Oss-Fuzz

FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng decode tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT MAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.

A crash exists in the IEEE 802.11 protocol dissector. This issue can lead to a denial of service.

Suricata, a network IDS, IPS and NSM engine, experiences an issue where it incorrectly handles the entropy keyword when not anchored to a "sticky" buffer. This can result in a segmentation fault. As a workaround, users can disable rules utilizing the entropy keyword or ensure they are anchored to a sticky buffer.

The issue is a use-after-free condition within the Qt framework, specifically related to the parsing of SVG files. The `renderPattern()` function and the SVG module are affected. The vulnerability occurs when a node is deleted after creation but is subsequently accessed, leading to a use-after-free scenario. This could allow an attacker to execute arbitrary code or cause a denial of service. The vulnerability impacts applications utilizing the Qt SVG module.

A flaw exists that could lead to a denial-of-service (DoS) condition. This occurs when the software renders a Scalable Vector Graphics (SVG) file containing a `<pattern>` element, potentially resulting in recursive rendering and a stack overflow.

Name of the Vulnerable Software and Affected Versions: Qt versions 6.6.0 through 6.8.3 Qt versions 6.9.0 through 6.9.1 Description: When passing values outside of the expected range to `QColorTransferGenericFunction`, it can cause a denial of service. This can occur when passing a specifically crafted ICC profile to `QColorSpace::fromICCProfile`. Recommendations: Update to Qt version 6.8.4 or 6.9.2.

Name of the Vulnerable Software and Affected Versions: Qt versions 6.8.0 through 6.8.4 Description: There is a Heap-based Buffer Overflow vulnerability in `QTextMarkdownImporter`. This requires an incorrectly formatted markdown file to be passed to `QTextMarkdownImporter` to trigger the overflow. Recommendations: For Qt versions 6.8.0 through 6.8.3, update to version 6.8.4 or later to resolve the issue. For Qt versions prior to 6.8.0, no action is required as these versions are not affected. As a temporary workaround, consider restricting the use of `QTextMarkdownImporter` until a patch is available.

The issue allows denial of service via packet injection or crafted capture file, specifically affecting the Bundle Protocol and CBOR dissector in Wireshark. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

The issue is related to the functions `EVP PKEY param check()` and `EVP PKEY public check()` in the OpenSSL library, which can lead to a Denial of Service (DoS) attack when checking excessively long DSA keys or parameters. These functions perform various checks on DSA parameters, and some computations can take a long time if the modulus (`p` parameter) is too large. An application that calls these functions and supplies a key or parameters obtained from an untrusted source could be vulnerable to a DoS attack. The OpenSSL SSL/TLS implementation is not affected by this issue.

The issue is related to the function `EVP PKEY public check()` in the OpenSSL library, which can lead to a Denial of Service (DoS) attack when checking excessively long invalid RSA public keys. This can cause long delays in applications that use this function to check RSA public keys obtained from untrusted sources. The `EVP PKEY public check()` function is called from the OpenSSL pkey command line application, making it vulnerable when used with the '-pubin' and '-check' options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue.

The issue allows for Denial of Service attacks. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash by stack overflow, potentially supporting a denial of service attack.

The issue allows an attacker to cause a denial of service attack by supplying content that causes htmlunit to crash due to a stack overflow when running on user-supplied web pages. This can happen when htmlunit is used to browse untrusted webpages.

The issue is related to the ParseAcceptLanguage function, which can be exploited to cause a denial of service by crafting a specific Accept-Language header. This header can cause the function to take significant time to parse, leading to a denial of service. The problem is due to the quadratic time complexity of the BCP 47 tag parser, which is exposed to untrusted user input. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Programs that compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases, the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After the fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

The issue is related to the Reader.Read function not setting a limit on the maximum size of file headers. A maliciously crafted archive could cause Reader.Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After the fix, Reader.Read limits the maximum size of header blocks to 1 MiB.