OSV-2022-810 Stack-buffer-overflow in CBS_stow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50791 Crash type: Stack-buffer-overflow READ Crash state: CBSstow i2cASN1INTEGER asn1exi2c...

OSV-2022-808 Use-of-uninitialized-value in _dbus_marshal_write_basic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50762 Crash type: Use-of-uninitialized-value Crash state: dbusmarshalwritebasic dbustypewriterwritebasic writebasicfield...

OSV-2022-805 Global-buffer-overflow in get_unpack_proc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50731 Crash type: Global-buffer-overflow READ 8 Crash state: getunpackproc xpsbegintypedimage defaultsubclassbegintypedimage...

OSV-2022-804 Heap-buffer-overflow in _cmsMAT3per

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50725 Crash type: Heap-buffer-overflow READ 8 Crash state: cmsMAT3per OptimizeMatrixShaper cmsOptimizePipeline...

OSV-2022-803 Segv on unknown address in gs_fapi_ft_get_scaled_font

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50720 Crash type: Segv on unknown address Crash state: gsfapiftgetscaledfont gsfapipreparefont gsfapipassfont...

OSV-2022-802 Heap-use-after-free in UA_Server_networkCallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50699 Crash type: Heap-use-after-free READ 4 Crash state: UAServernetworkCallback fuzzbinarymessage.cc UAmemoryManagerfree...

OSV-2022-801 Stack-buffer-overflow in sc_hsm_decode_ecdsa_signature

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50683 Crash type: Stack-buffer-overflow WRITE Crash state: schsmdecodeecdsasignature schsmcomputesignature sccomputesignature...

OSV-2022-799 Incorrect-function-pointer-type in grk::BufferedStream::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50661 Crash type: Incorrect-function-pointer-type Crash state: grk::BufferedStream::read grk::FileFormatDecompress::readboxhdr grk::FileFormatDecompress::readHeaderProcedureImpl...

OSV-2022-798 Heap-use-after-free in cmsFreeNamedColorList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50665 Crash type: Heap-use-after-free READ 8 Crash state: cmsFreeNamedColorList TypeNamedColorFree cmsCloseProfile...

OSV-2022-797 Heap-buffer-overflow in Ins_NPUSHB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50656 Crash type: Heap-buffer-overflow READ 1 Crash state: InsNPUSHB RunIns InstanceReset...

OSV-2022-795 UNKNOWN READ in pcl::PLYReader::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50663 Crash type: UNKNOWN READ Crash state: pcl::PLYReader::read plyio.h...

OSV-2022-794 Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50629 Crash type: Heap-buffer-overflow READ 5 Crash state: std::1::basicstring, std::1::allocatorch Exiv2::QuickTimeVideo::previewTagDecoder Exiv2::QuickTimeVideo::tagDecoder...

OSV-2022-791 Security exception in java.base/java.util.Arrays.copyOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50631 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOf java.base/java.lang.AbstractStringBuilder.ensureCapacityInternal java.base/java.lang.AbstractStringBuilder.append...

OSV-2022-786 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50645 Crash type: Heap-double-free Crash state: readconfig readglob readconfig...

OSV-2022-785 Heap-buffer-overflow in resize_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50617 Crash type: Heap-buffer-overflow WRITE Crash state: resizepacket FuzzResizePacket fuzzrfc1035.c...

OSV-2022-784 Segv on unknown address in FreeCodePages

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50593 Crash type: Segv on unknown address Crash state: FreeCodePages m3FreeEnvironment fuzzer.c...

OSV-2022-782 Security exception in java.base/java.lang.StringBuffer.append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50600 Crash type: Security exception Crash state: java.base/java.lang.StringBuffer.append org.apache.commons.jxpath.ri.compiler.CoreFunction.toString java.base/java.lang.String.valueOf...

OSV-2022-781 Segv on unknown address in wasmtime_runtime::traphandlers::catch_traps::call_closure::hec711b3339636b04

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50596 Crash type: Segv on unknown address Crash state: wasmtimeruntime::traphandlers::catchtraps::callclosure::hec711b3339636b04 wasmtimesetjmp wasmtime::linker::Linker$LT$T$GT$::instantiate::h7e42baf4a320e0da...

OSV-2022-780 Index-out-of-bounds in is_same_net6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50599 Crash type: Index-out-of-bounds Crash state: issamenet6 dhcp6mayberelay dhcp6mayberelay...

OSV-2022-776 Heap-buffer-overflow in do_job

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50528 Crash type: Heap-buffer-overflow WRITE 4 Crash state: dojob blosccompresscontext blosc2compress...

OSV-2022-774 Segv on unknown address in cranelift_filetests::function_runner::CompiledFunction::call::ha6b9162cd2eNUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50556 Crash type: Segv on unknown address Crash state: craneliftfiletests::functionrunner::CompiledFunction::call::ha6b9162cd2eNUMBER...

OSV-2022-773 Heap-double-free in sc_pkcs15_encode_df

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50536 Crash type: Heap-double-free Crash state: scpkcs15encodedf scpkcs15initupdateanydf scpkcs15initaddobject...

OSV-2022-772 Heap-use-after-free in pdfi_cidtype2_get_glyph_index

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50527 Crash type: Heap-use-after-free READ 1 Crash state: pdficidtype2getglyphindex gstype42glyphinfo pdficidtype2glyphinfo...

OSV-2022-770 Stack-buffer-overflow in get_transaction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50477 Crash type: Stack-buffer-overflow READ 2 Crash state: gettransaction dissectasp calldissectorworkerror...

OSV-2022-768 Security exception in org.apache.commons.jxpath.ri.axes.UnionContext.setPosition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50506 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.axes.UnionContext.setPosition org.apache.commons.jxpath.ri.axes.NodeSetContext.nextNode org.apache.commons.jxpath.ri.axes.PredicateContext.nextNode...

OSV-2022-764 Security exception in org.apache.commons.jxpath.ri.compiler.CoreOperation.parenthesize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50458 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.compiler.CoreOperation.parenthesize org.apache.commons.jxpath.ri.compiler.CoreOperation.toString...

OSV-2022-763 Heap-buffer-overflow in sqlite3VdbeExec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50466 Crash type: Heap-buffer-overflow READ Crash state: sqlite3VdbeExec sqlite3step osquery::readRows...

OSV-2022-760 Security exception in com.fasterxml.jackson.dataformat.toml.Parser.parseInlineTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50432 Crash type: Security exception Crash state: com.fasterxml.jackson.dataformat.toml.Parser.parseInlineTable com.fasterxml.jackson.dataformat.toml.Parser.parseValue com.fasterxml.jackson.dataformat.toml.Parser.parseKeyVal...

OSV-2022-759 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50428 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/sun.nio.cs.CESU8.updatePositions java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...

OSV-2022-757 UNKNOWN WRITE in pdfi_free_array

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50406 Crash type: UNKNOWN WRITE Crash state: pdfifreearray pdfifreeobject pdficleartomark...

OSV-2022-755 Global-buffer-overflow in chunk_obj_alloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50436 Crash type: Global-buffer-overflow READ 8 Crash state: chunkobjalloc chunkallocbytearrayimmovable szliballoc...

OSV-2022-751 Heap-buffer-overflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50448 Crash type: Heap-buffer-overflow READ 1 Crash state: gstype2interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2022-750 Heap-buffer-overflow in do_job

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50433 Crash type: Heap-buffer-overflow WRITE 4 Crash state: dojob blosccompresscontext blosc2compressctx...

OSV-2022-749 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50393 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.nio.charset.CharsetEncoder.replaceWith java.base/java.nio.charset.CharsetEncoder...

OSV-2022-744 Stack-buffer-overflow in gs_glyph_data_from_bytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50326 Crash type: Stack-buffer-overflow WRITE 8 Crash state: gsglyphdatafrombytes pdficffsubrdata gstype1piececodes...

OSV-2022-743 Security exception in org.apache.commons.jxpath.ri.parser.XPathParser.MultiplicativeExpr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50363 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.parser.XPathParser.MultiplicativeExpr org.apache.commons.jxpath.ri.parser.XPathParser.SubtractiveExpr...

OSV-2022-738 Security exception in DatatypeFuzzer.fuzzerTestOneInput

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50379 Crash type: Security exception Crash state: DatatypeFuzzer.fuzzerTestOneInput com.codeintelligence.jazzer.driver.FuzzTargetRunner.runOne com.codeintelligence.jazzer.driver.FuzzTargetRunner.startLibFuzzer...

OSV-2022-736 Heap-buffer-overflow in copy_glyph_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50321 Crash type: Heap-buffer-overflow READ Crash state: copyglyphdata copyglyphtype1 gscopyglyphoptions...

OSV-2022-733 Security exception in jaz.Zer.<clinit>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50374 Crash type: Security exception Crash state: jaz.Zer. java.base/java.lang.Class.forName0 java.base/java.lang.Class.forName...

OSV-2022-729 Security exception in org.apache.commons.jxpath.ri.compiler.CoreOperationMultiply.computeValue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50372 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.compiler.CoreOperationMultiply.computeValue org.apache.commons.jxpath.ri.compiler.CoreOperationMultiply.computeValue...

OSV-2022-727 Heap-buffer-overflow in s_file_write_flush

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50370 Crash type: Heap-buffer-overflow READ 8 Crash state: sfilewriteflush sclose streamfinalize...

OSV-2022-726 Heap-use-after-free in gx_device_forward_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50307 Crash type: Heap-use-after-free READ 8 Crash state: gxdeviceforwardfinalize gxdevicefinalize allocrestorestepin...

OSV-2022-725 Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295 Crash type: Heap-buffer-overflow WRITE 1 Crash state: jxl::NEMU128::WriteToU8Stage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-724 Stack-buffer-underflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50306 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype2interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2022-719 Stack-buffer-overflow in gs_glyph_data_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50267 Crash type: Stack-buffer-overflow WRITE 8 Crash state: gsglyphdatafromstring copiedtype1subrdata gstype2interpret...

OSV-2022-715 Segv on unknown address in jpeg_read_scanlines

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50217 https://pillow.readthedocs.io/en/stable/releasenotes/9.3.0.htmldecode-jpeg-compressed-blp1-data-in-original-mode Crash type: Segv on unknown address Crash state: jpegreadscanlines ImagingJpegDecode decode...

OSV-2022-714 Heap-buffer-overflow in dynapi_set_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194 Crash type: Heap-buffer-overflow WRITE 16 Crash state: dynapisethelper dwgdynapiheadersetvalue jsonHEADER...

OSV-2022-712 Heap-buffer-overflow in ndpi_search_florensia

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50110 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpisearchflorensia checkndpidetectionfunc ndpidetectionprocesspacket...

OSV-2022-711 Heap-buffer-overflow in _cmsMAT3per

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50115 Crash type: Heap-buffer-overflow READ 8 Crash state: cmsMAT3per OptimizeMatrixShaper cmsOptimizePipeline...

OSV-2022-710 Heap-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50099 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcfffont...