A heap-buffer-overflow vulnerability was identified in the ClamAV antivirus software within the cli_strlcat function, as reported by OSS-Fuzz. The issue causes a write overflow on the heap, potentially leading to a crash during YARA rule parsing. No CVSS score or vendor patch information is provided, and no known exploits are reported in the wild. The affected versions include the commit e5f001c9ca4175beecd445004a8e01bbdd29579c and later. The severity is assessed as medium based on the available data.
A heap-buffer-overflow vulnerability exists in the blosc_d function of the c-blosc2 compression library, as reported by OSS-Fuzz. This issue involves an out-of-bounds read of 4 bytes during decompression operations.
A heap-buffer-overflow vulnerability was identified in the get_next_owned_entity function of libredwg, as reported by OSS-Fuzz. The issue involves an out-of-bounds read of 8 bytes, leading to a crash during processing. Multiple specific versions of libredwg 0.12.4 and the 0.12.5-pre release are affected.
A memory safety issue (UNKNOWN READ) was reported in the libucl library in the function kh_get_ucl_hash_node, identified by OSS-Fuzz. The crash occurs during hash node retrieval and inheritance handling. Multiple versions of libucl are affected, but no patch or fix information is provided.
A heap-buffer-overflow vulnerability exists in the function dwg_convert_SAB_to_SAT1 of the libredwg library. The issue was reported by OSS-Fuzz and involves a read overflow of 2 bytes, potentially leading to memory corruption.
A heap-buffer-overflow vulnerability exists in the c-blosc2 library within the ZSTD_decompressBlock_internal function. This issue was reported by OSS-Fuzz and involves a read overflow during decompression operations.
A global buffer overflow vulnerability exists in the GetSsmlAttribute function of espeak-ng versions 1.51 and 1.52.0. This issue was reported by OSS-Fuzz and involves an out-of-bounds read leading to a crash. The vulnerability has been fixed in a later commit.
A memory safety issue (UNKNOWN READ) has been reported in the kimageformats component, specifically in the function mc_chroma<unsigned short>. The issue was identified by OSS-Fuzz and involves a crash during inter prediction sample generation and prediction unit decoding. Multiple versions of kimageformats from 5.80.0 through 5.90.0-rc1 are affected. No CVSS score or detailed impact information is provided, and no public exploit or patch information is available.
A use-of-uninitialized-value vulnerability was reported in the residual_coding function of the kimageformats component. The issue was identified by OSS-Fuzz and involves reading uninitialized memory during image processing.
A vulnerability in QEMU's virtio GPU component causes an unknown read error during the disable scanout operation. This issue was identified by OSS-Fuzz and affects multiple release candidates and stable versions of QEMU 6.1.x, 6.2.x, and 7.0.x series. The flaw involves the virtio_gpu_disable_scanout function and related GPU scanout handling code.
A use-of-uninitialized-value vulnerability was identified in the kimageformats component, specifically in the decode_CABAC_FL_bypass function. This issue was reported by OSS-Fuzz and involves uninitialized memory usage during decoding operations.
A use-of-uninitialized-value vulnerability was reported in the kimageformats component, specifically in the intra_prediction_angular function template. The issue was identified by OSS-Fuzz and involves uninitialized memory usage during intra prediction decoding.
A use-of-uninitialized-value vulnerability was reported in the kimageformats component, specifically in the function edge_filtering_chroma_internal<unsigned char>. The issue was identified by OSS-Fuzz and involves a crash due to uninitialized memory usage during image processing.
A heap-buffer-overflow vulnerability exists in the derive_collocated_motion_vectors function of libheif, as reported by OSS-Fuzz. The issue involves an out-of-bounds read leading to a crash in related functions handling motion vector prediction.
A use-of-uninitialized-value vulnerability was identified in the kimageformats library within the XCFImageFormat::mergeRGBToRGB function. This issue was reported by OSS-Fuzz and involves improper handling of uninitialized memory during image layer merging operations.
A use-of-uninitialized-value vulnerability was reported in the kimageformats component, specifically in the fetchARGB32ToRGBA64PM_avx2 function. The issue was identified through an OSS-Fuzz report and involves a crash due to uninitialized memory usage during image processing operations.