Overflowing the DjVuLibre MMR decoder with zero-length runs
A fax-coding decoder writes one run-length entry per code and never checks it is still inside the buffer.
found by Antonio Morales, GitHub Security Lab
memory-safety
Out-of-bounds write in libcue from a negative INDEX number
atoi has no way to report failure, and track_set_index only checked one end of the array.
found by Kevin Backhouse, GitHub Security Lab
Type confusion in OpenSSL's X.400 address handling (CVE-2023-0286)
A public header said ASN1_TYPE, the ASN.1 template produced an ASN1_STRING, and one comparison function stood between the two.
found by David Benjamin (Google); fix by Hugo Landau
Turning a 27-byte IP fragment into an arbitrary write in U-Boot
U-Boot stores its IP reassembly hole list inside the holes, and a 27-byte fragment lands right on top of it.
found by Nicolas Guigo and Nicolas Bidron, NCC Group
A fifth length byte: integer overflow and a signed syscall compare in Zephyr RTOS
A greater-than that should have been a greater-than-or-equal lets a remote MQTT packet pick any 32-bit length it likes, and a signed branch instruction lets a user thread pick any function pointer it…
found by Ilya Zhuravlev and Jeremy Boone, NCC Group
Zero-click block pool overflow in Marvell Avastar Wi-Fi firmware (CVE-2019-6496)
A Wi-Fi SoC is a whole second computer with its own RTOS and its own RAM, and the firmware Denis Selianin fuzzed would parse hostile beacon frames on a five-minute timer with nobody in the loop.
found by Denis Selianin, Embedi