OSV-2023-421 Global-buffer-overflow in hf_adjustment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59185 Crash type: Global-buffer-overflow READ 4 Crash state: hfadjustment sbrprocesschannel sbrDecodeCoupleFrame...

OSV-2023-420 Heap-use-after-free in fragment_addresses_equal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59173 Crash type: Heap-use-after-free READ 6 Crash state: fragmentaddressesequal ghashtablelookupextended fragmentaddseqsinglework...

OSV-2023-418 Heap-buffer-overflow in bfd_getl32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59148 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetl32 bfdstabsectionfindnearestline cofffindnearestlinewithnames...

OSV-2023-416 UNKNOWN READ in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59118 Crash type: UNKNOWN READ Crash state: dxffixupstring dwgdxfDIMENSIONALIGNEDprivate dwgdxfDIMENSIONALIGNED...

OSV-2023-415 UNKNOWN READ in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59097 Crash type: UNKNOWN READ Crash state: dxffixupstring dwgdxfLAYOUTprivate dwgdxfLAYOUT...

OSV-2023-412 UNKNOWN READ in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59089 Crash type: UNKNOWN READ Crash state: dxffixupstring dxfheaderwrite dwgwritedxf...

OSV-2023-409 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59072 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2023-408 Security exception in org.apache.lucene.util.ArrayUtil.growExact

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59071 Crash type: Security exception Crash state: org.apache.lucene.util.ArrayUtil.growExact org.apache.lucene.util.ArrayUtil.grow org.apache.lucene.util.BytesRefBuilder.grow...

OSV-2023-407 Stack-buffer-overflow in DwaCompressor_readChannelRules

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59070 Crash type: Stack-buffer-overflow READ Crash state: DwaCompressorreadChannelRules DwaCompressoruncompress internalexrundodwaa...

OSV-2023-405 Heap-buffer-overflow in _lou_stringHash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59057 Crash type: Heap-buffer-overflow READ 2 Crash state: loustringHash loutranslate loutranslateString...

OSV-2023-404 Invalid-free in Assimp::FBX::Scope::Scope

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59056 Crash type: Invalid-free Crash state: Assimp::FBX::Scope::Scope Assimp::FBX::Element::Element Assimp::FBX::Scope::Scope...

OSV-2023-402 Heap-use-after-free in Assimp::FBXExporter::WriteObjects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59036 Crash type: Heap-use-after-free READ 4 Crash state: Assimp::FBXExporter::WriteObjects Assimp::FBXExporter::ExportBinary Assimp::ExportSceneFBX...

OSV-2023-399 Heap-use-after-free in get_got_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58949 Crash type: Heap-use-after-free READ 8 Crash state: getgotentry getimportaddr Elf64rbinelfloadsymbolsandimports...

OSV-2023-397 Heap-buffer-overflow in json_write_TF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58915 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonwriteTF jsonpreR13headerwriteprivate dwgwritejson...

OSV-2023-396 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58938 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.Arrays.hashCode java.base/sun.reflect.generics.reflectiveObjects.ParameterizedTypeImpl.hashC...

OSV-2023-395 Stack-buffer-overflow in sc_path_print

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58932 Crash type: Stack-buffer-overflow READ 1 Crash state: scpathprint scselectfile cflexdeletefile...

OSV-2023-392 Negative-size-param in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58892 Crash type: Negative-size-param Crash state: H5MMmemcpy H5Olinkdecode H5Omsgiteratereal...

OSV-2023-391 UNKNOWN READ in wmem_tree_lookup32_array_le

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58832 Crash type: UNKNOWN READ Crash state: wmemtreelookup32arrayle dissectbtl2cap calldissectorwork...

OSV-2023-390 Heap-buffer-overflow in sdhci_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 Crash type: Heap-buffer-overflow WRITE 1 Crash state: sdhciwrite memoryregionwriteaccessor memoryregiondispatchwrite...

OSV-2023-388 Heap-buffer-overflow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58786 Crash type: Heap-buffer-overflow READ 4 Crash state: NULL...

OSV-2023-385 Bad-cast to Assimp::BaseImporter from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58724 Crash type: Bad-cast Crash state: Bad-cast to Assimp::BaseImporter from invalid vptr Assimp::Importer::ReadFile Assimp::BatchLoader::LoadAll...

OSV-2023-384 Heap-use-after-free in mrb_str_hash_m

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58723 Crash type: Heap-use-after-free READ 1 Crash state: mrbstrhashm mrbfuncallwithblock mrbfuncallargv...

OSV-2023-383 Security exception in org.json.JSONStringer.value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58722 Crash type: Security exception Crash state: org.json.JSONStringer.value org.json.JSONArray.writeTo org.json.JSONStringer.beforeValue...

OSV-2023-382 Use-of-uninitialized-value in wabt::BinaryReaderObjdump::PrintInitExpr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58694 Crash type: Use-of-uninitialized-value Crash state: wabt::BinaryReaderObjdump::PrintInitExpr wabt::BinaryReaderObjdump::EndInitExpr wabt::BinaryReaderObjdump::EndGlobalInitExpr...

OSV-2023-381 UNKNOWN READ in H5FL__blk_gc_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58701 Crash type: UNKNOWN READ Crash state: H5FLblkgclist H5FLgarbagecoll H5FLtermpackage...

OSV-2023-380 UNKNOWN WRITE in bool OT::Layout::Common::Coverage::serialize<hb_map_iter_t<hb_map_iter_t<hb_filt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58663 Crash type: UNKNOWN WRITE Crash state: bool OT::Layout::Common::Coverage::serialize::subset hbsubsetcontextt::returnt OT::Layout::GSUBimpl::SubstLookupSubTable::dispat...

OSV-2023-379 Heap-buffer-overflow in void sort_r_simple<>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58662 Crash type: Heap-buffer-overflow READ 1 Crash state: void sortrsimple bool OT::ClassDef::serializehbsortedarraythbpairtunsigned int, unsigned OT::ClassDefremapandserialize...

OSV-2023-377 UNKNOWN WRITE in bool OT::Layout::Common::CoverageFormat2_4<OT::Layout::MediumTypes>::serialize<h

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58671 Crash type: UNKNOWN WRITE Crash state: bool OT::Layout::Common::CoverageFormat24::serialize::subset...

OSV-2023-376 UNKNOWN WRITE in OT::Layout::GPOS_impl::CursivePosFormat1::subset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58660 Crash type: UNKNOWN WRITE Crash state: OT::Layout::GPOSimpl::CursivePosFormat1::subset hbsubsetcontextt::returnt OT::Layout::GPOSimpl::PosLookupSubTable::dispatch bool...

OSV-2023-375 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58658 Crash type: Heap-buffer-overflow WRITE Crash state: H5MMmemcpy H5Oallocchunk H5Oalloc...

OSV-2023-372 UNKNOWN WRITE in hb_ot_layout_substitute_start

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58626 Crash type: UNKNOWN WRITE Crash state: hbotlayoutsubstitutestart hbotshape hbshapeplanexecute...

OSV-2023-371 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58625 Crash type: Memcpy-param-overlap Crash state: repeat pere cliregcompreal...

OSV-2023-370 Heap-buffer-overflow in H5FS__sect_link

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58622 Crash type: Heap-buffer-overflow READ 8 Crash state: H5FSsectlink H5FSsectadd H5MFaddsect...

OSV-2023-366 Heap-use-after-free in gc_mark_children

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58577 Crash type: Heap-use-after-free READ 4 Crash state: gcmarkchildren incrementalgc mrbfullgc...

OSV-2023-364 Heap-double-free in HashMgr::~HashMgr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58553 Crash type: Heap-double-free Crash state: HashMgr::HashMgr HunspellImpl::HunspellImpl Hunspell::Hunspell...

OSV-2023-361 Heap-buffer-overflow in tok_get_normal_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58510 Crash type: Heap-buffer-overflow WRITE 1 Crash state: tokgetnormalmode PyTokenizerGet PyPegentokenizefullsourcetocheckforerrors...

OSV-2023-359 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58502 Crash type: Heap-buffer-overflow READ Crash state: H5MMmemcpy H5Ocachechkserialize H5Cgenerateimage...

OSV-2023-358 Heap-double-free in wolfCrypt_custom_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58484 Crash type: Heap-double-free Crash state: wolfCryptcustomfree wolfSSLFree FreeOcspRequest...

OSV-2023-357 Heap-buffer-overflow in flac__analyze_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58481 Crash type: Heap-buffer-overflow READ 4 Crash state: flacanalyzeframe writecallback writeaudioframetoclient...

OSV-2023-356 Heap-buffer-overflow in pdf_nextobject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58475 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfnextobject findlength pdfextractobj...

OSV-2023-353 Stack-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58405 Crash type: Stack-buffer-overflow WRITE 1 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcfffont...

OSV-2023-350 UNKNOWN READ in cli_html_normalise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58398 Crash type: UNKNOWN READ Crash state: clihtmlnormalise htmlnormalisemap cliscanhtml...

OSV-2023-346 UNKNOWN WRITE in void std::__1::allocator_traits<std::__1::allocator<wabt::interp::HandlerDesc> >

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58344 Crash type: UNKNOWN WRITE Crash state: void std::1::allocatortraits void std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::inter std::1::vectorwabt::interp::HandlerDesc, std::1::allocatorwabt::interp::Ha...

OSV-2023-345 Heap-buffer-overflow in mg_mqtt_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58319 Crash type: Heap-buffer-overflow READ 1 Crash state: mgmqttparse fuzz.c...

OSV-2023-344 Heap-buffer-overflow in tok_get_normal_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58295 Crash type: Heap-buffer-overflow WRITE 1 Crash state: tokgetnormalmode PyTokenizerGet PyPegentokenizefullsourcetocheckforerrors...

OSV-2023-343 Heap-buffer-overflow in _libssh2_ntohu32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58291 Crash type: Heap-buffer-overflow READ 1 Crash state: libssh2ntohu32 packetauthagentopen libssh2packetadd...

OSV-2023-342 Heap-use-after-free in ih264_inter_pred_luma_vert_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58278 Crash type: Heap-use-after-free READ 16 Crash state: ih264interpredlumavertssse3 ih264dmotioncompensatemp isvcddecoderecontfrnmbnonbaselyr...

OSV-2023-340 Heap-double-free in grk::DecompressCodeblock::release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58285 Crash type: Heap-double-free Crash state: grk::DecompressCodeblock::release grk::t1part1::T1Part1::decompress std::1::function::funcgrk::DecompressScheduler::scheduleBlocks...

OSV-2023-337 Heap-buffer-overflow in PyBytes_FromStringAndSize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58225 Crash type: Heap-buffer-overflow READ Crash state: PyBytesFromStringAndSize domkvalue vabuildstack...

OSV-2023-335 Security exception in org.json.JSONArray.writeTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58204 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...