Same digest, different files: ZIP parser differentials in uv and pip
A ZIP with one digest that expands into two different packages depending on which installer opens it.
found by Caleb Brown (Google) and Tim Hatch (Netflix)
parsing
Overflowing the DjVuLibre MMR decoder with zero-length runs
A fax-coding decoder writes one run-length entry per code and never checks it is still inside the buffer.
found by Antonio Morales, GitHub Security Lab
Out-of-bounds write in libcue from a negative INDEX number
atoi has no way to report failure, and track_set_index only checked one end of the array.
found by Kevin Backhouse, GitHub Security Lab
What does the Squid request smuggling patch actually fix?
The advisory says 'chunked decoder lenience' and stops; the commit says 0x prefixes, bare LFs and a bad rewind point.
found by Keran Mu and Jianjun Chen, Tsinghua University
Type confusion in OpenSSL's X.400 address handling (CVE-2023-0286)
A public header said ASN1_TYPE, the ASN.1 template produced an ASN1_STRING, and one comparison function stood between the two.
found by David Benjamin (Google); fix by Hugo Landau
Namespace separator injection in libexpat (CVE-2022-25236)
libexpat packed three strings into one buffer with a delimiter you chose, and never checked whether the delimiter turned up in the data.
found by Ivan Fratric, Google Project Zero
Running commands from RDoc by starting a filename with a pipe
RDoc sniffed the first hundred bytes of any file called 'tags' to see whether it was a ctags index, and used the one Ruby function that treats a leading pipe as a command.
found by Alexandr Savca
Python's parse_qsl treated semicolons as separators, enabling web cache poisoning
A standard-library parser that separated parameters on ';' as well as '&', and the cache poisoning that followed when the proxy in front disagreed.
found by Adam Goldschmidt (Snyk)
Late delimiters: NFKC normalization and host confusion in CPython's urlsplit
CPython's urlsplit found the host by scanning for delimiters, but IDNA normalizes the name afterwards with NFKC — and some characters only become delimiters once that happens. The first fix worked by…
found by Jonathan Birch (Microsoft) and Panayiotis Panayiotou