OSV-2023-156 Heap-use-after-free in HashMgr::add_word

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56737 Crash type: Heap-use-after-free READ 2 Crash state: HashMgr::addword HashMgr::loadtables HashMgr::HashMgr...

OSV-2023-155 Heap-buffer-overflow in run_container_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56710 Crash type: Heap-buffer-overflow WRITE 16 Crash state: runcontainerwrite raportableserialize roaringbitmapserialize...

OSV-2023-153 Heap-use-after-free in ucl_hash_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56716 Crash type: Heap-use-after-free READ 8 Crash state: uclhashfunc khresizeuclhashnode khputuclhashnode...

OSV-2023-152 UNKNOWN READ in dissect_oran_c_section

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56724 Crash type: UNKNOWN READ Crash state: dissectorancsection dissectoran calldissectorwork...

OSV-2023-151 UNKNOWN READ in mrb_vm_find_method

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56687 Crash type: UNKNOWN READ Crash state: mrbvmfindmethod mrbvmexec mrbvmrun...

OSV-2023-142 Heap-buffer-overflow in pdf14_preserve_backdrop

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56544 Crash type: Heap-buffer-overflow WRITE Crash state: pdf14preservebackdrop pdf14pushtransparencygroup pdf14begintransparencygroup...

OSV-2023-137 Heap-buffer-overflow in OT::Layout::Common::Coverage::get_population

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56510 Crash type: Heap-buffer-overflow READ 1 Crash state: OT::Layout::Common::Coverage::getpopulation OT::Layout::GPOSimpl::SinglePosFormat1::sanitize hbsanitizecontextt::returnt OT::Layout::GPOSimpl::PosLookupSubTable::dispa...

OSV-2023-135 Heap-buffer-overflow in json_cquote

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56473 Crash type: Heap-buffer-overflow READ 1 Crash state: jsoncquote dwgjsonLTYPE jsonobjectswrite...

OSV-2023-133 Heap-buffer-overflow in H5L__extern_traverse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56501 Crash type: Heap-buffer-overflow READ Crash state: H5Lexterntraverse H5Gtraversespecial H5Gtraversereal...

OSV-2023-119 Use-of-uninitialized-value in rename_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56401 Crash type: Use-of-uninitialized-value Crash state: renameprocess safeforkfull parsetimestamp...

OSV-2023-118 Heap-use-after-free in mrb_gc_mark

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56406 Crash type: Heap-use-after-free READ 4 Crash state: mrbgcmark mrbgcmarkiv gcmarkchildren...

OSV-2023-117 Heap-buffer-overflow in isvcd_nal_byte_swap_emulation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56386 Crash type: Heap-buffer-overflow WRITE 4 Crash state: isvcdnalbyteswapemulation isvcdnalparsenonvclnal isvcdpreparserefineau...

OSV-2023-116 Security exception in org.codehaus.janino.Parser.parseUnaryExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56367 Crash type: Security exception Crash state: org.codehaus.janino.Parser.parseUnaryExpression java.base/java.nio.ByteBuffer.limit java.base/java.nio.Buffer...

OSV-2023-113 Stack-buffer-overflow in dump_stats

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56339 Crash type: Stack-buffer-overflow READ 4 Crash state: dumpstats flacanalyzeframe writecallback...

OSV-2023-107 Heap-buffer-overflow in DecodeBasicOcspResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56308 Crash type: Heap-buffer-overflow READ Crash state: DecodeBasicOcspResponse OcspResponseDecode ocsp.c...

OSV-2023-106 UNKNOWN WRITE in sudo_lbuf_append_quoted_v1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56278 Crash type: UNKNOWN WRITE Crash state: sudolbufappendquotedv1 sudoersformatmemberint sudoersformatmemberint...

OSV-2023-104 Heap-buffer-overflow in H5FS__sect_link

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56234 Crash type: Heap-buffer-overflow READ 8 Crash state: H5FSsectlink H5FSsectadd H5MFaddsect...

OSV-2023-102 Segv on unknown address in ndpi_free_flow_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56272 Crash type: Segv on unknown address Crash state: ndpifreeflowdata ndpifreeflow fuzzprocesspacket.c...

OSV-2023-101 Heap-use-after-free in pci_enum

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56243 Crash type: Heap-use-after-free READ 4 Crash state: pcienum gptrarrayforeach genericfuzz...

OSV-2023-98 Heap-buffer-overflow in sc_hsm_write_ef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56213 Crash type: Heap-buffer-overflow READ Crash state: schsmwriteef schsmupdatebinary scupdatebinary...

OSV-2023-97 Heap-buffer-overflow in isvcd_reflayer_construction_dyadic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56210 Crash type: Heap-buffer-overflow READ 1 Crash state: isvcdreflayerconstructiondyadic isvcdintraresampmbdyadic isvcdprocessiblmb...

OSV-2023-96 Heap-buffer-overflow in load_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56208 Crash type: Heap-buffer-overflow READ 8 Crash state: loadbuffer rbinobjectnew rbinfilenewfrombuffer...

OSV-2023-95 Use-of-uninitialized-value in isvcd_interpolate_residual_sse42

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56176 Crash type: Use-of-uninitialized-value Crash state: isvcdinterpolateresidualsse42 isvcdresidualsampmb isvcdprocessresidualresamplemb...

OSV-2023-92 UNKNOWN READ in var_Create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56141 Crash type: UNKNOWN READ Crash state: varCreate Open genericstart...

OSV-2023-90 Heap-buffer-overflow in LibRaw_buffer_datastream::scanf_one

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56160 Crash type: Heap-buffer-overflow READ 1 Crash state: LibRawbufferdatastream::scanfone LibRaw::parsemos LibRaw::parsetiffifd...

OSV-2023-89 Heap-buffer-overflow in H5O__mtime_new_encode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56143 Crash type: Heap-buffer-overflow WRITE 1 Crash state: H5Omtimenewencode H5Omsgflush H5Ochunkserialize...

OSV-2023-88 Stack-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56156 Crash type: Stack-buffer-overflow WRITE 1 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcfffont...

OSV-2023-86 UNKNOWN READ in isvce_cabac_flush

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56137 Crash type: UNKNOWN READ Crash state: isvcecabacflush isvcecabacencodeterminate isvceentropy...

OSV-2023-84 Stack-buffer-overflow in parse_regex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56121 Crash type: Stack-buffer-overflow READ 1 Crash state: parseregex parseregex parseregex...

OSV-2023-80 Heap-buffer-overflow in set_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56037 Crash type: Heap-buffer-overflow READ Crash state: setdata refpkt gitpktparseline...

OSV-2023-79 Heap-buffer-overflow in H5O__fsinfo_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56076 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Ofsinfodecode H5Omsgiteratereal H5Omsgremovereal...

OSV-2023-78 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56054 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2023-77 Heap-buffer-overflow in H5C__load_cache_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56075 Crash type: Heap-buffer-overflow READ 4 Crash state: H5Cloadcacheimage H5Cprotect H5ACprotect...

OSV-2023-76 Heap-buffer-overflow in H5SM_delete

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56033 Crash type: Heap-buffer-overflow READ 4 Crash state: H5SMdelete H5Omsgwritereal H5Omsgwrite...

OSV-2023-75 Heap-buffer-overflow in isvcd_interlyr_motion_mode_pred_dyadic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56050 Crash type: Heap-buffer-overflow READ 1 Crash state: isvcdinterlyrmotionmodepreddyadic isvcdmvpredreftfrnby2epmb isvcdparseinterslicedatacabacenhlyr...

OSV-2023-72 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56057 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParseTracePacketData...

OSV-2023-69 Heap-use-after-free in zend_ast_evaluate_inner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56021 Crash type: Heap-use-after-free READ 4 Crash state: zendastevaluateinner zendastevaluateex zvalupdateconstantwithctx...

OSV-2023-68 Heap-buffer-overflow in isvcd_residual_samp_mb_dyadic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56023 Crash type: Heap-buffer-overflow READ 2 Crash state: isvcdresidualsampmbdyadic isvcdprocessresidualresamplemb isvcdprocessintermbrsdpredtargetlyr...

OSV-2023-67 Heap-use-after-free in config__cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56009 Crash type: Heap-use-after-free READ 8 Crash state: configcleanup mosquittofuzzmain runbroker...

OSV-2023-66 Heap-buffer-overflow in mosquitto__strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56008 Crash type: Heap-buffer-overflow READ Crash state: mosquittostrdup configreadfilecore configreadfile...

OSV-2023-61 Heap-buffer-overflow in xmlParseTryOrFinish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55980 Crash type: Heap-buffer-overflow READ 1 Crash state: xmlParseTryOrFinish xmlParseChunk xml.c...

OSV-2023-60 Security exception in org.json.JSONTokener.nextValue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55978 Crash type: Security exception Crash state: org.json.JSONTokener.nextValue org.json.JSONTokener.readArray org.json.JSONTokener.nextToInternal...

OSV-2023-56 Heap-buffer-overflow in git_oid_raw_cmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55724 Crash type: Heap-buffer-overflow READ Crash state: gitoidrawcmp commitgraphparseoidlookup gitcommitgraphfileparse...

OSV-2023-55 Index-out-of-bounds in LibRaw::apply_tiff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55722 Crash type: Index-out-of-bounds Crash state: LibRaw::applytiff LibRaw::parsejpeg LibRaw::identify...

OSV-2023-51 Heap-use-after-free in ZSTD_freeDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55673 Crash type: Heap-use-after-free READ Crash state: ZSTDfreeDDict blosc2freectx blosc2schunkfree...

OSV-2023-49 Heap-buffer-overflow in lex_scan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55654 Crash type: Heap-buffer-overflow READ 1 Crash state: lexscan zendlex zendparse...

OSV-2023-48 Global-buffer-overflow in isvce_write_coeff4x4_cavlc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55643 Crash type: Global-buffer-overflow READ 1 Crash state: isvcewritecoeff4x4cavlc isvceencoderesidue isvcewritepslicembcavlc...

OSV-2023-46 Heap-buffer-overflow in json_cquote

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55607 Crash type: Heap-buffer-overflow WRITE 1 Crash state: jsoncquote jsonpreR13headerwriteprivate dwgwritejson...

OSV-2023-42 Heap-buffer-overflow in bit_read_BB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55579 Crash type: Heap-buffer-overflow READ 1 Crash state: bitreadBB dwgdecodeMINSERTprivate dwgdecodeMINSERT...

OSV-2023-41 Heap-use-after-free in sk_num

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55556 Crash type: Heap-use-after-free READ 8 Crash state: sknum ASN1templatefree asn1itemcombinefree...