OSV-2023-248 Heap-double-free in _dwarf_read_line_table_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57443 Crash type: Heap-double-free Crash state: dwarfreadlinetableheader dwarfinternalsrclines dwarfsrclinesb...

OSV-2023-246 Heap-double-free in _dwarf_read_line_table_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57437 Crash type: Heap-double-free Crash state: dwarfreadlinetableheader dwarfsrcfiles fuzzsrcfiles.c...

OSV-2023-243 UNKNOWN WRITE in processCertificateElements

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57448 Crash type: UNKNOWN WRITE Crash state: processCertificateElements fuzztlscertificate.c...

OSV-2023-242 Use-of-uninitialized-value in xmlSwitchEncoding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57431 Crash type: Use-of-uninitialized-value Crash state: xmlSwitchEncoding xmlParsePEReference xmlParseInternalSubset...

OSV-2023-240 Invalid-free in fuzz_die_cu_attrs.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57429 Crash type: Invalid-free Crash state: fuzzdiecuattrs.c...

OSV-2023-239 Use-of-uninitialized-value in ihevce_strm_fill_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57401 Crash type: Use-of-uninitialized-value Crash state: ihevcestrmfilldone ihevceentcodingthrd osalfunc...

OSV-2023-235 Use-of-uninitialized-value in complexity_RC_reset_marking

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57398 Crash type: Use-of-uninitialized-value Crash state: complexityRCresetmarking ihevcepreencprocessframethrd osalfunc...

OSV-2023-234 Use-of-uninitialized-value in ihevce_enc_frm_proc_slave_thrd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57397 Crash type: Use-of-uninitialized-value Crash state: ihevceencfrmprocslavethrd osalfunc posixmemalign...

OSV-2023-229 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57369 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2023-225 Heap-buffer-overflow in std::__1::enable_if<true, void>::type APFSBtreeNodeIterator<APFSBtreeNode<apfs_o

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57364 Crash type: Heap-buffer-overflow READ 2 Crash state: std::1::enableif::type APFSBtreeNodeIterator ::APFSBtree APFSBtreeNodeIterator APFSBtreeN...

OSV-2023-222 Heap-buffer-overflow in hb_subset_plan_t::hb_subset_plan_t

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57342 Crash type: Heap-buffer-overflow READ 2 Crash state: hbsubsetplant::hbsubsetplant hbsubsetplancreateorfail hbsubsetorfail...

OSV-2023-221 Heap-use-after-free in flac__analyze_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57354 Crash type: Heap-use-after-free READ 4 Crash state: flacanalyzeframe writecallback writeaudioframetoclient...

OSV-2023-219 UNKNOWN WRITE in processCertificateElements

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57317 Crash type: UNKNOWN WRITE Crash state: processCertificateElements fuzztlscertificate.c...

OSV-2023-216 Heap-buffer-overflow in H5G__node_cmp3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57305 Crash type: Heap-buffer-overflow READ 5 Crash state: H5Gnodecmp3 H5Bfind H5Gstablookup...

OSV-2023-215 Global-buffer-overflow in htmlParsePI

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57304 Crash type: Global-buffer-overflow READ 1 Crash state: htmlParsePI htmlParseDocument htmlDoRead...

OSV-2023-214 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57295 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.HashMap.get org.springframework.core.convert.TypeDescriptor.valueOf...

OSV-2023-213 Global-buffer-overflow in htmlParseDocument

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57288 Crash type: Global-buffer-overflow READ 1 Crash state: htmlParseDocument htmlDoRead htmlReadMemory...

OSV-2023-212 Global-buffer-overflow in xmlParseEntityDecl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57294 Crash type: Global-buffer-overflow READ 1 Crash state: xmlParseEntityDecl xmlParseMarkupDecl xmlParseInternalSubset...

OSV-2023-211 Global-buffer-overflow in xmlStrndup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57284 Crash type: Global-buffer-overflow READ 1 Crash state: xmlStrndup htmlParseSystemLiteral htmlParseDocTypeDecl...

OSV-2023-206 Global-buffer-overflow in xmlParseContentInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57225 Crash type: Global-buffer-overflow READ 1 Crash state: xmlParseContentInternal xmlParseExternalEntityPrivate xmlParseReference...

OSV-2023-205 Global-buffer-overflow in base_C_MessageSignFinal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57202 Crash type: Global-buffer-overflow READ 8 Crash state: baseCMessageSignFinal rpcCMessageSignFinal p11rpcserverhandle...

OSV-2023-204 Global-buffer-overflow in htmlParseChunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57224 Crash type: Global-buffer-overflow READ 1 Crash state: htmlParseChunk html.c...

OSV-2023-201 UNKNOWN READ in Assimp::SMDImporter::ParseNodeInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57218 Crash type: UNKNOWN READ Crash state: Assimp::SMDImporter::ParseNodeInfo Assimp::SMDImporter::ParseNodesSection Assimp::SMDImporter::ParseFile...

OSV-2023-200 Segv on unknown address in mrb_vm_find_method

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57135 Crash type: Segv on unknown address Crash state: mrbvmfindmethod mrbvmexec mrbvmrun...

OSV-2023-199 Global-buffer-overflow in xmlParseQName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57151 Crash type: Global-buffer-overflow READ 1 Crash state: xmlParseQName xmlParseStartTag2 xmlParseTryOrFinish...

OSV-2023-197 Global-buffer-overflow in base_C_MessageEncryptInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57120 Crash type: Global-buffer-overflow READ 8 Crash state: baseCMessageEncryptInit rpcCMessageEncryptInit p11rpcserverhandle...

OSV-2023-196 Global-buffer-overflow in xmlDictLookup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57110 Crash type: Global-buffer-overflow READ 1 Crash state: xmlDictLookup xmlParseNCName xmlParseQName...

OSV-2023-195 Global-buffer-overflow in htmlParseDocument

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57089 Crash type: Global-buffer-overflow READ 1 Crash state: htmlParseDocument htmlDoRead htmlReadMemory...

OSV-2023-193 Global-buffer-overflow in xmlParseContentInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57084 Crash type: Global-buffer-overflow READ 1 Crash state: xmlParseContentInternal xmlParseExternalEntityPrivate xmlParseReference...

OSV-2023-192 Heap-use-after-free in mrb_str_hash_m

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57108 Crash type: Heap-use-after-free READ 1 Crash state: mrbstrhashm mrbfuncallwithblock mrbfuncallargv...

OSV-2023-191 Global-buffer-overflow in xmlSkipBlankChars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57080 Crash type: Global-buffer-overflow READ 1 Crash state: xmlSkipBlankChars xmlParseMisc xmlParseDocument...

OSV-2023-188 Global-buffer-overflow in xmlParseQName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57077 Crash type: Global-buffer-overflow READ 1 Crash state: xmlParseQName xmlParseStartTag2 xmlParseElementStart...

OSV-2023-185 Global-buffer-overflow in xmlNextChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57073 Crash type: Global-buffer-overflow READ 1 Crash state: xmlNextChar htmlParseStartTag htmlParseChunk...

OSV-2023-184 UNKNOWN READ in LibRaw::sget4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57105 Crash type: UNKNOWN READ Crash state: LibRaw::sget4 LibRaw::parseAdobeRAFMakernote LibRaw::parsetiffifd...

OSV-2023-183 UNKNOWN READ in mrb_exc_get_id

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57064 Crash type: UNKNOWN READ Crash state: mrbexcgetid mrbnomethoderror mrbmethodmissing...

OSV-2023-182 Heap-buffer-overflow in FLAC__bitwriter_write_rice_signed_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57071 Crash type: Heap-buffer-overflow WRITE 4 Crash state: FLACbitwriterwritericesignedblock addresidualpartitionedrice FLACsubframeaddfixed...

OSV-2023-181 Heap-double-free in xsltCompileStepPattern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57061 Crash type: Heap-double-free Crash state: xsltCompileStepPattern xsltCompileRelativePathPattern xsltCompilePatternInternal...

OSV-2023-180 UNKNOWN READ in mrb_obj_iv_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57051 Crash type: UNKNOWN READ Crash state: mrbobjivget classnamestr mrbmodtos...

OSV-2023-178 Segv on unknown address in mrb_bint_sub

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57037 Crash type: Segv on unknown address Crash state: mrbbintsub intsub mrbvmexec...

OSV-2023-177 Heap-buffer-overflow in mosquitto__strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57002 Crash type: Heap-buffer-overflow READ Crash state: mosquittostrdup configreadfilecore configreadfile...

OSV-2023-176 Heap-use-after-free in mrb_gc_mark

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56991 Crash type: Heap-use-after-free READ 4 Crash state: mrbgcmark mrbgcmarkiv gcmarkchildren...

OSV-2023-175 UNKNOWN READ in dissect_oran_c_section

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56990 Crash type: UNKNOWN READ Crash state: dissectorancsection dissectoran calldissectorwork...

OSV-2023-174 Global-buffer-overflow in htmlCurrentChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56964 Crash type: Global-buffer-overflow READ 1 Crash state: htmlCurrentChar htmlParseNameComplex htmlParseName...

OSV-2023-170 Invalid-free in hb_free_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56952 Crash type: Invalid-free Crash state: hbfreeimpl OT::glyf::freecompiledsubsetglyphs OT::glyf::populatesubsetglyphs...

OSV-2023-165 Heap-buffer-overflow in array_container_to_uint32_array

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56893 Crash type: Heap-buffer-overflow WRITE 4 Crash state: arraycontainertouint32array ratouint32array roaringbitmapserialize...

OSV-2023-164 UNKNOWN READ in fp_cmp_mag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56892 Crash type: UNKNOWN READ Crash state: fpcmpmag crtmgrtrustlistlookup crtmgradd...

OSV-2023-162 Global-buffer-overflow in xmlCurrentChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56841 Crash type: Global-buffer-overflow READ 1 Crash state: xmlCurrentChar xmlParseNCName xmlParseQName...

OSV-2023-160 Global-buffer-overflow in OT::gvar::accelerator_t::apply_deltas_to_points

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56800 Crash type: Global-buffer-overflow READ 2 Crash state: OT::gvar::acceleratort::applydeltastopoints bool OT::glyfimpl::Glyph::getpoints bool OT::glyfimpl::Glyph::getpoints...

OSV-2023-159 UNKNOWN READ in isvce_cabac_flush

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56816 Crash type: UNKNOWN READ Crash state: isvcecabacflush isvcecabacencodeterminate isvceentropy...

OSV-2023-158 Heap-use-after-free in ddsi_type_unref_impl_locked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56837 Crash type: Heap-use-after-free READ 4 Crash state: ddsitypeunrefimpllocked ddsitypeunreflocked ddsixttypefini...