The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions earlier than MHA-AL00BC00B221 and versions earlier than LON-AL00BC00B221 has a use after free (UAF) vulnerability. An attacker tricks a user into installing a malicious application and the application can start multiple threads and try to create and free specific memory which could triggers access memory after free it and causes a system crash or arbitrary code execution.


The Bastet Driver of Nova 2 Plus Nova 2 Huawei smart phones with software of Versions earlier than BAC-AL00C00B173 Versions earlier than PIC-AL00C00B173 has a use after free (UAF) vulnerability. An attacker can convince a user to install a malicious application which has a high privilege to exploit this vulnerability Successful exploitation may cause arbitrary code execution.


The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions Vicky-AL00CC768B122 Vicky-TL00AC01B167 Earlier than Victoria-AL00AC00B172 versions Victoria-TL00AC00B123 Victoria-TL00AC01B167 has a use after free (UAF) vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability Successful exploitation may cause arbitrary code execution.


In Tor before 0.2.5.16 0.2.6 through 0.2.8 before 0.2.8.17 0.2.9 before 0.2.9.14 0.3.0 before 0.3.0.13 and 0.3.1 before 0.3.1.9 there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases aka TROVE-2017-013.


In all Qualcomm products with Android releases from CAF using the Linux kernel in the function msm_dba_register_client if the client registers failed it would be freed. However the client was not removed from list. Use-after-free would occur when traversing the list next time.


Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.


Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0 Firefox ESR 38.x before 38.2 and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by leveraging a StyleAnimationValue::operator self assignment.


Multiple use-after-free vulnerabilities in OpenType Sanitiser as used in Mozilla Firefox before 36.0 might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion related to the ots::ots_gasp_parse function.


Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application aka \Microsoft Windows Kernel Brush Object Use After Free Vulnerability.\


Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application aka \Microsoft Windows Kernel Bitmap Handling Use After Free Vulnerability.\


Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) \two additional unconfirmed use-after-free complaints made by Coverity scan.\ NOTE: some of these details are obtained from third party information.


Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application aka \Microsoft Windows Station Use After Free Vulnerability.\


Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application aka \Microsoft Windows Kernel Object Use After Free Vulnerability.\


Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application aka \Microsoft Windows Kernel Use After Free Vulnerability.\


Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a \deeply nested element with infinite size\ followed by another element of an upper level in an EBML document.


Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X Nexus 6P and Android One devices allow attackers to gain privileges via a crafted application aka Android internal bug 30142668 and Qualcomm internal bug CR 948902.


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers keyboard layout errors aka \Keyboard Layout Use After Free Vulnerability.\


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application aka \Win32k Use After Free Vulnerability.\


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application aka \Win32k Use After Free Vulnerability.\


FFmpeg

before

commit

contains

a

use-after-free

vulnerability

in

the

realmedia

demuxer

that

can

result

in

vulnerability

allows

attacker

to

read

heap

memory.

This

attack

appear

to

be

exploitable

via

specially

crafted

RM

file

has

to

be

provided

as

input.

This

vulnerability

appears

to

have

been

fixed

in

and

later.


An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.


An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off aka CID-a0ff660058b8.


An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.


An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.


Adobe Acrobat and Reader versions 2019.008.20081 and earlier 2019.008.20080 and earlier 2019.008.20081 and earlier 2017.011.30106 and earlier version 2017.011.30105 and earlier version 2015.006.30457 and earlier and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.


An

issue

was

discovered

in

the

Linux

kernel

before

A

use-after-free

can

be

caused

by

the

function

in

the

file


An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.


An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists related to xfs_fs_fill_super failure.


An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.


A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed although the sound is still being played asynchronously leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5.


A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4 Firefox ESR < 60.4 and Firefox < 64.


A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5 Firefox ESR < 60.5 and Firefox < 65.


A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Creator property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Subject property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused. An attacker needs to trick the user to open the malicious file to trigger.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Author property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability.


A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Producer property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the CreationDate property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Keywords property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If a browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 450 SD 615/16/SD 415 SD 625 SD 650/52 SD 820 SD 835 SD 845 a Use After Free condition can occur in RIL while handling requests from Android.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60 Thunderbird < 52.9 Firefox ESR < 60.1 Firefox ESR < 52.9 and Firefox < 61.


A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62 Firefox ESR < 60.2 and Thunderbird < 60.2.1.


Adobe Acrobat and Reader 2018.011.20040 and earlier 2017.011.30080 and earlier and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60 Thunderbird < 52.9 Firefox ESR < 60.1 Firefox ESR < 52.9 and Firefox < 61.


A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62 Firefox ESR < 60.2 and Thunderbird < 60.2.1.


exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.


Use-after-free

vulnerability

will

occur

as

there

is

no

protection

for

the

route

table`s

rule

in

IPA

driver

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Error

in

parsing

PMT

table

frees

the

memory

allocated

for

the

map

section

but

does

not

reset

the

context

map

section

reference

causing

heap

use

after

free

issue

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Use-after-free condition due to Improper handling of hrtimers when the PMU driver tries to access its events in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables in MDM9206 MDM9607 MDM9650 MSM8909W QCS605 Qualcomm 215 SD 425 SD 439 / SD 429 SD 450 SD 625 SD 632 SD 636 SD 712 / SD 710 / SD 670 SD 820A SD 845 / SD 850 SD 855 SDM439 SDM630 SDM660 SDX24


Use-after-free vulnerability will occur if reset of the routing table encounters an invalid rule id while processing command to reset in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables in MDM9150 MDM9206 MDM9607 MDM9650 MSM8909W QCS405 QCS605 SD 625 SD 636 SD 675 SD 712 / SD 710 / SD 670 SD 730 SD 820 SD 820A SD 835 SD 845 / SD 850 SD 855 SDM630 SDM660 SDX20 SDX24


KGSL syncsource lock not handled properly during syncsource cleanup can lead to use after free issue in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables in MDM9206 MDM9607 MDM9650 MSM8909W QCS605 SD 210/SD 212/SD 205 SD 439 / SD 429 SD 712 / SD 710 / SD 670 SD 820A SD 845 / SD 850 SD 855 SDM439 SDM660 SDX24.


A remote unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D67; 12.3 versions prior to 12.3R12-S5; 12.3X48 versions prior to 12.3X48-D35; 14.1 versions prior to 14.1R8-S5 14.1R9; 14.1X53 versions prior to 14.1X53-D44 14.1X53-D50; 14.2 versions prior to 14.2R7-S7 14.2R8; 15.1 versions prior to 15.1R3; 15.1X49 versions prior to 15.1X49-D30; 15.1X53 versions prior to 15.1X53-D70.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while calling IPA_IOC_MDFY_RT_RULE IPA IOCTL header entry is not checked before use. If IPA_IOC_MDFY_RT_RULE IOCTL called for header entries formerly deleted a Use after free condition will occur.


When

a

series

of

FDAL

messages

are

sent

to

the

modem

a

Use

After

Free

condition

can

occur

in

Snapdragon

Automobile

Snapdragon

Mobile

Snapdragon

Wear

in

version

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


In

ADSP

RPC

in

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

a

Use

After

Free

condition

can

occur

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature or via SAX using the XERCES_DISABLE_DTD environment variable.


Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network otherwise just local.. This vulnerability appears to have been fixed in 1.7.4.


An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A use-after-free can occur in _pbcM_sp_query in map.c.


An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in try_merge_free_space() when mounting a crafted btrfs image because of a lack of chunk type flag checks in btrfs_check_chunk_valid in fs/btrfs/volumes.c.


A

Use

After

Free

condition

can

occur

in

the

IPA

driver

whenever

the

IPA

IOCTLs

IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD/IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_DEL/IPA_IOC_NOTIFY_WAN_EMBMS_CONNECTED

are

called

in

all

Android

releases

from

CAF

(Android

for

MSM

Firefox

OS

for

MSM

QRD

Android)

using

the

Linux

Kernel.


A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed resulting in a potentially exploitable crash when these references are used. This vulnerability affects Thunderbird < 52.6 Firefox ESR < 52.6 and Firefox < 58.


A use-after-free vulnerability can occur when form input elements focus and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6 Firefox ESR < 52.6 and Firefox < 58.


A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. This vulnerability affects Firefox < 60.


While processing modem SSR after IMS is registered the IMS data daemon is restarted but the ipc_dataHandle is no longer available. Consequently the DPL thread frees the internal memory for dataDHandle but the local variable pointer is not updated which can lead to a Use After Free condition in Snapdragon Mobile and Snapdragon Wear.


Adobe Acrobat and Reader 2018.011.20040 and earlier 2017.011.30080 and earlier and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


In Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05 whenever TDLS connection is setup we are freeing the netbuf in ol_tx_completion_handler and after that we are accessing it in NBUF_UPDATE_TX_PKT_COUNT causing a use after free.


A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.7.3 and Firefox < 59.0.2.


A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8 Thunderbird ESR < 52.8 Firefox < 60 and Firefox ESR < 52.8.


A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6 Firefox ESR < 52.6 and Firefox < 58.


A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8 Thunderbird ESR < 52.8 Firefox < 60 and Firefox ESR < 52.8.


Adobe Acrobat and Reader versions 2018.011.20038 and earlier 2017.011.30079 and earlier and 2015.006.30417 and earlier have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12 tvOS 12 Safari 12 iTunes 12.9 for Windows iCloud for Windows 7.7.


A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.


An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions 2017.011.30070 and earlier versions 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability. The vulnerability is triggered by a crafted PDF file that can cause a memory access violation exception in the XFA engine because of a dangling reference left as a consequence of freeing an object in the computation that manipulates internal nodes in a graph representation of a document object model used in XFA. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions 2017.011.30070 and earlier versions 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the JavaScript API related to bookmark functionality. The vulnerability is triggered by crafted JavaScript code embedded within a PDF file. A successful attack can lead to code corruption control-flow hijack or a code re-use attack.


An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions 2017.011.30070 and earlier versions 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the JBIG2 decoder. The vulnerability is triggered by a crafted PDF file that contains a malformed JBIG2 stream. Successful exploitation could lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5 iTunes 12.9 for Windows iCloud for Windows 7.7.


An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions 2017.011.30070 and earlier versions 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the XFA engine related to DOM manipulation. The vulnerability is triggered by crafted XFA script definitions in a PDF file. Successful exploitation could lead to arbitrary code execution.


A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player's quality of service functionality. A successful attack can lead to arbitrary code execution.


An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions 2017.011.30070 and earlier versions 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the rendering engine. The vulnerability is triggered by a crafted PDF file containing a video annotation (and corresponding media files) that is activated by the embedded JavaScript. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2019.008.20081 and earlier 2019.008.20080 and earlier 2019.008.20081 and earlier 2017.011.30106 and earlier version 2017.011.30105 and earlier version 2015.006.30457 and earlier and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


A UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation map unmap invalidation and dereference operations.


In FreeBSD before 11.1-STABLE 11.1-RELEASE-p7 10.4-STABLE 10.4-RELEASE-p7 and 10.3-RELEASE-p28 the kernel does not properly validate IPsec packets coming from a trusted host. Additionally a use-after-free vulnerability exists in the IPsec AH handling code. This issue could cause a system crash or other unpredictable results.


A use-after-free issue was discovered in libwebm through 2018-02-02. If a Vp9HeaderParser was initialized once before its property frame_ would not be changed because of code in vp9parser::Vp9HeaderParser::SetFrame. Its frame_ could be freed while the corresponding pointer would not be updated leading to a dangling pointer. This is related to the function OutputCluster in webm_info.cc.


A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits. NOTE: this issue exists because of an incomplete fix for CVE-2017-7191.


HUAWEI Mate 10 smartphones with versions earlier than ALP-AL00 8.1.0.311 have a use after free vulnerability on mediaserver component. An attacker tricks the user install a malicious application which make the software to reference memory after it has been freed. Successful exploit could cause execution of arbitrary code.


An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when SASL messages are received in an unexpected order.


A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3 a different vulnerability than CVE-2018-16291 CVE-2018-16293 CVE-2018-16294 CVE-2018-16295 CVE-2018-16296 and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


Adobe Acrobat and Reader versions 2019.010.20064 and earlier 2019.010.20064 and earlier 2017.011.30110 and earlier version and 2015.006.30461 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2019.008.20081 and earlier 2019.008.20080 and earlier 2019.008.20081 and earlier 2017.011.30106 and earlier version 2017.011.30105 and earlier version 2015.006.30457 and earlier and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3 a different vulnerability than CVE-2018-16291 CVE-2018-16292 CVE-2018-16293 CVE-2018-16294 CVE-2018-16295 and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3 a different vulnerability than CVE-2018-16291 CVE-2018-16292 CVE-2018-16294 CVE-2018-16295 CVE-2018-16296 and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3 a different vulnerability than CVE-2018-16291 CVE-2018-16292 CVE-2018-16293 CVE-2018-16294 CVE-2018-16295 and CVE-2018-16296. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3 a different vulnerability than CVE-2018-16292 CVE-2018-16293 CVE-2018-16294 CVE-2018-16295 CVE-2018-16296 and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3 a different vulnerability than CVE-2018-16291 CVE-2018-16292 CVE-2018-16293 CVE-2018-16294 CVE-2018-16296 and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


Adobe Acrobat and Reader versions 2019.008.20081 and earlier 2019.008.20080 and earlier 2019.008.20081 and earlier 2017.011.30106 and earlier version 2017.011.30105 and earlier version 2015.006.30457 and earlier and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3 a different vulnerability than CVE-2018-16291 CVE-2018-16292 CVE-2018-16293 CVE-2018-16295 CVE-2018-16296 and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.


An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.


An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.


An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked allowing attackers to obtain sensitive information cause a use-after-free or cause a data race.


An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.


An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.


An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.


An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.


An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free.


An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.


A use-after-free flaw was found in D-Bus Development branch <= 1.13.16 dbus-1.12.x stable branch <= 1.12.18 and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames D-Bus may free some memory in the heap which is still used by data structures necessary for the other usernames sharing the UID possibly leading to a crash or other undefined behaviors


An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding aka CID-6d816e088c35.


An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called aka CID-f5449e74802c.


An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field a use-after-free or double-free can occur.


In OSSEC-HIDS 2.7 through 3.5.0 the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of ossec-alert formatted msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).


In OSSEC-HIDS 2.7 through 3.5.0 the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of syscheck formatted msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).


HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after free vulnerability. There is a condition exists that the system would reference memory after it has been freed the attacker should trick the user into running a crafted application with common privilege successful exploit could cause code execution.


HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a use after free vulnerability. There is a condition exists that the system would reference memory after it has been freed the attacker should trick the user into running a crafted application with high privilege successful exploit could cause code execution.


There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with specific message properly which makes a function refer to memory after it has been freed. Attackers can exploit this vulnerability by running a crafted application with common privilege. This would compromise normal service.


Huawei smart phone Taurus-AL00B with versions earlier than 10.0.0.203(C00E201R7P2) have a use-after-free (UAF) vulnerability. An authenticated local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may tamper with the information to affect the availability.


Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier Adobe Flash Player for Google Chrome 32.0.0.371 and earlier and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a use-after-free (UAF) vulnerability. An authenticated local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and compromise the service.


A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.


GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself not that a crash may occur in code that is generated by Bison.


Acrobat Reader DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


In Xpdf 4.02 SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache` which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.


An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.


A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect there is still an alias in sunkbd_reinit causing Use After Free.


A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.


A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.


A use after free issue has been identified in the way ISPSoft(v3.12 and prior) processes project files allowing an attacker to craft a special project file that may allow arbitrary code execution.


Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check the index provided when accessing the local variable in the LGETV and LPUTV instructions. This provides the ability to both read and write memory outside the bounds of the TVM context allocation. It can be leveraged to construct a use-after-free scenario leading to a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.


If the Compact() method was called on an nsTArray the array could have been reallocated without updating other pointers leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83 Firefox ESR < 78.5 and Thunderbird < 78.5.


An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is an Opt object use-after-free related to Field::ClearItems and Field::DeleteOptions during AcroForm JavaScript execution.


The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL resulting in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 84.


When removing data about an origin whose tab was recently closed a use-after-free could occur in the Quota manager resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6 Firefox < 74 Firefox < ESR68.6 and Firefox ESR < 68.6.


When a device was changed while a stream was about to be destroyed the stream-reinit task may have been executed after the stream was destroyed causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6 Firefox < 74 Firefox < ESR68.6 and Firefox ESR < 68.6.


A Use After Free vulnerability exists in Artifex Software Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page was followed by a page with invalid pixmap dimensions causing bander - a static - to point to previously freed memory instead of a newband_writer.


Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56 5.3.0-68.63 4.15.0-121.123 4.4.0-193.224 3.13.0.182.191 and 3.2.0-149.196.


In FreeBSD 12.2-STABLE before r367402 11.4-STABLE before r368202 12.2-RELEASE before p1 12.1-RELEASE before p11 and 11.4-RELEASE before p5 the handler for a routing option caches a pointer into the packet buffer holding the ICMPv6 message. However when processing subsequent options the packet buffer may be freed rendering the cached pointer invalid. The network stack may later dereference the pointer potentially triggering a use-after-free.


In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13 improper mbuf handling in the kernel causes a use-after-free bug by sending IPv6 Hop-by-Hop options over the loopback interface. The use-after-free situation may result in unintended kernel behaviour including a kernel panic.


In FreeBSD 12.1-STABLE before r364644 11.4-STABLE before r364651 12.1-RELEASE before p9 11.4-RELEASE before p3 and 11.3-RELEASE before p13 improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The use-after-free situation may result in unintended kernel behaviour including a kernel panic.


In

the

Linux

kernel

longterm

through

and

longterm

through

(and

before

there

is

a

use-after-free

(write)

in

the

function

in

aka

This

is

related

to

in


A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.


VMware ESXi (7.0 before ESXi70U1b-17168206 6.7 before ESXi670-202011101-SG 6.5 before ESXi650-202011301-SG) Workstation (15.x before 15.5.7) Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.


jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.


When aborting an operation such as a fetch an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12.


An

issue

was

discovered

in

OpenEXR

before

Invalid

input

could

cause

a

use-after-free

in

DeepScanLineInputFile::DeepScanLineInputFile()

in

IlmImf/ImfDeepScanLineInputFile.cpp.


When

recursing

through

graphical

layers

while

scrolling

an

iterator

may

have

become

invalid

resulting

in

a

potential

use-after-free.

This

occurs

because

the

function

APZCTreeManager::ComputeClippedCompositionBounds

did

not

follow

iterator

invalidation

rules.

This

vulnerability

affects

Firefox

Thunderbird

and

Firefox

ESR


u'Calling thread may free the data buffer pointer that was passed to the callback and later when event loop executes the callback data buffer may not be valid and will lead to use after free scenario' in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in APQ8096AU APQ8098 Bitra Kamorta MSM8917 MSM8953 MSM8998 QCM2150 QCS405 QCS605 QM215 Rennell Saipan SDM429 SDM439 SDM450 SDM632 SM6150 SM7150 SM8150 SM8250 SXR2130


u'Possible use-after-free while accessing diag client map table since list can be reallocated due to exceeding max client limit.' in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in MDM9607 Nicobar QCS404 QCS405 QCS610 Rennell SA6155P SA8155P Saipan SC8180X SDM660 SDX55 SM6150 SM7150 SM8150 SM8250 SXR2130


Use after free condition in msm ioctl events due to race between the ioctl register and deregister events in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables


Use after free in GPU driver while mapping the user memory to GPU memory due to improper check of referenced memory in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


When sending a socket event message to a user application invalid information will be passed if socket is freed by other thread resulting in a Use After Free condition in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


u'Use

after

free

issue

in

Bluetooth

transport

driver

when

a

method

in

the

object

is

accessed

after

the

object

has

been

deleted

due

to

improper

timer

handling.'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in


Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback instance is deleted in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables


An issue was discovered in libgpac.a in GPAC 0.8.0 as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read gf_isom_delete_movie and gf_isom_parse_movie_boxes.


Use after free issue when importing a DMA buffer by using the CPU address of the buffer due to attachment is not cleaned up properly in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Before enqueuing a frame to the PE queue for further processing an entry in a hash table can be deleted and using a stale version later can lead to use after free condition in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


A race between command submission and destroying the context can cause an invalid context being added to the list leads to use after free issue. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


A use-after-free vulnerability exists in the _3MF_Importer::_handle_end_model() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


A heap use-after-free vulnerability was found in systemd before version v245-rc1 where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges by sending specially crafted dbus messages.


E6878-370 with versions of 10.0.3.1(H557SP27C233) 10.0.3.1(H563SP1C00) 10.0.3.1(H563SP1C233) has a use after free vulnerability. The software references memory after it has been freed in certain scenario the attacker does a series of crafted operations through web portal successful exploit could cause a use after free condition which may lead to malicious code execution.


A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that when processed by the glob function would potentially lead to arbitrary code execution. This was fixed in version 2.32.


An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. PROCA allows a use-after-free and arbitrary code execution. The Samsung ID is SVE-2019-16132 (February 2020).


Adobe Acrobat and Reader versions 2020.006.20034 and earlier 2017.011.30158 and earlier 2017.011.30158 and earlier 2015.006.30510 and earlier and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .


Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in APQ8009 Nicobar QCM2150 QCS405 Saipan SDM845 SM8150 SM8250 SXR2130


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15.4 Security Update 2020-002 Mojave Security Update 2020-002 High Sierra macOS Catalina 10.15.3 Security Update 2020-001 Mojave Security Update 2020-001 High Sierra. An application may be able to gain elevated privileges.


VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG) Workstation (15.x before 15.5.5) and Fusion (11.x before 11.5.5) contain a use-after-free vulnerability in the SVGA device. A malicious actor with local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine.


Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snapdragon Consumer IOT Snapdragon Mobile in Kamorta QCS605 Rennell Saipan SDM670 SDM710 SDM845 SM6150 SM7150 SM8150 SM8250 SXR1130 SXR2130


VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG) Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after-free vulnerability in PVNVRAM. A malicious actor with local access to a virtual machine may be able to read privileged information contained in physical memory.


u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checking security permission for particular process' in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking in APQ8009 APQ8017 APQ8053 APQ8096AU APQ8098 IPQ4019 IPQ6018 IPQ8064 IPQ8074 MDM9206 MDM9207C MDM9607 MSM8905 MSM8909W MSM8996AU QCA4531 QCA6574AU QCA9531 QCM2150 QCS605 SDM429W SDX20 SDX24


An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body.


An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.


An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has a use-after-free because of JavaScript execution after a deletion or close operation.


An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary.


A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2 Firefox ESR < 45.5.1 and Thunderbird < 45.5.1.


In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7 the DCERPC dissector could crash with a use-after-free triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.


Adobe Flash Player versions 23.0.0.207 and earlier 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class related to objects at multiple presentation levels. Successful exploitation could lead to arbitrary code execution.


Adobe Flash Player versions 23.0.0.207 and earlier 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution.


Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.


An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.


A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac Windows and Linux and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac Windows and Linux and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac Windows and Linux and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.


A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac Windows and Linux and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain privileges by leveraging access to the local physical environment during execution of a crafted application aka internal bug 25753768.


Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267 Adobe Flash Player Extended Support Release before 18.0.0.324 Adobe Flash Player for Google Chrome before 20.0.0.267 Adobe Flash Player for Microsoft Edge and Internet Explorer 11 before 20.0.0.267 Adobe Flash Player for Internet Explorer 10 and 11 before 20.0.0.267 Adobe Flash Player for Linux before 11.2.202.559 AIR Desktop Runtime before 20.0.0.233 AIR SDK before 20.0.0.233 AIR SDK & Compiler before 20.0.0.233 AIR for Android before 20.0.0.233.


Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 27890802.


Use-after-free vulnerability in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 27903498.


Mozilla Firefox before 3.6.20 Thunderbird 2.x and 3.x before 3.1.12 SeaMonkey 1.x and 2.x and possibly other products does not properly handle the RegExp.input property which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site possibly related to a use-after-free.


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management aka \Win32k Use After Free Vulnerability.\


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management a different vulnerability than other CVEs listed in MS11-054 aka \Win32k Use After Free Vulnerability.\


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management a different vulnerability than other \Vulnerability Type 1\ CVEs listed in MS11-034 aka \Win32k Use After Free Vulnerability.\


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management aka \Win32k Use After Free Vulnerability.\


Use after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.


Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.


Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.


Use after free vulnerability in the String.replace method JavaScriptCore in Apple Safari in iOS before 10.3 allows remote attackers to execute arbitrary code via a crafted web page or a crafted file.


Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.


Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.


Use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CTreeNode Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CElement Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CPasteCommand Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CDispNode Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer InsertElement Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer LsGetTrailInfo Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer removeChild Use After Free Vulnerability.\


Use-after-free vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer saveHistory Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CCaret Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer pasteHTML Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CMarkup Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CObjectElement Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer GetMarkupPtr Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer SetCapture Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CHTML Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer onBeforeCopy Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer OnResize Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer SLayoutRun Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer vtable Use After Free Vulnerability.\


Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response traffic after a URL request.


Use-after-free vulnerability in SumatraPDF Reader 2.x before 2.2.1 allows remote attackers to execute arbitrary code via a crafted PDF file.


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted CMarkup object aka \Internet Explorer Use After Free Vulnerability.\


Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 allows user-assisted remote attackers to execute arbitrary code via a crafted header in a torrent file which leaves a dangling pointer to an invalid object.


Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8454 and CVE-2014-8455.


Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8454 and CVE-2014-9165.


Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox before 35.0 Firefox ESR 31.x before 31.4 and SeaMonkey before 2.32 allows remote attackers to execute arbitrary code via crafted track data.


Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.


Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-8455 and CVE-2014-9165.


Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.


Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in WebKit as used in Apple OS X before 10.10.1 allows remote attackers to execute arbitrary code via crafted page objects in an HTML document.


Use-after-free vulnerability in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13 and SeaMonkey before 2.0.11 allows remote attackers to execute arbitrary code via vectors involving a change to an nsDOMAttribute node.


Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data related to the PHP unserialize function.


Use-after-free vulnerability in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document aka \OEPlaceholderAtom Use After Free Vulnerability.\


Use-after-free vulnerability in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via vectors involving multiple plugin instances.


Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR systems allows remote attackers to execute arbitrary code by calling the GetAudioPlayingTime method with certain arguments.


Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.


Use-after-free vulnerability in the DNS server in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests aka \Windows DNS Use After Free Vulnerability.\


Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.


Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.


Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.


Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.


Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.


Use-after-free vulnerability in CoreAnimation in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code by leveraging improper use of a mutex.


Use-after-free vulnerability in Microsoft Word 2007 SP3 Word Viewer and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Component Use After Free Vulnerability.\


Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.


Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.


Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via an invalid IP address and a page reload.


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site aka \CFormElement Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site aka \CTreePos Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Layout Use After Free Vulnerability.\


Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a crafted TIFF (aka .TIF) file.


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Event Listener Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \cloneNode Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \CMarkup Use After Free Vulnerability.\


Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to \palette reduction.\


Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site as exploited in the wild in September 2012.


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site aka \CTreeNode Use After Free Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \InjectHTMLStream Use After Free Vulnerability.\


Use-after-free vulnerability in the SVG implementation in WebKit as used in Google Chrome before 22.0.1229.94 allows remote attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.


Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors as exploited in the wild in October 2016.


Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.


Use-after-free vulnerability in Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4263.


Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via an object with a revision number of -1 in a PDF document.


Use-after-free vulnerability in Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file related to stylesheet and superscript tokens.


Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted FlateDecode stream in a PDF document.


Use-after-free vulnerability in the XFA forms handling functionality in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted remerge call.


Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection.


Use-after-free vulnerability in the kernel in Apple iOS before 9.3 OS X before 10.11.4 tvOS before 9.2 and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.


Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.


Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code via vectors related to the BeginReading method.


Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests aka \Windows DNS Server Use After Free Vulnerability.\


Use-after-free vulnerability in the Trend Micro HouseCall ActiveX control 6.51.0.1028 and 6.6.0.1278 in Housecall_ActiveX.dll allows remote attackers to execute arbitrary code via a crafted notifyOnLoadNative callback function.


Use-after-free vulnerability in Adobe Reader and Acrobat 8.x before 8.3.1 9.x before 9.4.6 and 10.x before 10.1.1 allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1 Thunderbird before 3.1.11 and SeaMonkey through 2.0.14 when JavaScript is disabled allows remote attackers to execute arbitrary code via a crafted XUL document.


Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute arbitrary code via vectors related to the browser cache.


Use-after-free vulnerability in Equis MetaStock 11 and earlier allows remote attackers to execute arbitrary code via a malformed (1) mwc chart (2) mws chart (3) mwt template or (4) mwl layout.


Use-after-free vulnerability in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors.


Use-after-free vulnerability in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a long syslog packet related to an exception handler.


Use-after-free vulnerability in Microsoft Excel 2003 SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Use after Free WriteAV Vulnerability.\


Use-after-free vulnerability in Microsoft Office 2007 SP2 and SP3 Office 2010 Gold and SP1 and Office for Mac 2011 allows remote attackers to execute arbitrary code via a crafted Word document aka \Word Use After Free Vulnerability.\


Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17 and SeaMonkey before 2.0.14 allows remote attackers to execute arbitrary code via vectors related to OBJECT's mChannel.


Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17 and SeaMonkey before 2.0.14 allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.


Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3. An application may be able to execute arbitrary code with kernel privileges.


Use-after-free vulnerability in the addOSPLext method in the Honeywell ScanServer ActiveX control 780.0.20.5 allows remote attackers to execute arbitrary code via a crafted HTML document.

use after free
arbitrary code execution
dos


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. An attacker with JavaScript execution may be able to execute arbitrary code.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.0.1 iOS 15.1 and iPadOS 15.1 watchOS 8.1 tvOS 15.1. An application may be able to execute arbitrary code with kernel privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An application may be able to execute arbitrary code with kernel privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. An application may be able to execute arbitrary code with kernel privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 watchOS 6.2. An application may be able to execute arbitrary code with system privileges.


Use after free in some Intel(R) Graphics Driver before version 27.20.100.8336 15.45.33.5164 and 15.40.47.5166 may allow an authenticated user to potentially enable denial of service via local access.


Use after free in some Intel(R) Graphics Drivers before version 15.33.51.5146 may allow an authenticated user to potentially enable denial of service via local access.


Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls.


Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the string values of id attributes.


Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the x-webkit-speech attribute in a text INPUT element.


Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by \hot-unplugging\ a virtio device.


Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.


Use-after-free vulnerability in the vhost_net_set_backend function in drivers/vhost/net.c in the Linux kernel through 3.10.3 allows local users to cause a denial of service (OOPS and system crash) via vectors involving powering on a virtual machine.


Use-after-free vulnerability in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of browser navigation.


Use-after-free vulnerability in the frame-loader implementation in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Use-after-free vulnerability in the Web Audio implementation in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of fonts in CANVAS elements.


Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to databases.


Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a URL.


Use-after-free vulnerability in the extension bookmarks API in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to printing.


Use-after-free vulnerability in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving an SVG animation.


Use-after-free vulnerability in Google Chrome before 26.0.1410.43 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the presence of an extension that creates a pop-up window.


Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style resolution.


Use-after-free vulnerability in the HTML5 Audio implementation in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input.


Use-after-free vulnerability in the media loader in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2013-2846.


Use-after-free vulnerability in the SVG implementation in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Use-after-free vulnerability in the SVG implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Use-after-free vulnerability in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving access to a database API by a worker process.


Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of Pepper resources.


Use-after-free vulnerability in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of images.


Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to deleting the registration of a MutationObserver object.


Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of speech data.


Use-after-free vulnerability in the media loader in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2013-2840.


Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.


Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of widgets.


Use-after-free vulnerability in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input.


Use-after-free vulnerability in ext2fs.c in Brian Carrier The Sleuth Kit (TSK) before 2.09 allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain ext2fs files via a malformed ext2fs image.


Use-after-free vulnerability in dwarfdump in libdwarf 20130126 through 20140805 might allow remote attackers to cause a denial of service (program crash) via a crafted ELF file.


Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.


Use-after-free

vulnerability

in

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

related

to

forms.


Use-after-free vulnerability in PDFium as used in Google Chrome before 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.