OSV-2021-1135 Heap-use-after-free in prvTidyInsertedToken

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37196 Crash type: Heap-use-after-free READ 8 Crash state: prvTidyInsertedToken prvTidyGetToken prvTidyoldParseInline...

OSV-2021-1134 Heap-buffer-overflow in exif_mnote_data_apple_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37222 Crash type: Heap-buffer-overflow READ Crash state: exifmnotedataappleload exifmnotedataload interpretmakernote...

OSV-2021-1128 Heap-buffer-overflow in exif_mnote_data_apple_identify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37211 Crash type: Heap-buffer-overflow READ 3 Crash state: exifmnotedataappleidentify interpretmakernote exifdataloaddata...

OSV-2021-1127 Heap-use-after-free in zebra_nhg_hash_equal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37164 Crash type: Heap-use-after-free READ 4 Crash state: zebranhghashequal hashget hashlookup...

OSV-2021-1124 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37116 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-1122 Heap-double-free in sudoers_gc_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37056 Crash type: Heap-double-free Crash state: sudoersgcrun fuzzpolicy.c resolveeditor...

OSV-2021-1121 UNKNOWN WRITE in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025 This is the same issue as OSV-2021-1143 which replaced this one after it was closed wrongly. Crash type: UNKNOWN WRITE Crash state: QtPrivate::QCommonArrayOps::growAppend QPainterPath::addPath QPathClipper::intersect...

OSV-2021-1120 Heap-use-after-free in on_body

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37023 Crash type: Heap-use-after-free READ 1 Crash state: onbody reqbodysendcomplete runsocket...

OSV-2021-1117 Heap-buffer-overflow in json_object_new_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37017 Crash type: Heap-buffer-overflow READ Crash state: jsonobjectnewstring clijsonstr clihwp5header...

OSV-2021-1116 Use-after-poison in JS::PrimitiveString::string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36985 Crash type: Use-after-poison READ 1 Crash state: JS::PrimitiveString::string JS::abstractrelation JS::lessthan...

OSV-2021-1113 Stack-buffer-overflow in getoid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36962 Crash type: Stack-buffer-overflow READ 8 Crash state: getoid parseobjectid parseasntype...

OSV-2021-1110 Stack-buffer-overflow in TranslateWord2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36932 Crash type: Stack-buffer-overflow WRITE 1 Crash state: TranslateWord2 TranslateClause SpeakNextClause...

OSV-2021-1109 UNKNOWN READ in mrb_check_frozen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36930 Crash type: UNKNOWN READ Crash state: mrbcheckfrozen mrbstrmodifykeepascii mrbstrmodify...

OSV-2021-1108 Use-of-uninitialized-value in init_main_qtable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36913 Crash type: Use-of-uninitialized-value Crash state: initmainqtable LibRaw::fujidecodestrip LibRaw::fujidecodeloop...

OSV-2021-1105 Heap-buffer-overflow in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36908 Crash type: Heap-buffer-overflow READ 1 Crash state: readconfig snmpconfigfuzzer.c...

OSV-2021-1104 Heap-buffer-overflow in ap_escape_path_segment_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36882 Crash type: Heap-buffer-overflow WRITE 1 Crash state: apescapepathsegmentbuffer fuzzutils.c...

OSV-2021-1102 Heap-use-after-free in usbredirparser_serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36861 Crash type: Heap-use-after-free WRITE 4 Crash state: usbredirparserserialize tryserialize usbredirparserfuzz.cc...

OSV-2021-1099 Stack-buffer-overflow in ot::StringFind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36830 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::StringFind ot::Coap::Message::AppendUriPathOptions otCoapMessageAppendUriPathOptions...

OSV-2021-1086 Heap-buffer-overflow in dwg_convert_SAB_to_SAT1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728 Crash type: Heap-buffer-overflow READ 2 Crash state: dwgconvertSABtoSAT1 dxf3dsolid dwgdxfREGIONprivate...

OSV-2021-1084 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36738 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::ResolveConstant...

OSV-2021-1085 Stack-buffer-overflow in strcat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36743 Crash type: Stack-buffer-overflow WRITE Crash state: strcat prvTidystrrep tidyMessageCreateInitV...

OSV-2021-1083 Heap-buffer-overflow in flb_hash_get_by_id

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36718 Crash type: Heap-buffer-overflow READ Crash state: flbhashgetbyid utilsfuzzer.c...

OSV-2021-1082 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24051 Crash type: UNKNOWN READ Crash state: std::1::tree, std::1...

OSV-2021-1081 Heap-use-after-free in gx_pattern_accum_finalize_cw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36714 Crash type: Heap-use-after-free READ 8 Crash state: gxpatternaccumfinalizecw gxdevicefinalize gcobjectssetreloc...

OSV-2021-1080 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36706 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-1079 Stack-use-after-return in aio_bh_dequeue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36690 Crash type: Stack-use-after-return READ 8 Crash state: aiobhdequeue aiobhpoll aiodispatch...

OSV-2021-1078 Heap-buffer-overflow in prvTidygrowStack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36694 Crash type: Heap-buffer-overflow WRITE Crash state: prvTidygrowStack prvTidypush CleanSpaces...

OSV-2021-1076 UNKNOWN READ in ParseXMLElement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36671 Crash type: UNKNOWN READ Crash state: ParseXMLElement prvTidyParseXMLDocument prvTidyDocParseStream...

OSV-2021-1075 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36677 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-1074 Use-of-uninitialized-value in SkBaseDevice::save

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36647 Crash type: Use-of-uninitialized-value Crash state: SkBaseDevice::save SkCanvas::internalSave SkCanvas::internalSaveLayer...

OSV-2021-1071 Heap-use-after-free in SkCanvas::MCRec::MCRec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36644 Crash type: Heap-use-after-free READ 8 Crash state: SkCanvas::MCRec::MCRec SkCanvas::MCRec& SkTArray::emplacebackSkCanvas::MCRec& SkCanvas::internalSave...

OSV-2021-1070 Heap-buffer-overflow in ZSTD_decompressBlock_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623 Crash type: Heap-buffer-overflow READ 4 Crash state: ZSTDdecompressBlockinternal ZSTDdecompressMultiFrame ZSTDdecompressDCtx...

OSV-2021-1069 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36616 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-1068 Heap-buffer-overflow in ucl_object_free_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36572 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectfreeinternal uclobjectdtorunrefsingle uclobjectdtorunref...

OSV-2021-1066 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36571 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-1061 UNKNOWN WRITE in CompileBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36551 Crash type: UNKNOWN WRITE Crash state: CompileBlock CompileElseBlock CompileIf...

OSV-2021-1059 Use-of-uninitialized-value in fuzz_json_decode_encode.cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36502 Crash type: Use-of-uninitialized-value Crash state: fuzzjsondecodeencode.cc UAByteStringallocBuffer fuzzjsondecodeencode.cc...

OSV-2021-1055 UNKNOWN WRITE in jxl::ModularFrameDecoder::DecodeGroup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36456 Crash type: UNKNOWN WRITE Crash state: jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup jxl::ThreadPool::RunCallStatejxl::FrameDecoder::ProcessSections...

OSV-2021-1054 Heap-buffer-overflow in jxl::N_SCALAR::SingleFromSingle

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36490 Crash type: Heap-buffer-overflow WRITE 4 Crash state: jxl::NSCALAR::SingleFromSingle jxl::ThreadPool::SequentialRunnerStatic jxl::ModularFrameDecoder::ModularImageToDecodedRect...

OSV-2021-1052 Use-of-uninitialized-value in jxl::N_AVX2::UpsampleRect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36497 Crash type: Use-of-uninitialized-value Crash state: jxl::NAVX2::UpsampleRect jxl::Upsampler::UpsampleRect jxl::FinalizeImageRect...

OSV-2021-1049 Container-overflow in jxl::InvSqueeze

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36485 Crash type: Container-overflow READ 8 Crash state: jxl::InvSqueeze jxl::Transform::Inverse jxl::Image::undotransforms...

OSV-2021-1048 Stack-buffer-overflow in INDEX_ORDERLY_RAM_Marshal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36476 Crash type: Stack-buffer-overflow READ 4 Crash state: INDEXORDERLYRAMMarshal PERSISTENTALLMarshal TPM2PersistentAllStore...

OSV-2021-1046 UNKNOWN READ in helper_ret_stb_mmu_x86_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36453 Crash type: UNKNOWN READ Crash state: helperretstbmmux8664 stack...

OSV-2021-1045 Heap-buffer-overflow in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36464 Crash type: Heap-buffer-overflow READ 1 Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2021-1041 Global-buffer-overflow in SetUpPhonemeTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36412 Crash type: Global-buffer-overflow READ 4 Crash state: SetUpPhonemeTable SelectPhonemeTable TranslateWord2...

OSV-2021-1039 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36388 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-1033 Stack-buffer-overflow in unicodize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36312 Crash type: Stack-buffer-overflow WRITE 1 Crash state: unicodize ntlmphase3 establishhttpproxypassthru...

OSV-2021-1027 Index-out-of-bounds in sd_read_byte

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36240 Crash type: Index-out-of-bounds Crash state: sdreadbyte sdbusreaddata sdhcireadblockfromcard...

OSV-2021-1024 Global-buffer-overflow in GetSsmlAttribute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36228 Crash type: Global-buffer-overflow READ 1 Crash state: GetSsmlAttribute GetVoiceAttributes ProcessSsmlTag...

OSV-2021-1017 Stack-buffer-overflow in piv_compute_signature

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36200 Crash type: Stack-buffer-overflow WRITE Crash state: pivcomputesignature sccomputesignature usekey...