diff --git a/bugxml/data.txt b/bugxml/data.txt index fd9cbf03f..05f984b53 100644 --- a/bugxml/data.txt +++ b/bugxml/data.txt @@ -1,4 +1,22 @@ - +id: DW202305-003 +cve: +fuzzer: ossfuzz id: 59091 +datereported: 2023-05-19 +reportedby: David Korczynski +vulnerability: Incorrect section bound check +product: libdwarf +description: A fuzzed line table in the non-standard + (experimental) two-level line table format + exposed a failure as the test was v > sectionend + whereas it has to be v >= sectionend as end pointers + are always one-past the end of the area. + This was incorrect since the experimental table support + was added in 2021. +datefixed: 2023-05-19 +references: regressiontest/ossfuzz59091/fuzz_macro_dwarf5-5135813562990592 +gitfixid: 4017ab8b92195641e6876b388cebe2d3307634f5 +tarrelease: +endrec: DW202305-003 id: DW202305-002 cve: diff --git a/bugxml/dwarfbug.html b/bugxml/dwarfbug.html index 35caf0ee2..c9640f15f 100644 --- a/bugxml/dwarfbug.html +++ b/bugxml/dwarfbug.html @@ -49,8 +49,40 @@

Vulnerabilities

LibDwarf Vulnerabilities Newest First

as of May 2023

-

Record count: 142

-

1) DW202305-002

+

Record count: 143

+

1) DW202305-003

+

id: DW202305-003 +

+

cve: +

+

fuzzer: ossfuzz id: 59091 +

+

datereported: 2023-05-19 +

+

reportedby: David Korczynski +

+

vulnerability: Incorrect section bound check +

+

product: libdwarf +

+

description: A fuzzed line table in the non-standard + (experimental) two-level line table format + exposed a failure as the test was v > sectionend + whereas it has to be v >= sectionend as end pointers + are always one-past the end of the area. + This was incorrect since the experimental table support + was added in 2021. +

+

datefixed: 2023-05-19 +

+

references: regressiontest/ossfuzz59091/fuzz_macro_dwarf5-5135813562990592 +

+

gitfixid: 4017ab8b92195641e6876b388cebe2d3307634f5 +

+

tarrelease: +

+

[top]

+

2) DW202305-002

id: DW202305-002

cve: @@ -84,7 +116,7 @@

1) DW202305-002

tarrelease:

[top]

-

2) DW202305-001

+

3) DW202305-001

id: DW202305-001

cve: @@ -118,7 +150,7 @@

2) DW202305-001

tarrelease:

[top]

-

3) DW202304-004

+

4) DW202304-004

id: DW202304-004

cve: @@ -153,7 +185,7 @@

3) DW202304-004

tarrelease:

[top]

-

4) DW202304-003

+

5) DW202304-003

id: DW202304-003

cve: @@ -188,7 +220,7 @@

4) DW202304-003

tarrelease:

[top]

-

5) DW202304-002

+

6) DW202304-002

id: DW202304-002

cve: @@ -219,7 +251,7 @@

5) DW202304-002

tarrelease:

[top]

-

6) DW202304-001

+

7) DW202304-001

id: DW202304-001

cve: @@ -254,7 +286,7 @@

6) DW202304-001

tarrelease:

[top]

-

7) DW202303-059

+

8) DW202303-059

id: DW202303-059

cve: @@ -286,7 +318,7 @@

7) DW202303-059

tarrelease:

[top]

-

8) DW202303-058

+

9) DW202303-058

id: DW202303-058

cve: @@ -317,7 +349,7 @@

8) DW202303-058

tarrelease:

[top]

-

9) DW202303-057

+

10) DW202303-057

id: DW202303-057

cve: @@ -350,7 +382,7 @@

9) DW202303-057

tarrelease:

[top]

-

10) DW202303-056

+

11) DW202303-056

id: DW202303-056

cve: @@ -387,7 +419,7 @@

10) DW202303-056

tarrelease:

[top]

-

11) DW202303-055

+

12) DW202303-055

id: DW202303-055

cve: @@ -414,7 +446,7 @@

11) DW202303-055

tarrelease:

[top]

-

12) DW202303-054

+

13) DW202303-054

id: DW202303-054

cve: @@ -442,7 +474,7 @@

12) DW202303-054

tarrelease:

[top]

-

13) DW202303-053

+

14) DW202303-053

id: DW202303-053

cve: @@ -472,7 +504,7 @@

13) DW202303-053

tarrelease:

[top]

-

14) DW202303-052

+

15) DW202303-052

id: DW202303-052

cve: @@ -503,7 +535,7 @@

14) DW202303-052

tarrelease:

[top]

-

15) DW202303-051

+

16) DW202303-051

id: DW202303-051

cve: @@ -534,7 +566,7 @@

15) DW202303-051

tarrelease:

[top]

-

16) DW202303-050

+

17) DW202303-050

id: DW202303-050

cve: @@ -564,7 +596,7 @@

16) DW202303-050

tarrelease:

[top]

-

17) DW202303-049

+

18) DW202303-049

id: DW202303-049

cve: @@ -595,7 +627,7 @@

17) DW202303-049

tarrelease:

[top]

-

18) DW202303-048

+

19) DW202303-048

id: DW202303-048

cve: @@ -627,7 +659,7 @@

18) DW202303-048

tarrelease:

[top]

-

19) DW202303-047

+

20) DW202303-047

id: DW202303-047

cve: @@ -660,7 +692,7 @@

19) DW202303-047

tarrelease:

[top]

-

20) DW202303-046

+

21) DW202303-046

id: DW202303-046

cve: @@ -690,7 +722,7 @@

20) DW202303-046

tarrelease:

[top]

-

21) DW202303-045

+

22) DW202303-045

id: DW202303-045

cve: @@ -724,7 +756,7 @@

21) DW202303-045

tarrelease:

[top]

-

22) DW202303-044

+

23) DW202303-044

id: DW202303-044

cve: @@ -759,7 +791,7 @@

22) DW202303-044

tarrelease:

[top]

-

23) DW202303-043

+

24) DW202303-043

id: DW202303-043

cve: @@ -789,7 +821,7 @@

23) DW202303-043

tarrelease:

[top]

-

24) DW202303-042

+

25) DW202303-042

id: DW202303-042

cve: @@ -822,7 +854,7 @@

24) DW202303-042

tarrelease:

[top]

-

25) DW202303-041

+

26) DW202303-041

id: DW202303-041

cve: @@ -851,7 +883,7 @@

25) DW202303-041

tarrelease:

[top]

-

26) DW202303-040

+

27) DW202303-040

id: DW202303-040

cve: @@ -882,7 +914,7 @@

26) DW202303-040

tarrelease:

[top]

-

27) DW202303-039

+

28) DW202303-039

id: DW202303-039

cve: @@ -918,7 +950,7 @@

27) DW202303-039

tarrelease:

[top]

-

28) DW202303-038

+

29) DW202303-038

id: DW202303-038

cve: @@ -949,7 +981,7 @@

28) DW202303-038

tarrelease:

[top]

-

29) DW202303-037

+

30) DW202303-037

id: DW202303-037

cve: @@ -977,7 +1009,7 @@

29) DW202303-037

tarrelease:

[top]

-

30) DW202303-036

+

31) DW202303-036

id: DW202303-036

cve: @@ -1008,7 +1040,7 @@

30) DW202303-036

tarrelease:

[top]

-

31) DW202303-035

+

32) DW202303-035

id: DW202303-035

cve: @@ -1036,7 +1068,7 @@

31) DW202303-035

tarrelease:

[top]

-

32) DW202303-034

+

33) DW202303-034

id: DW202303-034

cve: @@ -1071,7 +1103,7 @@

32) DW202303-034

tarrelease:

[top]

-

33) DW202303-033

+

34) DW202303-033

id: DW202303-033

cve: @@ -1103,7 +1135,7 @@

33) DW202303-033

tarrelease:

[top]

-

34) DW202303-032

+

35) DW202303-032

id: DW202303-032

cve: @@ -1137,7 +1169,7 @@

34) DW202303-032

tarrelease:

[top]

-

35) DW202303-031

+

36) DW202303-031

id: DW202303-031

cve: @@ -1167,7 +1199,7 @@

35) DW202303-031

tarrelease:

[top]

-

36) DW202303-030

+

37) DW202303-030

id: DW202303-030

cve: @@ -1198,7 +1230,7 @@

36) DW202303-030

tarrelease:

[top]

-

37) DW202303-029

+

38) DW202303-029

id: DW202303-029

cve: @@ -1228,7 +1260,7 @@

37) DW202303-029

tarrelease:

[top]

-

38) DW202303-028

+

39) DW202303-028

id: DW202303-028

cve: @@ -1256,7 +1288,7 @@

38) DW202303-028

tarrelease:

[top]

-

39) DW202303-027

+

40) DW202303-027

id: DW202303-027

cve: @@ -1283,7 +1315,7 @@

39) DW202303-027

tarrelease:

[top]

-

40) DW202303-026

+

41) DW202303-026

id: DW202303-026

cve: @@ -1312,7 +1344,7 @@

40) DW202303-026

tarrelease:

[top]

-

41) DW202303-025

+

42) DW202303-025

id: DW202303-025

cve: @@ -1343,7 +1375,7 @@

41) DW202303-025

tarrelease:

[top]

-

42) DW202303-024

+

43) DW202303-024

id: DW202303-024

cve: @@ -1373,7 +1405,7 @@

42) DW202303-024

tarrelease:

[top]

-

43) DW202303-023

+

44) DW202303-023

id: DW202303-023

cve: @@ -1406,7 +1438,7 @@

43) DW202303-023

tarrelease:

[top]

-

44) DW202303-022

+

45) DW202303-022

id: DW202303-022

cve: @@ -1434,7 +1466,7 @@

44) DW202303-022

tarrelease:

[top]

-

45) DW202303-021

+

46) DW202303-021

id: DW202303-021

cve: @@ -1462,7 +1494,7 @@

45) DW202303-021

tarrelease:

[top]

-

46) DW202303-020

+

47) DW202303-020

id: DW202303-020

cve: @@ -1492,7 +1524,7 @@

46) DW202303-020

tarrelease:

[top]

-

47) DW202303-019

+

48) DW202303-019

id: DW202303-019

cve: @@ -1520,7 +1552,7 @@

47) DW202303-019

tarrelease:

[top]

-

48) DW202303-018

+

49) DW202303-018

id: DW202303-018

cve: @@ -1550,7 +1582,7 @@

48) DW202303-018

tarrelease:

[top]

-

49) DW202303-017

+

50) DW202303-017

id: DW202303-017

cve: @@ -1578,7 +1610,7 @@

49) DW202303-017

tarrelease:

[top]

-

50) DW202303-016

+

51) DW202303-016

id: DW202303-016

cve: @@ -1607,7 +1639,7 @@

50) DW202303-016

tarrelease:

[top]

-

51) DW202303-015

+

52) DW202303-015

id: DW202303-015

cve: @@ -1636,7 +1668,7 @@

51) DW202303-015

tarrelease:

[top]

-

52) DW202303-014

+

53) DW202303-014

id: DW202303-014

cve: @@ -1665,7 +1697,7 @@

52) DW202303-014

tarrelease:

[top]

-

53) DW202303-013

+

54) DW202303-013

id: DW202303-013

cve: @@ -1694,7 +1726,7 @@

53) DW202303-013

tarrelease:

[top]

-

54) DW202303-012

+

55) DW202303-012

id: DW202303-012

cve: @@ -1724,7 +1756,7 @@

54) DW202303-012

tarrelease:

[top]

-

55) DW202303-011

+

56) DW202303-011

id: DW202303-011

cve: @@ -1755,7 +1787,7 @@

55) DW202303-011

tarrelease:

[top]

-

56) DW202303-010

+

57) DW202303-010

id: DW202303-010

cve: @@ -1787,7 +1819,7 @@

56) DW202303-010

tarrelease:

[top]

-

57) DW202303-009

+

58) DW202303-009

id: DW202303-009

cve: @@ -1818,7 +1850,7 @@

57) DW202303-009

tarrelease:

[top]

-

58) DW202303-008

+

59) DW202303-008

id: DW202303-008

cve: @@ -1848,7 +1880,7 @@

58) DW202303-008

tarrelease:

[top]

-

59) DW202303-007

+

60) DW202303-007

id: DW202303-007

cve: @@ -1875,7 +1907,7 @@

59) DW202303-007

tarrelease:

[top]

-

60) DW202303-006

+

61) DW202303-006

id: DW202303-006

cve: @@ -1905,7 +1937,7 @@

60) DW202303-006

tarrelease:

[top]

-

61) DW202303-005

+

62) DW202303-005

id: DW202303-005

cve: @@ -1932,7 +1964,7 @@

61) DW202303-005

tarrelease:

[top]

-

62) DW202303-004

+

63) DW202303-004

id: DW202303-004

cve: @@ -1960,7 +1992,7 @@

62) DW202303-004

tarrelease:

[top]

-

63) DW202303-003

+

64) DW202303-003

id: DW202303-003

cve: @@ -1990,7 +2022,7 @@

63) DW202303-003

tarrelease:

[top]

-

64) DW202303-002

+

65) DW202303-002

id: DW202303-002

cve: @@ -2021,7 +2053,7 @@

64) DW202303-002

tarrelease:

[top]

-

65) DW202303-001

+

66) DW202303-001

id: DW202303-001

cve: @@ -2050,7 +2082,7 @@

65) DW202303-001

tarrelease:

[top]

-

66) DW202301-001

+

67) DW202301-001

id: DW202301-001

cve: @@ -2079,7 +2111,7 @@

66) DW202301-001

tarrelease: libdwarf-0.6.0.tar.xz

[top]

-

67) DW202212-001

+

68) DW202212-001

id: DW202212-001

cve: @@ -2121,7 +2153,7 @@

67) DW202212-001

tarrelease: libdwarf-0.6.0.tar.xz

[top]

-

68) DW202208-001

+

69) DW202208-001

id: DW202208-001

cve: @@ -2154,7 +2186,7 @@

68) DW202208-001

tarrelease: libdwarf-0.5.0.tar.xz

[top]

-

69) DW202207-001

+

70) DW202207-001

id: DW202207-001

cve: @@ -2187,7 +2219,7 @@

69) DW202207-001

tarrelease: libdwarf-0.5.0.tar.xz

[top]

-

70) DW202206-001

+

71) DW202206-001

id: DW202206-001

cve: @@ -2220,7 +2252,7 @@

70) DW202206-001

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

71) DW202205-001

+

72) DW202205-001

id: DW202205-001

cve: @@ -2252,7 +2284,7 @@

71) DW202205-001

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

72) DW202111-016

+

73) DW202111-016

id: DW202111-016

cve: @@ -2287,7 +2319,7 @@

72) DW202111-016

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

73) DW202111-015

+

74) DW202111-015

id: DW202111-015

cve: @@ -2319,7 +2351,7 @@

73) DW202111-015

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

74) DW202111-014

+

75) DW202111-014

id: DW202111-014

cve: @@ -2350,7 +2382,7 @@

74) DW202111-014

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

75) DW202111-013

+

76) DW202111-013

id: DW202111-013

cve: @@ -2383,7 +2415,7 @@

75) DW202111-013

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

76) DW202111-012

+

77) DW202111-012

id: DW202111-012

cve: @@ -2413,7 +2445,7 @@

76) DW202111-012

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

77) DW202111-011

+

78) DW202111-011

id: DW202111-011

cve: @@ -2446,7 +2478,7 @@

77) DW202111-011

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

78) DW202111-010

+

79) DW202111-010

id: DW202111-010

cve: @@ -2477,7 +2509,7 @@

78) DW202111-010

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

79) DW202111-009

+

80) DW202111-009

id: DW202111-009

cve: @@ -2511,7 +2543,7 @@

79) DW202111-009

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

80) DW202111-008

+

81) DW202111-008

id: DW202111-008

cve: @@ -2541,7 +2573,7 @@

80) DW202111-008

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

81) DW202111-005

+

82) DW202111-005

id: DW202111-005

cve: @@ -2571,7 +2603,7 @@

81) DW202111-005

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

82) DW202111-004

+

83) DW202111-004

id: DW202111-004

cve: @@ -2602,7 +2634,7 @@

82) DW202111-004

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

83) DW202111-003

+

84) DW202111-003

id: DW202111-003

cve: @@ -2637,7 +2669,7 @@

83) DW202111-003

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

84) DW202111-002

+

85) DW202111-002

id: DW202111-002

cve: @@ -2672,7 +2704,7 @@

84) DW202111-002

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

85) DW202111-001

+

86) DW202111-001

id: DW202111-001

cve: @@ -2708,7 +2740,7 @@

85) DW202111-001

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

86) DW202010-003

+

87) DW202010-003

id: DW202010-003

cve: CVE-2020-28163 @@ -2746,7 +2778,7 @@

86) DW202010-003

tarrelease:

[top]

-

87) DW202010-002

+

88) DW202010-002

id: DW202010-002

cve: CVE-2020-28162 @@ -2789,7 +2821,7 @@

87) DW202010-002

tarrelease:

[top]

-

88) DW202010-001

+

89) DW202010-001

id: DW202010-001

cve: CVE-2020-27545 @@ -2829,7 +2861,7 @@

88) DW202010-001

tarrelease:

[top]

-

89) DW201907-001

+

90) DW201907-001

id: DW201907-001

cve: CVE-2019-14249 @@ -2854,7 +2886,7 @@

89) DW201907-001

tarrelease: libdwarf-0.4.1.tar.xz

[top]

-

90) DW201801-001

+

91) DW201801-001

id: DW201801-001

cve: @@ -2886,7 +2918,7 @@

90) DW201801-001

tarrelease: libdwarf-20180129.tar.gz

[top]

-

91) DW201712-001

+

92) DW201712-001

id: DW201712-001

cve: @@ -2919,7 +2951,7 @@

91) DW201712-001

tarrelease:

[top]

-

92) DW201711-002

+

93) DW201711-002

id: DW201711-002

cve: @@ -2950,7 +2982,7 @@

92) DW201711-002

tarrelease:

[top]

-

93) DW201711-001

+

94) DW201711-001

id: DW201711-001

cve: @@ -2982,7 +3014,7 @@

93) DW201711-001

tarrelease:

[top]

-

94) DW201709-001

+

95) DW201709-001

id: DW201709-001

cve: @@ -3011,7 +3043,7 @@

94) DW201709-001

tarrelease:

[top]

-

95) DW201706-001

+

96) DW201706-001

id: DW201706-001

cve: CVE-2017-9998 @@ -3048,7 +3080,7 @@

95) DW201706-001

tarrelease:

[top]

-

96) DW201703-007

+

97) DW201703-007

id: DW201703-007

cve: @@ -3099,7 +3131,7 @@

96) DW201703-007

tarrelease: libdwarf-20160507.tar.gz

[top]

-

97) DW201703-006

+

98) DW201703-006

id: DW201703-006

cve: CVE-2017-9052 @@ -3146,7 +3178,7 @@

97) DW201703-006

tarrelease: libdwarf-20160507.tar.gz

[top]

-

98) DW201703-005

+

99) DW201703-005

id: DW201703-005

cve: CVE-2017-9053 @@ -3194,7 +3226,7 @@

98) DW201703-005

tarrelease: libdwarf-20160507.tar.gz

[top]

-

99) DW201703-004

+

100) DW201703-004

id: DW201703-004

cve: @@ -3245,7 +3277,7 @@

99) DW201703-004

tarrelease: libdwarf-20160507.tar.gz

[top]

-

100) DW201703-003

+

101) DW201703-003

id: DW201703-003

cve: @@ -3298,7 +3330,7 @@

100) DW201703-003

tarrelease: libdwarf-20160507.tar.gz

[top]

-

101) DW201703-002

+

102) DW201703-002

id: DW201703-002

cve: CVE-2017-9054 @@ -3349,7 +3381,7 @@

101) DW201703-002

tarrelease: libdwarf-20160507.tar.gz

[top]

-

102) DW201703-001

+

103) DW201703-001

id: DW201703-001

cve: CVE-2017-9055 @@ -3400,7 +3432,7 @@

102) DW201703-001

tarrelease: libdwarf-20160507.tar.gz

[top]

-

103) DW201611-008

+

104) DW201611-008

id: DW201611-008

cve: CVE-2016-10254 @@ -3434,7 +3466,7 @@

103) DW201611-008

tarrelease:

[top]

-

104) DW201611-007

+

105) DW201611-007

id: DW201611-007

cve: CVE-2016-10255 @@ -3469,7 +3501,7 @@

104) DW201611-007

tarrelease:

[top]

-

105) DW201611-006

+

106) DW201611-006

id: DW201611-006

cve: CVE-2016-9480 @@ -3533,7 +3565,7 @@

105) DW201611-006

tarrelease: libdwarf-20160507.tar.gz

[top]

-

106) DW201611-005

+

107) DW201611-005

id: DW201611-005

cve: CVE-2016-9558 @@ -3562,7 +3594,7 @@

106) DW201611-005

tarrelease: libdwarf-20160507.tar.gz

[top]

-

107) DW201611-004

+

108) DW201611-004

id: DW201611-004

cve: CVE-2016-9275 @@ -3592,7 +3624,7 @@

107) DW201611-004

tarrelease:

[top]

-

108) DW201611-003

+

109) DW201611-003

id: DW201611-003

cve: CVE-2016-9276 @@ -3621,7 +3653,7 @@

108) DW201611-003

tarrelease: libdwarf-20170416.tar.gz

[top]

-

109) DW201611-002

+

110) DW201611-002

id: DW201611-002

cve: @@ -3660,7 +3692,7 @@

109) DW201611-002

tarrelease: libdwarf-20170416.tar.gz

[top]

-

110) DW201611-001

+

111) DW201611-001

id: DW201611-001

cve: @@ -3699,7 +3731,7 @@

110) DW201611-001

tarrelease: libdwarf-20170416.tar.gz

[top]

-

111) DW201610-003

+

112) DW201610-003

id: DW201610-003

cve: CVE-2016-8679 @@ -3733,7 +3765,7 @@

111) DW201610-003

tarrelease:

[top]

-

112) DW201610-002

+

113) DW201610-002

id: DW201610-002

cve: CVE-2016-8680 @@ -3766,7 +3798,7 @@

112) DW201610-002

tarrelease:

[top]

-

113) DW201610-001

+

114) DW201610-001

id: DW201610-001

cve: CVE-2016-8681 @@ -3799,7 +3831,7 @@

113) DW201610-001

tarrelease:

[top]

-

114) DW201609-004

+

115) DW201609-004

id: DW201609-004

cve: CVE-2016-7510 @@ -3842,7 +3874,7 @@

114) DW201609-004

tarrelease: libdwarf-20160923.tar.gz

[top]

-

115) DW201609-003

+

116) DW201609-003

id: DW201609-003

cve: CVE-2016-7410 @@ -3904,7 +3936,7 @@

115) DW201609-003

tarrelease: libdwarf-20160923.tar.gz

[top]

-

116) DW201609-002

+

117) DW201609-002

id: DW201609-002

cve: CVE-2016-7511 @@ -3948,7 +3980,7 @@

116) DW201609-002

tarrelease: libdwarf-20160923.tar.gz

[top]

-

117) DW201609-001

+

118) DW201609-001

id: DW201609-001

cve: @@ -4001,7 +4033,7 @@

117) DW201609-001

tarrelease: libdwarf-20160923.tar.gz

[top]

-

118) DW201605-020

+

119) DW201605-020

id: DW201605-020

cve: CVE-2016-5027 @@ -4040,7 +4072,7 @@

118) DW201605-020

tarrelease: libdwarf-20160507.tar.gz

[top]

-

119) DW201605-019

+

120) DW201605-019

id: DW201605-019

cve: CVE-2016-5028 @@ -4070,7 +4102,7 @@

119) DW201605-019

tarrelease: libdwarf-20160923.tar.gz

[top]

-

120) DW201605-018

+

121) DW201605-018

id: DW201605-018

cve: CVE-2016-5029 @@ -4119,7 +4151,7 @@

120) DW201605-018

tarrelease: libdwarf-20160923.tar.gz

[top]

-

121) DW201605-017

+

122) DW201605-017

id: DW201605-017

cve: CVE-2016-5030 @@ -4180,7 +4212,7 @@

121) DW201605-017

tarrelease: libdwarf-20160923.tar.gz

[top]

-

122) DW201605-016

+

123) DW201605-016

id: DW201605-016

cve: @@ -4237,7 +4269,7 @@

122) DW201605-016

tarrelease: libdwarf-20160923.tar.gz

[top]

-

123) DW201605-015

+

124) DW201605-015

id: DW201605-015

cve: CVE-2016-5031 @@ -4286,7 +4318,7 @@

123) DW201605-015

tarrelease: libdwarf-20160923.tar.gz

[top]

-

124) DW201605-014

+

125) DW201605-014

id: DW201605-014

cve: CVE-2016-5032 @@ -4327,7 +4359,7 @@

124) DW201605-014

tarrelease: libdwarf-20160923.tar.gz

[top]

-

125) DW201605-013

+

126) DW201605-013

id: DW201605-013

cve: CVE-2016-5033 @@ -4365,7 +4397,7 @@

125) DW201605-013

tarrelease: libdwarf-20160923.tar.gz

[top]

-

126) DW201605-012

+

127) DW201605-012

id: DW201605-012

cve: CVE-2016-5034 @@ -4398,7 +4430,7 @@

126) DW201605-012

tarrelease: libdwarf-20160923.tar.gz

[top]

-

127) DW201605-011

+

128) DW201605-011

id: DW201605-011

cve: CVE-2016-5035 @@ -4427,7 +4459,7 @@

127) DW201605-011

tarrelease: libdwarf-20160923.tar.gz

[top]

-

128) DW201605-010

+

129) DW201605-010

id: DW201605-010

cve: CVE-2016-5036 @@ -4457,7 +4489,7 @@

128) DW201605-010

tarrelease: libdwarf-20160923.tar.gz

[top]

-

129) DW201605-009

+

130) DW201605-009

id: DW201605-009

cve: CVE-2016-5037 @@ -4488,7 +4520,7 @@

129) DW201605-009

tarrelease: libdwarf-20160507.tar.gz

[top]

-

130) DW201605-008

+

131) DW201605-008

id: DW201605-008

cve: CVE-2016-5038 @@ -4521,7 +4553,7 @@

130) DW201605-008

tarrelease: libdwarf-20160923.tar.gz

[top]

-

131) DW201605-007

+

132) DW201605-007

id: DW201605-007

cve: CVE-2016-5039 @@ -4552,7 +4584,7 @@

131) DW201605-007

tarrelease: libdwarf-20160507.tar.gz

[top]

-

132) DW201605-006

+

133) DW201605-006

id: DW201605-006

cve: @@ -4585,7 +4617,7 @@

132) DW201605-006

tarrelease: libdwarf-20160507.tar.gz

[top]

-

133) DW201605-005

+

134) DW201605-005

id: DW201605-005

cve: CVE-2016-5040 @@ -4618,7 +4650,7 @@

133) DW201605-005

tarrelease: libdwarf-20160507.tar.gz

[top]

-

134) DW201605-004

+

135) DW201605-004

id: DW201605-004

cve: CVE-2016-5041 @@ -4653,7 +4685,7 @@

134) DW201605-004

tarrelease: libdwarf-20160507.tar.gz

[top]

-

135) DW201605-003

+

136) DW201605-003

id: DW201605-003

cve: CVE-2016-5042 @@ -4686,7 +4718,7 @@

135) DW201605-003

tarrelease: libdwarf-20160507.tar.gz

[top]

-

136) DW201605-002

+

137) DW201605-002

id: DW201605-002

cve: CVE-2016-5043 @@ -4731,7 +4763,7 @@

136) DW201605-002

tarrelease: libdwarf-20160507.tar.gz

[top]

-

137) DW201605-001

+

138) DW201605-001

id: DW201605-001

cve: CVE-2016-5044 @@ -4774,7 +4806,7 @@

137) DW201605-001

tarrelease: libdwarf-20160507.tar.gz

[top]

-

138) DW201601-002

+

139) DW201601-002

id: DW201601-002

cve: CVE-2016-2050 @@ -4816,7 +4848,7 @@

138) DW201601-002

tarrelease: libdwarf-20160507.tar.gz

[top]

-

139) DW201601-001

+

140) DW201601-001

id: DW201601-001

cve: CVE-2016-2091 @@ -4860,7 +4892,7 @@

139) DW201601-001

tarrelease: libdwarf-20160507.tar.gz

[top]

-

140) DW201512-002

+

141) DW201512-002

id: DW201512-002

cve: CVE-2015-8538 @@ -4896,7 +4928,7 @@

140) DW201512-002

tarrelease: libdwarf-20160507.tar.gz

[top]

-

141) DW201512-001

+

142) DW201512-001

id: DW201512-001

cve: CVE-2015-8750 @@ -4929,7 +4961,7 @@

141) DW201512-001

tarrelease: libdwarf-20160507.tar.gz

[top]

-

142) DW201412-001

+

143) DW201412-001

id: DW201412-001

cve: CVE-2014-9482 diff --git a/bugxml/dwarfbug.xml b/bugxml/dwarfbug.xml index 01a5ef422..ab106e60e 100644 --- a/bugxml/dwarfbug.xml +++ b/bugxml/dwarfbug.xml @@ -3,6 +3,39 @@ +ossfuzz id: 59091 + +2023-05-19 + +David Korczynski + +libdwarf + + Incorrect section bound check + + + A fuzzed line table in the non-standard + (experimental) two-level line table format + exposed a failure as the test was v > sectionend + whereas it has to be v >= sectionend as end pointers + are always one-past the end of the area. + This was incorrect since the experimental table support + was added in 2021. + + +2023-05-19 + + regressiontest/ossfuzz59091/fuzz_macro_dwarf5-5135813562990592 + + +4017ab8b92195641e6876b388cebe2d3307634f5 + + + + + + + ossfuzz id: 58797 2023-05-10 diff --git a/bugxml/dwarfbuglohi.html b/bugxml/dwarfbuglohi.html index b7069f0f6..647bd3a49 100644 --- a/bugxml/dwarfbuglohi.html +++ b/bugxml/dwarfbuglohi.html @@ -49,7 +49,7 @@

Vulnerabilities

LibDwarf Vulnerabilities Oldest First

as of May 2023

-

Record count: 142

+

Record count: 143

1) DW201412-001

id: DW201412-001

@@ -4961,6 +4961,38 @@

142) DW202305-002

tarrelease:

[top]

+

143) DW202305-003

+

id: DW202305-003 +

+

cve: +

+

fuzzer: ossfuzz id: 59091 +

+

datereported: 2023-05-19 +

+

reportedby: David Korczynski +

+

vulnerability: Incorrect section bound check +

+

product: libdwarf +

+

description: A fuzzed line table in the non-standard + (experimental) two-level line table format + exposed a failure as the test was v > sectionend + whereas it has to be v >= sectionend as end pointers + are always one-past the end of the area. + This was incorrect since the experimental table support + was added in 2021. +

+

datefixed: 2023-05-19 +

+

references: regressiontest/ossfuzz59091/fuzz_macro_dwarf5-5135813562990592 +

+

gitfixid: 4017ab8b92195641e6876b388cebe2d3307634f5 +

+

tarrelease: +

+

[top]

[top]