TQRG/raw-osv-data huggingface dataset:
Vulnerability: OSV-2020-940
Summary: Heap-use-after-free in surround51_to_stereo_downmix_mtx
Severity: HIGH
Published: 2020-07-22T00:00:19.715558Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21113

```
Crash type: Heap-use-after-free WRITE 4
Crash state:
surround51_to_stereo_downmix_mtx
cras_fmt_conv_create
config_format_converter
```
Vulnerability: OSV-2018-140
Summary: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short
Severity: MEDIUM
Published: 2021-01-13T00:01:00.287078Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11074

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
BEInt<unsigned short, 2>::operator unsigned short
AAT::LookupFormat10<OT::IntType<unsigned short, 2u> >::sanitize
AAT::Lookup<OT::IntType<unsigned short, 2u> >::sanitize
```
Vulnerability: OSV-2020-1065
Summary: Use-of-uninitialized-value in xsltNumberFormatInsertNumbers
Severity: MEDIUM
Published: 2020-07-22T21:49:44.558167Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471

Crash type: Use-of-uninitialized-value
Crash state:
xsltNumberFormatInsertNumbers
xsltNumberFormat
xsltNumber
Vulnerability: OSV-2020-413
Summary: Stack-buffer-overflow in ot::NetworkData::NetworkDataTlv::GetNext
Severity: MEDIUM
Published: 2020-07-01T00:00:08.114688Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14401

```
Crash type: Stack-buffer-overflow READ 1
Crash state:
ot::NetworkData::NetworkDataTlv::GetNext
ot::NetworkData::Leader::IsStableUpdated
ot::NetworkData::Leader::RegisterNetworkData
```
Vulnerability: OSV-2021-940
Summary: Heap-buffer-overflow in json_string_unescape
Severity: HIGH
Published: 2021-07-09T00:01:28.772223Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35925

```
Crash type: Heap-buffer-overflow WRITE 1
Crash state:
json_string_unescape
after_value
execute_callbacks
```
Vulnerability: OSV-2021-1429
Summary: Heap-buffer-overflow in unpack_16bit
Severity: HIGH
Published: 2021-10-10T00:00:16.052480Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39737

```
Crash type: Heap-buffer-overflow WRITE 2
Crash state:
unpack_16bit
exr_decoding_run
Imf_3_1::checkCoreFile
```
Vulnerability: OSV-2022-271
Summary: UNKNOWN READ in pdf14_buf_free
Severity: MEDIUM
Published: 2022-03-22T00:01:47.478262Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45892

```
Crash type: UNKNOWN READ
Crash state:
pdf14_buf_free
rc_pdf14_maskbuf_free
pdf14_end_transparency_mask
```
Vulnerability: OSV-2021-782
Summary: Global-buffer-overflow in IsLetterGroup
Published: 2021-05-21T00:00:07.675695Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34494

```
Crash type: Global-buffer-overflow READ 1
Crash state:
IsLetterGroup
MatchRule
TranslateRules
```
Vulnerability: OSV-2021-278
Summary: Heap-buffer-overflow in H5MM_memcpy
Severity: MEDIUM
Published: 2021-02-05T00:01:09.038933Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30250

```
Crash type: Heap-buffer-overflow READ {*}
Crash state:
H5MM_memcpy
H5VM_memcpyvv
H5D__compact_readvv
```
Vulnerability: OSV-2020-628
Summary: UNKNOWN READ in copy_string
Severity: MEDIUM
Published: 2020-07-01T00:00:21.328353Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15482

```
Crash type: UNKNOWN READ
Crash state:
copy_string
do_uncompress_block
process_block
```
Vulnerability: OSV-2020-278
Summary: Heap-buffer-overflow in ih264d_decode_slice_thread
Severity: MEDIUM
Published: 2020-06-30T00:00:45.549045Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19027

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
ih264d_decode_slice_thread
ih264d_decode_picture_thread
clone
```
Vulnerability: OSV-2020-782
Summary: UNKNOWN READ in H5O_dtype_decode_helper
Severity: MEDIUM
Published: 2020-07-14T05:37:32.900547Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23320

```
Crash type: UNKNOWN READ
Crash state:
H5O_dtype_decode_helper
H5O_dtype_shared_decode
H5O_attr_shared_decode
```
Vulnerability: OSV-2020-2188
Summary: Heap-buffer-overflow in ih264d_parse_pslice
Severity: HIGH
Published: 2020-11-26T00:00:03.791789Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27856

```
Crash type: Heap-buffer-overflow WRITE {*}
Crash state:
ih264d_parse_pslice
ih264d_parse_decode_slice
ih264d_parse_nal_unit
```
Vulnerability: OSV-2020-852
Summary: Use-of-uninitialized-value in H5MM_xstrdup
Severity: MEDIUM
Published: 2020-07-14T22:13:45.896859Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21457

```
Crash type: Use-of-uninitialized-value
Crash state:
H5MM_xstrdup
H5E_push_stack
H5E_printf_stack
```
Vulnerability: OSV-2021-1215
Summary: Invalid-free in swift_unexpectedError
Published: 2021-09-10T00:00:28.645690Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38264

```
Crash type: Invalid-free
Crash state:
swift_unexpectedError
function signature specialization <Arg
function signature specialization <Arg
```
Vulnerability: OSV-2021-1645
Summary: UNKNOWN READ in ndlz4_decompress
Severity: MEDIUM
Published: 2021-12-04T00:01:27.768326Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41636

```
Crash type: UNKNOWN READ
Crash state:
ndlz4_decompress
blosc_d
do_job
```
Vulnerability: OSV-2020-1874
Summary: Use-of-uninitialized-value in load_truetype_glyph
Severity: MEDIUM
Published: 2020-09-29T00:00:24.645658Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22182

Crash type: Use-of-uninitialized-value
Crash state:
load_truetype_glyph
TT_Load_Glyph
tt_glyph_load
Vulnerability: OSV-2020-917
Summary: Heap-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayVisitor>
Severity: MEDIUM
Published: 2020-07-22T00:00:06.823071Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21039

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayVisitor>
arrow::internal::ValidateArray
arrow::RecordBatch::Validate
```
Vulnerability: OSV-2018-117
Summary: Heap-buffer-overflow in Envoy::StringUtil::itoa
Severity: HIGH
Published: 2021-01-13T00:00:54.062431Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10038

```
Crash type: Heap-buffer-overflow WRITE 1
Crash state:
Envoy::StringUtil::itoa
Envoy::Http::HeaderString::setInteger
Envoy::TestOneProtoInput
```
Vulnerability: OSV-2022-158
Summary: Heap-buffer-overflow in parse_primitive
Severity: MEDIUM
Published: 2022-02-16T00:00:29.292668Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44695

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
parse_primitive
plist_from_json
jplist_fuzzer.cc
```
Vulnerability: OSV-2022-267
Summary: Segv on unknown address in flb_sds_copy
Published: 2022-03-21T00:01:43.029782Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45879

```
Crash type: Segv on unknown address
Crash state:
flb_sds_copy
flb_parser_decoder_do
flb_parser_logfmt_do
```
Vulnerability: OSV-2021-1595
Summary: UNKNOWN WRITE in sprint_realloc_hinted_integer
Severity: HIGH
Published: 2021-11-21T00:00:06.936393Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41205

```
Crash type: UNKNOWN WRITE
Crash state:
sprint_realloc_hinted_integer
sprint_realloc_integer
snprint_integer
```
Vulnerability: OSV-2018-228
Summary: Heap-buffer-overflow in g_variant_serialiser_is_string
Severity: MEDIUM
Published: 2021-01-13T00:01:34.116112Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9828

Crash type: Heap-buffer-overflow READ 1
Crash state:
g_variant_serialiser_is_string
g_variant_serialiser_is_object_path
g_variant_serialised_is_normal
Vulnerability: OSV-2021-281
Summary: Heap-buffer-overflow in flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>
Severity: MEDIUM
Published: 2021-02-06T00:00:11.762958Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30289

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>
flatbuffers::Table const* flatbuffers::GetRoot<flatbuffers::Table>
flatbuffers::JsonPrinter::GenFieldOffset
```
Vulnerability: OSV-2020-2171
Summary: Stack-buffer-overflow in fp_read_unsigned_bin
Severity: MEDIUM
Published: 2020-11-21T00:00:42.417255Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27666

```
Crash type: Stack-buffer-overflow READ 8
Crash state:
fp_read_unsigned_bin
mp_read_unsigned_bin
wc_RsaPublicKeyDecodeRaw
```
Vulnerability: OSV-2020-794
Summary: Use-of-uninitialized-value in Splash::pipeRunSimpleXBGR8
Severity: MEDIUM
Published: 2020-07-14T05:37:37.128981Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23086

Crash type: Use-of-uninitialized-value
Crash state:
Splash::pipeRunSimpleXBGR8
Splash::blitImage
Splash::drawImage
Vulnerability: OSV-2021-794
Summary: Heap-buffer-overflow in mrb_format_float
Severity: HIGH
Published: 2021-05-25T23:49:50.285850Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34652

```
Crash type: Heap-buffer-overflow WRITE 1
Crash state:
mrb_format_float
fmt_float
mrb_str_format
```
Vulnerability: OSV-2021-1080
Summary: Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr
Severity: HIGH
Published: 2021-08-01T00:00:08.293111Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36706

```
Crash type: Use-after-poison WRITE 8
Crash state:
AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr
AK::String::String
JS::abstract_relation
```
Vulnerability: OSV-2020-21
Summary: UNKNOWN WRITE in arrow::internal::unpack32
Severity: HIGH
Published: 2020-06-24T01:51:10.547779Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20711

```
Crash type: UNKNOWN WRITE
Crash state:
arrow::internal::unpack32
int arrow::BitUtil::BitReader::GetBatch<int>
parquet::DictByteArrayDecoderImpl::DecodeArrowDense
```
Vulnerability: OSV-2020-1862
Summary: Use-of-uninitialized-value in ares_parse_caa_reply
Severity: MEDIUM
Published: 2020-09-28T00:00:13.102068Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26012

```
Crash type: Use-of-uninitialized-value
Crash state:
ares_parse_caa_reply
ares-test-fuzz.c
```
Vulnerability: OSV-2020-147
Summary: Heap-buffer-overflow in BEInt<short, 2>::operator short
Severity: MEDIUM
Published: 2020-06-24T01:51:16.229267Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21026

```
Crash type: Heap-buffer-overflow READ 2
Crash state:
BEInt<short, 2>::operator short
OT::IntType<short, 2u>::operator int
OT::TupleVarHeader::calculate_scalar
```
Vulnerability: OSV-2018-414
Summary: Use-of-uninitialized-value in jbig2_immediate_generic_region
Severity: MEDIUM
Published: 2021-01-15T00:01:14.704723Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9680

Crash type: Use-of-uninitialized-value
Crash state:
jbig2_immediate_generic_region
jbig2_parse_segment
jbig2_data_in
Vulnerability: OSV-2021-147
Summary: Use-of-uninitialized-value in gnutls_ocsp_resp_get_status
Severity: MEDIUM
Published: 2021-01-13T21:56:29.997Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1492

```
Crash type: Use-of-uninitialized-value
Crash state:
gnutls_ocsp_resp_get_status
gnutls_ocsp_resp_import
_start
```
Vulnerability: OSV-2020-1161
Summary: Heap-buffer-overflow in impeg2_fmt_conv_yuv420p_to_yuv420sp_uv
Severity: HIGH
Published: 2020-07-22T21:49:52.257088Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16604

```
Crash type: Heap-buffer-overflow WRITE 1
Crash state:
impeg2_fmt_conv_yuv420p_to_yuv420sp_uv
impeg2d_format_convert
impeg2d_dec_pic_data_thread
```
Vulnerability: OSV-2018-101
Summary: Heap-buffer-overflow in r_bin_mdmp_init_pe_bins
Severity: MEDIUM
Published: 2021-01-13T00:00:44.502980Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11361

```
Crash type: Heap-buffer-overflow READ 8
Crash state:
r_bin_mdmp_init_pe_bins
r_bin_mdmp_init
r_bin_mdmp_new_buf
```
Vulnerability: OSV-2021-1346
Summary: UNKNOWN READ in state_VLC_dec::load_bytes
Severity: MEDIUM
Published: 2021-09-22T00:00:11.187759Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39046

```
Crash type: UNKNOWN READ
Crash state:
state_VLC_dec::load_bytes
state_VLC_dec::state_VLC_dec
htj2k_decode
```
Vulnerability: OSV-2020-452
Summary: UNKNOWN READ in _fini
Severity: MEDIUM
Published: 2020-07-01T00:00:10.397492Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18611

```
Crash type: UNKNOWN READ
Crash state:
_fini
```
Vulnerability: OSV-2018-48
Summary: Heap-buffer-overflow in PCF_Glyph_Load
Severity: MEDIUM
Published: 2021-01-13T00:00:26.415724Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9524

```
Crash type: Heap-buffer-overflow READ 2
Crash state:
PCF_Glyph_Load
FT_Load_Glyph
ftfuzzer.cc
```
Vulnerability: OSV-2020-2126
Summary: Heap-buffer-overflow in ndpi_workflow_process_packet
Severity: MEDIUM
Published: 2020-11-03T00:00:46.816747Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26880

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
ndpi_workflow_process_packet
fuzz_ndpi_reader.c
```
Vulnerability: OSV-2021-1192
Summary: Segv on unknown address in arrow::DefaultBackend
Published: 2021-09-02T00:01:47.797383Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37927

```
Crash type: Segv on unknown address
Crash state:
arrow::DefaultBackend
arrow::PoolBuffer::MakeUnique
arrow::AllocateBuffer
```
Vulnerability: OSV-2021-669
Summary: Heap-buffer-overflow in _estrdup
Severity: MEDIUM
Published: 2021-04-22T00:00:12.106706Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33495

```
Crash type: Heap-buffer-overflow READ {*}
Crash state:
_estrdup
exif_process_user_comment
exif_process_IFD_TAG_impl
```
Vulnerability: OSV-2022-375
Summary: Stack-use-after-return in std::__1::__function::__func<bool grk::WaveletReverse::decompress_partial_tile<i
Published: 2022-04-26T00:00:52.868142Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46986

```
Crash type: Stack-use-after-return READ 1
Crash state:
std::__1::__function::__func<bool grk::WaveletReverse::decompress_partial_tile<i
tf::Executor::_invoke
tf::Executor::_spawn
```
Vulnerability: OSV-2020-669
Summary: Use-of-uninitialized-value in g_date_time_get_week_number
Severity: MEDIUM
Published: 2020-07-01T00:00:23.657942Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17648

Crash type: Use-of-uninitialized-value
Crash state:
g_date_time_get_week_number
g_date_time_new_week
parse_isoNUMBER_date
Vulnerability: OSV-2020-2063
Summary: Heap-buffer-overflow in WelsDec::WelsDecodeMbCavlcBSlice
Severity: HIGH
Published: 2020-10-14T00:00:24.741197Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26296

```
Crash type: Heap-buffer-overflow WRITE 16
Crash state:
WelsDec::WelsDecodeMbCavlcBSlice
WelsDec::WelsDecodeSlice
WelsDec::DecodeCurrentAccessUnit
```
Vulnerability: OSV-2020-393
Summary: Heap-buffer-overflow in Elf32_r_bin_elf_compiler
Severity: HIGH
Published: 2020-07-01T00:00:06.928110Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13858

```
Crash type: Heap-buffer-overflow WRITE 1
Crash state:
Elf32_r_bin_elf_compiler
info
r_bin_object_set_items
```
Vulnerability: OSV-2020-1136
Summary: Global-buffer-overflow in ssl_sigalg
Published: 2020-07-22T21:49:49.841110Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13797

```
Crash type: Global-buffer-overflow READ 2
Crash state:
ssl_sigalg
tls1_process_sigalgs
tlsext_sigalgs_server_parse
```
Vulnerability: OSV-2020-813
Summary: Use-of-uninitialized-value in inflate
Severity: MEDIUM
Published: 2020-07-14T05:37:44.963693Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17121

```
Crash type: Use-of-uninitialized-value
Crash state:
inflate
InflateRankDims
ReadNextStructField
```
Vulnerability: OSV-2020-1566
Summary: Heap-buffer-overflow in ndpi_workflow_process_packet
Severity: MEDIUM
Published: 2020-08-02T00:01:17.893681Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24576

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
ndpi_workflow_process_packet
fuzz_ndpi_reader.c
```
Vulnerability: OSV-2021-1604
Summary: Heap-buffer-overflow in jxl::N_AVX2::SingleFromSingle
Severity: MEDIUM
Published: 2021-11-22T00:00:35.889328Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41225

```
Crash type: Heap-buffer-overflow READ {*}
Crash state:
jxl::N_AVX2::SingleFromSingle
jxl::ThreadPool::SequentialRunnerStatic
jxl::ModularFrameDecoder::ModularImageToDecodedRect
```
Vulnerability: OSV-2021-540
Summary: Heap-buffer-overflow in g_array_append_vals
Severity: MEDIUM
Published: 2021-03-21T00:00:08.667933Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32249

```
Crash type: Heap-buffer-overflow READ {*}
Crash state:
g_array_append_vals
g_byte_array_append
fu_efi_firmware_volume_write
```
Vulnerability: OSV-2020-1835
Summary: Stack-buffer-overflow in fmt::v7::detail::buffer<char>::push_back
Severity: MEDIUM
Published: 2020-09-25T00:00:10.846065Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25884

```
Crash type: Stack-buffer-overflow READ 1
Crash state:
fmt::v7::detail::buffer<char>::push_back
std::__1::back_insert_iterator<fmt::v7::detail::buffer<char> >::operator=
fmt::v7::detail::buffer_appender<char> std::__1::__copy_constexpr<char const*, f
```
Vulnerability: OSV-2020-110
Summary: Heap-buffer-overflow in parquet::internal::RecordReader::Make
Severity: MEDIUM
Published: 2020-06-24T01:51:14.532580Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20989

```
Crash type: Heap-buffer-overflow READ 8
Crash state:
parquet::internal::RecordReader::Make
parquet::arrow::LeafReader::LeafReader
parquet::arrow::GetReader
```
Vulnerability: OSV-2021-813
Summary: Use-of-uninitialized-value in StandardSecurityHandler::StandardSecurityHandler
Severity: MEDIUM
Published: 2021-05-30T00:00:05.737839Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34778

Crash type: Use-of-uninitialized-value
Crash state:
StandardSecurityHandler::StandardSecurityHandler
SecurityHandler::make
PDFDoc::checkEncryption
Vulnerability: OSV-2020-540
Summary: Heap-buffer-overflow in byte_from_wkb_state
Severity: MEDIUM
Published: 2020-07-01T00:00:15.605041Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16591

Crash type: Heap-buffer-overflow READ 1
Crash state:
byte_from_wkb_state
lwgeom_from_wkb_state
lwcollection_from_wkb_state
Vulnerability: OSV-2020-76
Summary: Heap-use-after-free in pixAverageRasterScans
Severity: HIGH
Published: 2020-06-24T01:51:13.003871Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22760

```
Crash type: Heap-use-after-free READ 1
Crash state:
pixAverageRasterScans
pixExtractBarcodeCrossings
pixExtractBarcodeWidths1
```
Vulnerability: OSV-2020-405
Summary: Stack-buffer-overflow in ZSTD_decodeLiteralsBlock
Severity: HIGH
Published: 2020-07-01T00:00:07.677115Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16445

```
Crash type: Stack-buffer-overflow WRITE {*}
Crash state:
ZSTD_decodeLiteralsBlock
ZSTD_decompressBlock
ZSTD_decompressDCtx
```
Vulnerability: OSV-2021-1311
Summary: Null-dereference READ in unzOpenCurrentFile3
Published: 2021-09-18T00:00:37.776159Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38873

```
Crash type: Null-dereference READ
Crash state:
unzOpenCurrentFile3
unzOpenCurrentFile
Assimp::ZipFileInfo::Extract
```
Vulnerability: OSV-2018-156
Summary: Heap-buffer-overflow in dotnet_parse_us
Severity: MEDIUM
Published: 2021-01-13T00:01:07.126725Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11945

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
dotnet_parse_us
dotnet_parse_com
dotnet__load
```
Vulnerability: OSV-2020-956
Summary: Heap-buffer-overflow in ndpi_workflow_process_packet
Severity: MEDIUM
Published: 2020-07-22T00:00:25.708813Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20644

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
ndpi_workflow_process_packet
fuzz_ndpi_reader.c
HonggfuzzPersistentLoop
```
Vulnerability: OSV-2021-1741
Summary: Stack-buffer-overflow in line_join_points
Severity: HIGH
Published: 2021-12-23T00:00:50.607893Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42796

Crash type: Stack-buffer-overflow WRITE 4
Crash state:
line_join_points
stroke_add_compat
gx_stroke_path_only
Vulnerability: OSV-2020-1423
Summary: Use-of-uninitialized-value in txt2sd
Severity: MEDIUM
Published: 2020-07-28T00:00:16.191970Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22219

```
Crash type: Use-of-uninitialized-value
Crash state:
txt2sd
fuzz_mdns_xht.cc
txt2sd
```
Vulnerability: OSV-2020-8
Summary: Heap-buffer-overflow in findNextBorderPixel
Severity: MEDIUM
Published: 2020-06-24T01:51:09.673990Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23433

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
findNextBorderPixel
pixGetHoleBorder
pixGetCCBorders
```
Vulnerability: OSV-2020-1264
Summary: Use-of-uninitialized-value in AnnotAppearanceBuilder::drawText
Severity: MEDIUM
Published: 2020-07-22T21:50:01.559473Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17607

Crash type: Use-of-uninitialized-value
Crash state:
AnnotAppearanceBuilder::drawText
AnnotAppearanceBuilder::drawFormFieldChoice
AnnotAppearanceBuilder::drawFormField
Vulnerability: OSV-2021-242
Summary: Heap-buffer-overflow in rans_uncompress_to_4x16
Severity: MEDIUM
Published: 2021-01-26T23:45:33.235035Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29939

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
rans_uncompress_to_4x16
rans_decode
uncompress
```
Vulnerability: OSV-2020-2018
Summary: Heap-use-after-free in fpixChangeRefcount
Severity: HIGH
Published: 2020-10-12T00:00:40.582555Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26260

```
Crash type: Heap-use-after-free READ 4
Crash state:
fpixChangeRefcount
fpixDestroy
fpix2_fuzzer.cc
```
Vulnerability: OSV-2020-612
Summary: Use-of-uninitialized-value in std::__1::vector<std::__1::vector<Sass::SharedImpl<Sass::ComplexSelector>, std::
Severity: MEDIUM
Published: 2020-07-01T00:00:20.375619Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18066

```
Crash type: Use-of-uninitialized-value
Crash state:
std::__1::vector<std::__1::vector<Sass::SharedImpl<Sass::ComplexSelector>, std::
Sass::ComplexSelector::resolve_parent_refs
Sass::Eval::operator
```
Vulnerability: OSV-2020-242
Summary: Heap-buffer-overflow in ndpi_workflow_process_packet
Severity: MEDIUM
Published: 2020-06-26T00:00:09.227452Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20089

```
Crash type: Heap-buffer-overflow READ 2
Crash state:
ndpi_workflow_process_packet
fuzz_ndpi_reader.c
```
Vulnerability: OSV-2021-1805
Summary: Heap-buffer-overflow in ndpi_search_kerberos
Severity: MEDIUM
Published: 2022-01-23T00:00:37.838585Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43925

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
ndpi_search_kerberos
check_ndpi_detection_func
ndpi_check_flow_func
```
Vulnerability: OSV-2020-757
Summary: Heap-buffer-overflow in cras_channel_remix_conv_create
Severity: MEDIUM
Published: 2020-07-09T00:00:09.165795Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23612

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
cras_channel_remix_conv_create
audio_thread_config_global_remix
ccr_handle_message_from_client
```
Vulnerability: OSV-2020-307
Summary: Heap-buffer-overflow in spng_decode_image
Severity: MEDIUM
Published: 2020-06-30T00:00:49.046191Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16830

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
spng_decode_image
spng_read_fuzzer.cc
```
Vulnerability: OSV-2021-1413
Summary: UNKNOWN READ in helper_uc_tracecode
Severity: MEDIUM
Published: 2021-10-05T00:01:45.386128Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39559

```
Crash type: UNKNOWN READ
Crash state:
helper_uc_tracecode
```
Vulnerability: OSV-2021-757
Summary: Use-of-uninitialized-value in nn_check_initialized
Severity: MEDIUM
Published: 2021-05-12T00:01:05.638739Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34156

```
Crash type: Use-of-uninitialized-value
Crash state:
nn_check_initialized
nn_zero
ecgdsa_sign_raw
```
Vulnerability: OSV-2021-307
Summary: UNKNOWN READ in cpu_arm_exec_armeb
Severity: MEDIUM
Published: 2021-02-08T00:00:08.491999Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30444

```
Crash type: UNKNOWN READ
Crash state:
cpu_arm_exec_armeb
resume_all_vcpus_armeb
vm_start_armeb
```
Vulnerability: OSV-2020-1321
Summary: UNKNOWN READ in FlowGetHash
Severity: MEDIUM
Published: 2020-07-22T21:50:06.291563Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21479

```
Crash type: UNKNOWN READ
Crash state:
FlowGetHash
FlowSetupPacket
DecodeICMPV4
```
Vulnerability: OSV-2018-204
Summary: UNKNOWN WRITE in __msan_memcpy.part.51
Severity: HIGH
Published: 2021-01-13T00:01:23.035709Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845

```
Crash type: UNKNOWN WRITE
Crash state:
__msan_memcpy.part.51
QuickOpen::ReadRaw
QuickOpen::ReadNext
```
Vulnerability: OSV-2018-64
Summary: Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int
Severity: MEDIUM
Published: 2021-01-13T00:00:31.625117Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11522

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
BEInt<unsigned int, 4>::operator unsigned int
void hb_sanitize_context_t::set_object<OT::KernSubTable<OT::KernAATSubTableHeade
AAT::KerxTable<OT::KernAAT>::sanitize
```
Vulnerability: OSV-2020-184
Summary: Heap-buffer-overflow in file_strncmp
Severity: MEDIUM
Published: 2020-06-24T01:51:17.908691Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23044

```
Crash type: Heap-buffer-overflow READ 13
Crash state:
file_strncmp
magiccheck
match
```
Vulnerability: OSV-2021-887
Summary: Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr
Severity: HIGH
Published: 2021-06-22T00:01:25.243822Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35436

```
Crash type: Use-after-poison WRITE 8
Crash state:
AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr
AK::String::String
JS::abstract_relation
```
Vulnerability: OSV-2020-2274
Summary: Heap-buffer-overflow in McCopyWidthEq4_c
Severity: MEDIUM
Published: 2020-12-19T00:00:41.113564Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28769

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
McCopyWidthEq4_c
McCopy_sse2
McChroma_ssse3
```
Vulnerability: OSV-2020-1008
Summary: Use-of-uninitialized-value in ihevc_recon_32x32
Severity: MEDIUM
Published: 2020-07-22T21:49:39.707812Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20476

```
Crash type: Use-of-uninitialized-value
Crash state:
ihevc_recon_32x32
ihevcd_iquant_itrans_recon_ctb
ihevcd_process
```
Vulnerability: OSV-2021-1690
Summary: Global-buffer-overflow in search_table_1
Published: 2021-12-14T00:01:39.477607Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42266

Crash type: Global-buffer-overflow READ 1
Crash state:
search_table_1
split_bogus_operator
pdfi_interpret_stream_operator
Vulnerability: OSV-2021-184
Summary: Heap-buffer-overflow in H5HL__fl_deserialize
Severity: MEDIUM
Published: 2021-01-15T00:00:16.202094Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29580

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
H5HL__fl_deserialize
H5HL__cache_datablock_deserialize
H5C_load_entry
```
Vulnerability: OSV-2020-868
Summary: Use-of-uninitialized-value in fetchARGB32ToRGBA64PM_avx2
Severity: MEDIUM
Published: 2020-07-14T22:13:50.828646Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21808

```
Crash type: Use-of-uninitialized-value
Crash state:
fetchARGB32ToRGBA64PM_avx2
blend_untransformed_generic_rgb64
fillRect_normalized
```
Vulnerability: OSV-2021-1385
Summary: Heap-buffer-overflow in Assimp::BaseImporter::ConvertToUTF8
Severity: MEDIUM
Published: 2021-09-28T00:00:07.486971Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39339

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
Assimp::BaseImporter::ConvertToUTF8
Assimp::BaseImporter::TextFileToBuffer
Assimp::OpenGEX::OpenGEXImporter::InternReadFile
```
Vulnerability: OSV-2021-868
Summary: Heap-buffer-overflow in ndpi_set_detected_protocol
Severity: MEDIUM
Published: 2021-06-18T00:00:07.405397Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35288

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
ndpi_set_detected_protocol
ndpi_match_hostname_protocol
processClientServerHello
```
Vulnerability: OSV-2020-491
Summary: Stack-buffer-overflow in Mat_VarReadNextInfo5
Severity: MEDIUM
Published: 2020-07-01T00:00:12.708028Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17119

```
Crash type: Stack-buffer-overflow READ 4
Crash state:
Mat_VarReadNextInfo5
Mat_GetDir
MatioRead
```
Vulnerability: OSV-2020-215
Summary: Use-of-uninitialized-value in xmlStrdup
Severity: MEDIUM
Published: 2020-06-24T01:51:19.309469Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23144

Crash type: Use-of-uninitialized-value
Crash state:
xmlStrdup
__xmlRaiseError
xmlErrValidNode
Vulnerability: OSV-2020-1233
Summary: Heap-buffer-overflow in getTLScertificate
Severity: MEDIUM
Published: 2020-07-22T21:49:58.860561Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19269

```
Crash type: Heap-buffer-overflow READ 6
Crash state:
getTLScertificate
tlsDetectProtocolFromCertificate
ndpi_search_tls_tcp_udp
```
Vulnerability: OSV-2020-1726
Summary: Heap-use-after-free in xmlXPathNodeSetAdd
Severity: HIGH
Published: 2020-09-11T00:00:07.083398Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25536

Crash type: Heap-use-after-free READ 4
Crash state:
xmlXPathNodeSetAdd
xmlXPathGetElementsByIds
xmlXPathIdFunction
Vulnerability: OSV-2021-700
Summary: UNKNOWN READ in ReadLEB_u32
Severity: MEDIUM
Published: 2021-04-29T00:00:12.162949Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33749

```
Crash type: UNKNOWN READ
Crash state:
ReadLEB_u32
InitElements
Compile_ExtendedOpcode
```
Vulnerability: OSV-2020-700
Summary: Stack-buffer-overflow in ot::Message::Write
Severity: MEDIUM
Published: 2020-07-01T00:00:25.618153Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15380

```
Crash type: Stack-buffer-overflow READ {*}
Crash state:
ot::Message::Write
ot::Message::Append
ot::Mle::Mle::AppendResponse
```
Vulnerability: OSV-2021-429
Summary: Heap-buffer-overflow in blosc_d
Severity: HIGH
Published: 2021-02-22T00:00:20.030600Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31170

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
blosc_d
_blosc_getitem
blosc2_getitem_ctx
```
Vulnerability: OSV-2020-429
Summary: Heap-buffer-overflow in MEM_read32
Severity: MEDIUM
Published: 2020-07-01T00:00:08.999234Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14368

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
MEM_read32
ZSTDv05_decodeSequence
ZSTDv05_decompressSequences
```
Vulnerability: OSV-2020-2223
Summary: Heap-use-after-free in e1000e_write_packet_to_guest
Severity: HIGH
Published: 2020-12-04T00:00:19.497055Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28194

Crash type: Heap-use-after-free READ 8
Crash state:
e1000e_write_packet_to_guest
e1000e_receive_iov
e1000e_nc_receive_iov
Vulnerability: OSV-2018-33
Summary: Heap-buffer-overflow in yr_object_set_string
Severity: MEDIUM
Published: 2021-01-13T00:00:14.651679Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14560

```
Crash type: Heap-buffer-overflow READ {*}
Crash state:
yr_object_set_string
dotnet_parse_us
dotnet_parse_com
```
Vulnerability: OSV-2022-67
Summary: Heap-buffer-overflow in cli_bcomp_freemeta
Severity: MEDIUM
Published: 2022-01-21T00:00:45.048694Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43816

```
Crash type: Heap-buffer-overflow READ 8
Crash state:
cli_bcomp_freemeta
cli_bcomp_addpatt
cli_parse_add
```
Vulnerability: OSV-2020-1819
Summary: Heap-buffer-overflow in void cv::copyToMat<int>
Severity: MEDIUM
Published: 2020-09-21T00:00:12.969129Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25779

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
void cv::copyToMat<int>
cv::decodeSRGBData
cv::Jpeg2KOpjDecoder::readData
```
Vulnerability: OSV-2021-1628
Summary: Stack-buffer-overflow in sprint_realloc_hinted_integer
Published: 2021-11-27T00:01:21.208846Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41372

```
Crash type: Stack-buffer-overflow WRITE 1
Crash state:
sprint_realloc_hinted_integer
sprint_realloc_integer
snprint_integer
```
Vulnerability: OSV-2018-195
Summary: Heap-buffer-overflow in gmp_emsa_pkcs1_signature_data
Severity: HIGH
Published: 2021-01-13T00:01:21.218732Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10671

```
Crash type: Heap-buffer-overflow WRITE 1
Crash state:
gmp_emsa_pkcs1_signature_data
verify_emsa_pkcs1_signature
verify
```
Vulnerability: OSV-2018-300
Summary: Use-of-uninitialized-value in fz_unpack_tile
Severity: MEDIUM
Published: 2021-01-15T00:00:27.081384Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8326

Crash type: Use-of-uninitialized-value
Crash state:
fz_unpack_tile
fz_decomp_image_from_stream
compressed_image_get_pixmap
Vulnerability: OSV-2020-653
Summary: Heap-buffer-overflow in perfetto::base::Hash::Update
Severity: MEDIUM
Published: 2020-07-01T00:00:22.674176Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14753

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
perfetto::base::Hash::Update
perfetto::base::StringView::Hash
perfetto::trace_processor::StringPool::InternString
```
Vulnerability: OSV-2017-16
Summary: Heap-buffer-overflow in file_strncmp
Severity: MEDIUM
Published: 2021-01-13T00:00:27.841127Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=750

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
file_strncmp
magiccheck
match
```
Vulnerability: OSV-2017-154
Summary: Heap-buffer-overflow in TetrahedralInterpFloat
Severity: MEDIUM
Published: 2021-01-15T00:01:25.369737Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=852

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
TetrahedralInterpFloat
_LUTeval16
CachedXFORM
```
Vulnerability: OSV-2021-1452
Summary: Heap-buffer-overflow in mrb_funcall_with_block
Severity: HIGH
Published: 2021-10-15T00:00:40.001741Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39937

```
Crash type: Heap-buffer-overflow WRITE 8
Crash state:
mrb_funcall_with_block
mrb_instance_new
mrb_funcall_with_block
```
Vulnerability: OSV-2020-1730
Summary: Bad-cast to RDKit::Atom
Severity: HIGH
Published: 2020-09-11T00:00:51.334144Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25547

```
Crash type: Bad-cast
Crash state:
Bad-cast to RDKit::Atom
```
Vulnerability: OSV-2018-245
Summary: Use-of-uninitialized-value in fz_keep_imp
Severity: MEDIUM
Published: 2021-01-15T00:00:05.471739Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6837

```
Crash type: Use-of-uninitialized-value
Crash state:
fz_keep_imp
pdf_copy_pattern_gstate
pdf_show_pattern
```
Vulnerability: OSV-2020-1049
Summary: Heap-use-after-free in WelsDec::WelsReorderRefList
Severity: HIGH
Published: 2020-07-22T21:49:43.177956Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14027

```
Crash type: Heap-use-after-free READ 4
Crash state:
WelsDec::WelsReorderRefList
WelsDec::InitRefPicList
WelsDec::DecodeCurrentAccessUnit
```
Vulnerability: OSV-2020-829
Summary: Heap-use-after-free in check_content_type_and_change_protocol
Severity: HIGH
Published: 2020-07-14T05:37:49.889652Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23834

```
Crash type: Heap-use-after-free READ 2
Crash state:
check_content_type_and_change_protocol
ndpi_check_http_tcp
ndpi_search_http_tcp
```
Vulnerability: OSV-2020-254
Summary: Heap-buffer-overflow in pixReadFromTiffStream
Severity: MEDIUM
Published: 2020-06-26T00:00:11.669926Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23654

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
pixReadFromTiffStream
pixReadMemTiff
pixReadMem
```
Vulnerability: OSV-2017-41
Summary: Heap-buffer-overflow in OSS_FUZZ_png_combine_row
Severity: HIGH
Published: 2021-01-13T21:56:05.092063Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3606

```
Crash type: Heap-buffer-overflow WRITE 4
Crash state:
OSS_FUZZ_png_combine_row
OSS_FUZZ_png_read_row
_start
```
Vulnerability: OSV-2020-604
Summary: UNKNOWN READ in Sass::Parser::parseCompoundSelector
Severity: MEDIUM
Published: 2020-07-01T00:00:19.975718Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15904

```
Crash type: UNKNOWN READ
Crash state:
Sass::Parser::parseCompoundSelector
Sass::Parser::parseComplexSelector
Sass::Parser::parseSelectorList
```
Vulnerability: OSV-2021-1110
Summary: Stack-buffer-overflow in TranslateWord2
Severity: HIGH
Published: 2021-08-08T00:02:17.026887Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36932

```
Crash type: Stack-buffer-overflow WRITE 1
Crash state:
TranslateWord2
TranslateClause
SpeakNextClause
```
Vulnerability: OSV-2020-1272
Summary: Heap-buffer-overflow in ASN1_get_object
Severity: MEDIUM
Published: 2020-07-22T21:50:02.220943Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13803

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
ASN1_get_object
asn1_check_tlen
asn1_item_ex_d2i
```
Vulnerability: OSV-2022-318
Summary: UNKNOWN READ
Severity: MEDIUM
Published: 2022-04-07T00:01:51.631058Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46356

```
Crash type: UNKNOWN READ
Crash state:
NULL```
Vulnerability: OSV-2021-1540
Summary: Heap-buffer-overflow in consume_list
Severity: MEDIUM
Published: 2021-11-06T00:01:33.530210Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40723

```
Crash type: Heap-buffer-overflow READ 1
Crash state:
consume_list
pn_amqp_decode_DqEoQBIoIe
pn_message_decode
```
Vulnerability: OSV-2018-212
Summary: Heap-buffer-overflow in token_stream_prepare
Severity: MEDIUM
Published: 2021-01-13T00:01:26.134181Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9805

Crash type: Heap-buffer-overflow READ 1
Crash state:
token_stream_prepare
parse
typedecl_parse
Vulnerability: OSV-2021-1055
Summary: UNKNOWN WRITE in jxl::ModularFrameDecoder::DecodeGroup
Severity: HIGH
Published: 2021-07-25T00:00:32.621715Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36456

```
Crash type: UNKNOWN WRITE
Crash state:
jxl::ModularFrameDecoder::DecodeGroup
jxl::FrameDecoder::ProcessACGroup
jxl::ThreadPool::RunCallState<jxl::FrameDecoder::ProcessSections
```
Vulnerability: OSV-2020-741
Summary: Heap-buffer-overflow in uri_decoder
Severity: MEDIUM
Published: 2020-07-04T00:00:01.437763Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23815

Crash type: Heap-buffer-overflow READ 1
Crash state:
uri_decoder
uri_decode
g_uri_parse_params
Vulnerability: OSV-2020-891
Summary: Heap-buffer-overflow in ccr_handle_message_from_client
Severity: MEDIUM
Published: 2020-07-21T00:00:05.825108Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23965

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
ccr_handle_message_from_client
cras_rclient_buffer_from_client
rclient_message.cc
```
Vulnerability: OSV-2021-1686
Summary: Segv on unknown address in chunk_free_object
Published: 2021-12-14T00:00:38.296258Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42312

Crash type: Segv on unknown address
Crash state:
chunk_free_object
file_close_file
sclose
Vulnerability: OSV-2021-891
Summary: Heap-buffer-overflow in __cil_cat_expr_range_to_bitmap_helper
Severity: MEDIUM
Published: 2021-06-24T00:00:40.542962Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35492

```
Crash type: Heap-buffer-overflow READ 4
Crash state:
__cil_cat_expr_range_to_bitmap_helper
__cil_expr_to_bitmap
__evaluate_cat_expression
```
Vulnerability: OSV-2020-468
Summary: Stack-buffer-overflow in ot::Ip6::Address::FromString
Severity: HIGH
Published: 2020-07-01T00:00:11.286088Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14821

```
Crash type: Stack-buffer-overflow WRITE 1
Crash state:
ot::Ip6::Address::FromString
ot::Cli::Coap::ProcessRequest
ot::Cli::Interpreter::ProcessCoap
```
Vulnerability: OSV-2018-72
Summary: Use-of-uninitialized-value in read_pbkdf2_params
Severity: MEDIUM
Published: 2021-01-13T00:00:34.744580Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10143

```
Crash type: Use-of-uninitialized-value
Crash state:
read_pbkdf2_params
_gnutls_read_pkcs_schema_params
pkcs8_key_decrypt
```
Vulnerability: OSV-2020-487
Summary: UNKNOWN READ in crc32
Severity: MEDIUM
Published: 2020-07-01T00:00:12.477818Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15278

```
Crash type: UNKNOWN READ
Crash state:
crc32
update_crc
push_data_ready
```
Vulnerability: OSV-2021-1239
Summary: Heap-buffer-overflow in stbi__load_and_postprocess_8bit
Severity: MEDIUM
Published: 2021-09-12T00:01:05.421369Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38394

```
Crash type: Heap-buffer-overflow READ 2
Crash state:
stbi__load_and_postprocess_8bit
stb_image.h
```
Vulnerability: OSV-2021-487
Summary: UNKNOWN READ in blosc_run_decompression_with_context
Severity: MEDIUM
Published: 2021-03-04T00:02:22.600849Z

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31611

```
Crash type: UNKNOWN READ
Crash state:
blosc_run_decompression_with_context
blosc2_decompress_ctx
frame_decompress_chunk
```
Vulnerability: PYSEC-2020-85
Aliases: CVE-2020-7936
Published: 2020-01-23T21:15:00Z

An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
Vulnerability: GHSA-mq5c-prh3-3f3h
Summary: Invalid validation in `QuantizeAndDequantizeV2`
Aliases: CVE-2021-29610
Severity: LOW
CWE: CWE-665
Published: 2021-05-21T14:28:32Z

### Impact
The validation in `tf.raw_ops.QuantizeAndDequantizeV2` allows invalid values for `axis` argument:

```python
import tensorflow as tf

input_tensor = tf.constant([0.0], shape=[1], dtype=float)
input_min = tf.constant(-10.0)
input_max = tf.constant(-10.0)

tf.raw_ops.QuantizeAndDequantizeV2(
  input=input_tensor, input_min=input_min, input_max=input_max,
  signed_input=False, num_bits=1, range_given=False, round_mode='HALF_TO_EVEN',
  narrow_range=False, axis=-2)
``` 

The [validation](https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L74-L77) uses `||` to mix two different conditions:

```cc
OP_REQUIRES(ctx,
  (axis_ == -1 || axis_ < input.shape().dims()),
  errors::InvalidArgument(...));
```

If `axis_ < -1` the condition in `OP_REQUIRES` will still be true, but this value of `axis_` results in heap underflow. This allows attackers to read/write to other data on the heap.

### Patches
We have patched the issue in GitHub commit [c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9](https://github.com/tensorflow/tensorflow/commit/c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: PYSEC-2021-171
Aliases: CVE-2021-29534, GHSA-6j9c-grc6-5m6g
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.SparseConcat`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/b432a38fe0e1b4b904a6c222cbce794c39703e87/tensorflow/core/kernels/sparse_concat_op.cc#L76) takes the values specified in `shapes[0]` as dimensions for the output shape. The `TensorShape` constructor(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L183-L188) uses a `CHECK` operation which triggers when `InitDims`(https://github.com/tensorflow/tensorflow/blob/6f9896890c4c703ae0a0845394086e2e1e523299/tensorflow/core/framework/tensor_shape.cc#L212-L296) returns a non-OK status. This is a legacy implementation of the constructor and operations should use `BuildTensorShapeBase` or `AddDimWithStatus` to prevent `CHECK`-failures in the presence of overflows. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-521
Aliases: GHSA-cfx7-2xpc-8w4h, CVE-2021-29593
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `BatchToSpaceNd` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/b5ed552fe55895aee8bd8b191f744a069957d18d/tensorflow/lite/kernels/batch_to_space_nd.cc#L81-L82). An attacker can craft a model such that one dimension of the `block` input is 0. Hence, the corresponding value in `block_shape` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-5wv5-4vpf-pj6m
Summary: Unexpected memory usage in Pallets Project Flask
Aliases: CVE-2019-1010083
Severity: HIGH
CWE: CWE-400
Published: 2019-07-19T16:12:46Z

The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656.
Vulnerability: PYSEC-2014-20
Aliases: CVE-2014-3730
Published: 2014-05-16T15:55:00Z

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."