 Stack-buffer-overflow in sc_pkcs15_get_lastupdate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60769 Crash type: Stack-buffer-overflow READ Crash state: scpkcs15getlastupdate generatecachefilename scpkcs15readcachedfile...

OSV-2023-606 Heap-buffer-overflow in ZSTD_decompressMultiFrame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778 Crash type: Heap-buffer-overflow READ Crash state: ZSTDdecompressMultiFrame ZSTDdecompressusingDDict zstdwrapdecompress...

OSV-2023-605 Heap-use-after-free in Elf64_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60790 Crash type: Heap-use-after-free READ 8 Crash state: Elf64free destroy rbinfilefree...

OSV-2023-604 Segv on unknown address in ucl_object_free_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60789 Crash type: Segv on unknown address Crash state: uclobjectfreeinternal uclparserfree ucladdstringfuzzer.c...

OSV-2023-599 Negative-size-param in passDoAction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60723 Crash type: Negative-size-param Crash state: passDoAction translateString loutranslate...

OSV-2023-598 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60734 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2023-586 Heap-buffer-overflow in setcos_create_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60672 Crash type: Heap-buffer-overflow READ 1 Crash state: setcoscreatekey scpkcs15initgeneratekey dogeneratekey...

OSV-2023-583 Segv on unknown address in ucl_hash_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60678 Crash type: Segv on unknown address Crash state: uclhashdestroy uclobjectdtorunrefsingle uclobjectdtorunref...

OSV-2023-581 Heap-buffer-overflow in wwunpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60655 Crash type: Heap-buffer-overflow WRITE 1 Crash state: wwunpack cliscanpe climagicscan...

OSV-2023-580 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60640 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.Exception. java.base/java.lang.RuntimeException...

OSV-2023-578 Heap-buffer-overflow in cosm_new_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60650 Crash type: Heap-buffer-overflow READ 1 Crash state: cosmnewfile cosmcreatekey scpkcs15initgeneratekey...

OSV-2023-576 Heap-double-free in sc_pkcs15_free_object_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60616 Crash type: Heap-double-free Crash state: scpkcs15freeobjectcontent scpkcs15freeobject fuzzpkcs15decode.c...

OSV-2023-573 Negative-size-param in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60605 Crash type: Negative-size-param Crash state: checkcontenttypeandchangeprotocol processresponse ndpicheckhttptcp...

OSV-2023-568 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60565 Crash type: Memcpy-param-overlap Crash state: repeat repeat pere...

OSV-2023-567 Stack-buffer-overflow in initialize_encryption_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60563 Crash type: Stack-buffer-overflow READ Crash state: initializeencryptionkey cliole2extract cliscanole2...

OSV-2023-566 Heap-buffer-overflow in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60557 Crash type: Heap-buffer-overflow READ 1 Crash state: checkcontenttypeandchangeprotocol processresponse ndpicheckhttptcp...

OSV-2023-562 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60538 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::EvaluateValue...

OSV-2023-560 Stack-buffer-overflow in sc_pkcs15_get_lastupdate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60527 Crash type: Stack-buffer-overflow READ Crash state: scpkcs15getlastupdate generatecachefilename scpkcs15readcachedfile...

OSV-2023-556 Heap-buffer-overflow in xt_valid_enum_values

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60514 Crash type: Heap-buffer-overflow READ 4 Crash state: xtvalidenumvalues xtvalidateimpl ddsixttypeaddtypeobj...

OSV-2023-555 Heap-buffer-overflow in Gfx::InputStreamer::read_u24

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60465 Crash type: Heap-buffer-overflow READ 1 Crash state: Gfx::InputStreamer::readu24 AK::Function Gfx::BMPImageDecoderPlugin::frame...

OSV-2023-554 Heap-buffer-overflow in OT::CmapSubtable::get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60475 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::CmapSubtable::getglyph bool OT::cmap::acceleratort::getglyphfrom hbotgetnominalglyphs...

OSV-2023-551 Heap-buffer-overflow in OT::CmapSubtable::collect_unicodes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60467 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::CmapSubtable::collectunicodes hbfacecollectunicodes test-ot-face.c...

OSV-2023-547 UNKNOWN READ in r_str_ncpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60407 Crash type: UNKNOWN READ Crash state: rstrncpy Elf32rbinelfloadsymbolsandimports Elf32loadsymbols...

OSV-2023-546 Invalid-free in jpeg_free_large

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60379 Crash type: Invalid-free Crash state: jpegfreelarge jpegabort jpegfinishdecompress...

OSV-2023-543 Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60355 Crash type: Security exception Crash state: com.github.javaparser.ast.validator.TreeVisitorValidator.accept com.github.javaparser.ast.expr.FieldAccessExpr.getMetaModel...

OSV-2023-542 Security exception in net.jsign.appx.Zip64EndOfCentralDirectoryRecord.read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60308 Crash type: Security exception Crash state: net.jsign.appx.Zip64EndOfCentralDirectoryRecord.read net.jsign.appx.CentralDirectory.read net.jsign.appx.ZipFile...

OSV-2023-538 Heap-buffer-overflow in Gfx::BooleanDecoder::initialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60262 Crash type: Heap-buffer-overflow READ 7 Crash state: Gfx::BooleanDecoder::initialize Video::VP9::FrameContext::createrangedecoder Video::VP9::Parser::compressedheader...

OSV-2023-536 Heap-buffer-overflow in Assimp::MD5::MD5Parser::ParseHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60274 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::MD5::MD5Parser::ParseHeader Assimp::MD5::MD5Parser::MD5Parser Assimp::MD5Importer::LoadMD5MeshFile...

OSV-2023-533 Security exception in org.apache.lucene.util.ArrayUtil.growExact

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60248 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.growExact org.apache.lucene.util.ArrayUtil.grow org.apache.lucene.util.BytesRefBuilder.grow...