A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XE Software could allow an unauthenticated remote attacker to cause the Border Gateway Protocol (BGP) process to crash resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of a specific RPKI to Router (RTR) Protocol packet header. An attacker could exploit this vulnerability by compromising the RPKI validator server and sending a specifically crafted RTR packet to an affected device. Alternatively the attacker could use man-in-the-middle techniques to impersonate the RPKI validator server and send a crafted RTR response packet over the established RTR TCP connection to the affected device. A successful exploit could allow the attacker to cause a DoS condition because the BGP process could constantly restart and BGP routing could become unstable.


A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to exhaust the 1550-byte buffers on an affected device resulting in a denial of service (DoS) condition. The vulnerability is due to a missing boundary check in an internal function. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between an affected device and its configured TCP syslog server and then maliciously modifying the TCP header in segments that are sent from the syslog server to the affected device. A successful exploit could allow the attacker to exhaust buffer on the affected device and cause all TCP-based features to stop functioning resulting in a DoS condition. The affected TCP-based features include AnyConnect SSL VPN clientless SSL VPN and management connections such as Secure Shell (SSH) Telnet and HTTPS.


Insufficient access control in the firmware of the Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.


The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c which allows attackers to cause a denial of service even code execution and escalation of privileges.


The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c which allows attackers to cause a denial of service even code execution and escalation of privileges.


The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c which allows attackers to cause a denial of service even code execution and escalation of privileges.


Improper buffer restrictions in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.


Improper buffer restrictions in BIOS firmware for 7th 8th 9th and 10th Generation Intel(R) Core(TM) Processor families may allow an authenticated user to potentially enable escalation of privilege and/or denial of service via local access.


Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow might lead to denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSubmitCommandVirtual in which the application dereferences a pointer that it expects to be valid but is NULL which may lead to denial of service or escalation of privileges.


NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. When an attacker has access to the system and creates a hard link the software does not check for hard link attacks. This behavior may lead to code execution denial of service or escalation of privileges.


In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2 Tegra bootloader contains a vulnerability in nvtboot in which the nvtboot-cpu image is loaded without the load address first being validated which may lead to code execution denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape in which the software uses a sequential operation to read from or write to a buffer but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer which may lead to denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver all versions contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the size of an input buffer is not validated which may lead to denial of service or escalation of privileges.


NVIDIA Windows GPU Display driver contains a vulnerability in the 3D vision component in which the stereo service software when opening a file does not check for hard links. This behavior may lead to code execution denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver all versions contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the product uses untrusted input when calculating or using an array index which may lead to escalation of privileges or denial of service.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSetRootPageTable in which the application dereferences a pointer that it expects to be valid but is NULL which may lead to code execution denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) create context command DDI DxgkDdiCreateContext in which the product uses untrusted input when calculating or using an array index but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array which may lead to denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the user mode video driver trace logger component. When an attacker has access to the system and creates a hard link the software does not check for hard link attacks. This behavior may lead to code execution denial of service or escalation of privileges.


NVIDIA SHIELD TV all versions prior to 8.2.2 contains a vulnerability in the implementation of the RPMB command status in which an attacker can write to the Write Protect Configuration Block which may lead to denial of service or escalation of privileges.


NVIDIA SHIELD TV all versions prior to 8.2.2 contains a vulnerability in the NVDEC component in which an attacker can read from or write to a memory location that is outside the intended boundary of the buffer which may lead to denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver for Windows all versions contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the program dereferences a pointer that contains a location for memory that is no longer valid which may lead to code execution denial of service or escalation of privileges. Attacker does not have any control over the information and may conduct limited data modification.


RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges Denial of Service and Code Execution) via a crafted Device IO Control packet to a device.


NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access to the board direct read/write access to the entire system address space through the PCI bus. Such an attack could result in denial of service code execution escalation of privileges and impact to data integrity and confidentiality. The scope impact may extend to other components.


NVIDIA DCGM contains a vulnerability in nvhostengine where a network user can cause detection of error conditions without action which may lead to limited code execution some denial of service escalation of privileges and limited impacts to both data confidentiality and integrity.


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where incorrect calculation may cause an invalid address access leading to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an attempt to access an invalid object pointer may lead to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated leading to denial of service or potential escalation of privileges.


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated leading to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) where untrusted input is used to reference memory outside of the intended boundary of the buffer leading to denial of service or escalation of privileges.


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to denial of service or potential escalation of privileges.


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is not correctly validated before it is dereferenced for a write operation may lead to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where user provided input is used as the limit for a loop may lead to denial of service or potential escalation of privileges


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input can trigger an access to a pointer that has not been initialized which may lead to denial of service or potential escalation of privileges.


In GeForce Experience (GFE) 3.x before 3.10.0.55 NVIDIA Installer Framework contains a vulnerability in NVISystemService64 where a value passed from a user to the driver is used without validation which may lead to denial of service or possible escalation of privileges.


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input used as an array size is not correctly validated allows out of bound access in kernel memory and may lead to denial of service or potential escalation of privileges


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a value passed from a user to the driver is not correctly validated and used as the index to an array leading to denial of service or potential escalation of privileges.


All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used in an offset calculation may lead to denial of service or potential escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to denial of service or possible escalation of privileges.


NVIDIA Tegra kernel contains a vulnerability in the CORE DVFS Thermal driver where there is the potential to read or write a buffer using an index or pointer that references a memory location after the end of the buffer which may lead to a denial of service or possible escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from an user to the driver is used without validation which may lead to denial of service or potential escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is used without validation which may lead to denial of service or possible escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to denial of service or potential escalation of privileges.


NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of privileges. This issue is rated as moderate.


NVIDIA ADSP Firmware contains a vulnerability in the ADSP Loader component where there is the potential to write to a memory location that is outside the intended boundary of the buffer which may lead to denial of service or possible escalation of privileges.


NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to a denial of service or possible escalation of privileges.


NVIDIA Tegra OpenMax driver (libnvomx) contains a vulnerability in which the software delivers extra data with the buffer and does not properly validated the extra data which may lead to denial of service or escalation of privileges. Android ID: A-80198474.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software uses a sequential operation to read or write a buffer but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer which may lead to denial of service or possible escalation of privileges.


NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which sets incorrect permissions on a file which may to code execution denial of service or escalation of privileges by users with system access.


NVIDIA Tegra library contains a vulnerability in libnvmmlite_video.so where referencing memory after it has been freed may lead to denial of service or possible escalation of privileges. Android ID: A-80433161.


NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the registerbuffer API which may lead to arbitrary code execution denial of service or escalation of privileges. Android ID: A-62540032 Severity Rating: High Version: N/A.


NVIDIA Tegra TLK Widevine Trust Application contains a vulnerability in which missing the input parameter checking of video metadata count may lead to Arbitrary Code Execution Denial of Service or Escalation of Privileges. Android ID: A-72315075. Severity Rating: High. Version: N/A.


NVIDIA Tegra OpenMax driver (libnvomx) contains a vulnerability in which the software does not validate or incorrectly validates input that can affect the control flow or data flow of a program which may lead to denial of service or escalation of privileges. Android ID: A-70857947.


A logic issue in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.


NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin in which guest-supplied parameters remain writable by the guest after the plugin has validated them which may lead to the guest being able to pass invalid parameters to plugin handlers which may lead to denial of service or escalation of privileges. This affects vGPU version 8.x (prior to 8.5) version 10.x (prior to 10.4) and version 11.0.


NVIDIA GeForce Experience all versions prior to 3.20.5.70 contains a vulnerability in its services in which a folder is created by nvcontainer.exe under normal user login with LOCAL_SYSTEM privileges which may lead to a denial of service or escalation of privileges.


Path traversal in igdkmd64.sys for Intel(R) Graphics Drivers before versions 15.45.30.5103 15.40.44.5107 15.36.38.5117 and 15.33.49.5100 may allow an authenticated user to potentially enable escalation of privilege or denial of service via local access.


Improper initialization in subsystem for Intel(R) SPS versions before SPS_E3_04.01.04.109.0 and SPS_E3_04.08.04.070.0 may allow an authenticated user to potentially enable escalation of privilege and/or denial of service via local access.


Unquoted service path in Intel(R) Optane(TM) DC Persistent Memory Module Management Software before version 1.0.0.3461 may allow an authenticated user to potentially enable escalation of privilege and denial of service via local access.


An invalid object pointer free vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.


An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may cause arbitrary code execution in the kernel leading to escalation of privilege or denial of service.


An arbitrary write vulnerability in the AMD Radeon Graphics Driver for Windows 10 potentially allows unprivileged users to gain Escalation of Privileges and cause Denial of Service.


Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.


An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.


Out of Bounds Write and Read in AMD Graphics Driver for Windows 10 in Escape 0x6002d03 may lead to escalation of privilege or denial of service.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x600000E 0x600000F and 0x6000010 where a value passed from a user to the driver is used without validation as the index to an internal array leading to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where multiple pointers are used without checking for NULL leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x5000027 where a pointer passed from an user to the driver is used without validation leading to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed from a user to the driver is used without validation as the index to an array leading to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a pointer passed from a user to the driver is used without validation leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x70000d5 where a value passed from an user to the driver is used without validation as the index to an internal array leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x100009a where a value passed from an user to the driver is used without validation as the index to an internal array leading to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where the size of an input buffer is not validated leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x70001b2 where the size of an input buffer is not validated leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x7000170 where the size of an input buffer is not validated leading to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a handle to a kernel object may be returned to the user leading to possible denial of service or escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x7000014 where a value passed from an user to the driver is used without validation as the index to an internal array leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in a memory mapping API in the kernel mode layer (nvlddmkm.sys) handler leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x600000D where a value passed from a user to the driver is used without validation as the index to an internal array leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x100010b where a missing array bounds check can allow a user to write to kernel memory leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a user input to index an array is not bounds checked leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x700010d where a value passed from a user to the driver is used without validation as the index to an internal array leading to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) where unchecked input/output lengths in UVMLiteController Device IO Control handling may lead to denial of service or potential escalation of privileges.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x7000194 where a value passed from a user to the driver is used without validation as the index to an internal array leading to denial of service or potential escalation of privileges.


Protection mechanism failure in Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.


Out of bounds write in BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or denial of service via local access.


Out-of-bounds write in Intel(R) Graphics Drivers before version 15.36.38.5117 may allow an authenticated user to potentially enable escalation of privilege or denial of service via local access.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where untrusted input is used for buffer size calculation leading to denial of service or escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where the size of an input buffer is not validated leading to a denial of service or possible escalation of privileges


NVIDIA Windows GPU Display Driver all versions contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a NULL pointer is dereferenced which may lead to denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an improper input parameter handling may lead to a denial of service or potential escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated which may lead to denial of service or potential escalation of privileges


NVIDIA Windows GPU Display Driver all versions contains a vulnerability in the NVIDIA Control Panel component in which an attacker with local system access can corrupt a system file which may lead to denial of service or escalation of privileges.


NVIDIA Windows GPU Display Driver all versions contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a NULL pointer is dereferenced leading to denial of service or potential escalation of privileges.


Improper access control for Intel(R) Graphics Drivers before versions 15.33.49.5100 and 15.36.38.5117 may allow an authenticated user to potentially enable escalation of privilege or denial of service via local access.

denial of service
escalated privilege
improper access control


Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access


NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled where improper access control may lead to a denial of service escalation of privileges or both.


NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler where improper access control may lead to denial of service or possible escalation of privileges.


Improper access control for some Intel(R) Server Boards Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.

denial of service
improper access control


Improper access control in the installer for Intel(R) Chipset Device Software INF Utility before version 10.1.18 may allow an authenticated user to potentially enable denial of service via local access.


Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.


Improper access control in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user to potentially enable a denial of service via local access.


Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denial of service via local access.


Improper access control in the Intel(R) Visual Compute Accelerator 2 all versions may allow a privileged user to potentially enable denial of service via local access.


Improper

Access

Control

in

Jfinal

CMS

and

earlier

allows

remote

attackers

to

obtain

sensitive

information

or

cause

a

denial

of

service

via

the

'FileManager.delete()'

function

in

the

component

'modules/filemanager/FileManagerController.java'.


Improper access control in firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow a privileged user to potentially enable denial of service via local access.


Improper access control in the Intel(R) HD Graphics Control Panel before version 15.40.46.5144 and 15.36.39.5143 may allow an authenticated user to potentially enable denial of service via local access.


Improper access control in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may potentially allow a privileged user to enable a denial of service via local access.


Improper access control in Intel(R) Graphics Drivers before version 26.20.100.7463 may allow an authenticated user to potentially enable denial of service via local access.


Improper access control in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.


A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In order to exploit the vulnerability the adversary needs to have successfully paired an app or service which requires user interaction.


NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVMAP_IOC_WRITE* paths where improper access controls may lead to code execution complete denial of service and seriously compromised integrity of all system components.


NVIDIA Jetson AGX Xavier Series Jetson Xavier NX TX1 TX2 Nano and Nano 2GB L4T versions prior to 32.5 contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image in which improper access control is applied which may lead to an unprivileged user being able to modify system device tree files leading to denial of service.


NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER where improper access control may lead to code execution compromised integrity or denial of service.


The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data and cause a denial of service for users.


Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.


A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580 Modicon M340 Modicon Quantum and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus.


NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where improper access controls could allow unprivileged users to cause a denial of service.


All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service.


An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a specific open IPv4 port which in affected releases should otherwise be unreachable to cause the CPU to consume all resources as more traffic is sent to the port to create a Denial of Service (DoS) condition. Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS Evolved 20.4 versions prior to 20.4R3-S2-EVO; 21.1 versions prior to 21.1R3-S1-EVO; 21.2 versions prior to 21.2R3-EVO; 21.3 versions prior to 21.3R2-EVO; 21.4 versions prior to 21.4R2-EVO. This issue does not affect Junos OS.

denial of service
improper access control
dos


A CWE-284: Improper Access Control vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause a wide range of problems including information exposure denial of service and command execution when access to a resource from an attacker is not restricted or incorrectly restricted.

denial of service
improper access control
information exposure


A denial of service vulnerability exists when Windows improperly handles objects in memory aka \Windows Denial of Service Vulnerability.\ This affects Windows 10 Windows Server 2019.

denial of service
improper memory object handle
denial of service


A denial of service vulnerability exists when Windows improperly handles objects in memory aka 'Windows Denial of Service Vulnerability'.


A denial of service vulnerability exists when Windows Routing Utilities improperly handles objects in memory aka 'Windows Routing Utilities Denial of Service'.


HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the client. Versions 9 10 and 11 are affected.

denial of service
improper user input validation


HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input potentially giving an attacker the ability to crash the server. Versions previous to release 9.0.1 FP10 IF6 and release 10.0.1 are affected.


HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the server. Versions previous to releases 9.0.1 FP10 IF6 10.0.1 FP5 and 11.0.1 are affected.


IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613.


A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS) and Expressway could allow an unauthenticated remote attacker to cause a temporary service outage for all IM&P users resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious IPv4 or IPv6 packet to an affected device on TCP port 7400. An exploit could allow the attacker to overread a buffer resulting in a crash and restart of the XCP Router service. Cisco Bug IDs: CSCvg97663 CSCvi55947.

denial of service
improper user input validation
dos


An

information

exposure

and

denial

of

service

vulnerability

exists

in

Jenkins

Token

Macro

Plugin

and

earlier

in

that

allows

attackers

with

the

ability

to

control

token

macro

input

(such

as

SCM

changelogs)

to

define

recursive

input

that

results

in

unexpected

macro

evaluation.


Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Dell EMC ViPR Controller versions after 3.0.0.38 contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user having access to the vCloud subnet where ViPR is deployed could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.


A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older) that could cause a wide range of problems including information exposures denial of service and arbitrary code execution when access control checks are not applied consistently.


In SweetScape 010 Editor 9.0.1 an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.


In OpenJPEG 2.3.0 there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.


In OpenJPEG 2.3.0 there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.


nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).


Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c.


Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow through a specific SMC call that is triggered by the user which may lead to denial of service.


Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005. An unauthenticated remote attacker can crash vserver.exe due to an integer overflow in the UDP message handling logic.


An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen leading to a denial of service or possibly unspecified other impact aka CID-19fad20d15a6.


A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.


Jonathan

Looney

discovered

that

the

value

was

subject

to

an

integer

overflow

in

the

Linux

kernel

when

handling

TCP

Selective

Acknowledgments

(SACKs).

A

remote

attacker

could

use

this

to

cause

a

denial

of

service.

This

has

been

fixed

in

stable

kernel

releases

and

is

fixed

in

commit


** DISPUTED ** lighttpd before 1.4.54 has a signed integer overflow which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states \The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50 and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables) also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.\


An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable which triggers an allocation of excessive memory.


Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.


In Bluetooth there is a possible crash due to an integer overflow. This could lead to remote denial of service on incoming calls with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-79431031


In libhevc there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111272481


In libssh2 v1.9.0 and earlier versions the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.


Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8 as used in eom gnome-photos eog gambas3 thunar pinpoint and possibly other applications allows remote attackers to cause a denial of service (crash) via a large image file which triggers a large memory allocation.


Integer overflow in Links before 2.8 allows remote attackers to cause a denial of service (crash) via crafted HTML tables.


Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the (1) pvalloc (2) valloc (3) posix_memalign (4) memalign or (5) aligned_alloc functions.


Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.


Multiple integer overflows in the JPEG engine drivers in the MSM camera driver for the Linux kernel 2.6.x and 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allow attackers to cause a denial of service (system crash) via a large number of commands in an ioctl call related to (1) camera_v1/gemini/msm_gemini_sync.c (2) camera_v2/gemini/msm_gemini_sync.c (3) camera_v2/jpeg_10/msm_jpeg_sync.c (4) gemini/msm_gemini_sync.c (5) jpeg_10/msm_jpeg_sync.c and (6) mercury/msm_mercury_sync.c.


Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request which triggers a large memory allocation.


The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function which allows remote attackers to cause a denial of service (segmentation fault) via a (1) XAuth username (2) EAP identity or (3) PEM encoded file that starts with a 0x04 0x30 or 0x31 character followed by an ASN.1 length value that triggers an integer overflow.


Multiple integer overflows in the binary-search implementation in SpiderMonkey in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 might allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.


Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2 as used in Firefox before 25.0.1 Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1 and SeaMonkey before 2.22.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate a related issue to CVE-2013-1741.


Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value.


Multiple integer overflows in (1) libGLESv2/renderer/Renderer9.cpp and (2) libGLESv2/renderer/Renderer11.cpp in Almost Native Graphics Layer Engine (ANGLE) as used in Google Chrome before 29.0.1547.57 allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


The dissect_server_info function in epan/dissectors/packet-ms-mms.c in the MS-MMS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not properly manage string lengths which allows remote attackers to cause a denial of service (application crash) via a malformed packet that (1) triggers an integer overflow or (2) has embedded '\\0' characters in a string.


The iff_read_header function in iff.c in libavformat in FFmpeg through 1.1.3 does not properly handle data sizes for Interchange File Format (IFF) data during operations involving a CMAP chunk or a video codec which allows remote attackers to cause a denial of service (integer overflow out-of-bounds array access and application crash) or possibly have unspecified other impact via a crafted header.


Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet related to a crash of the Websocket dissector an infinite loop in the MySQL dissector and a large loop in the ETCH dissector.


Integer overflow in the TCP/IP kernel-mode driver in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT allows remote attackers to cause a denial of service (system hang) via crafted TCP packets aka \TCP/IP Integer Overflow Vulnerability.\


The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values which allows remote attackers to cause a denial of service (integer overflow out-of-bounds array access and application crash) via crafted LucasArts Smush video data.


There is an integer overflow in the ION driver \/dev/ion\ of Allwinner R818 SoC Android Q SDK V1.0 that could use the ioctl cmd \COMPAT_ION_IOC_SUNXI_FLUSH_RANGE\ to cause a system crash (denial of service).


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

denial

of

service

via

a

`CHECK`-fail

in

caused

by

an

integer

overflow

in

constructing

a

new

tensor

shape.

This

is

because

the

builds

a

dense

shape

without

checking

that

the

dimensions

would

not

result

in

overflow.

The

`TensorShape`

uses

a

`CHECK`

operation

which

triggers

when

returns

a

non-OK

status.

This

is

a

legacy

implementation

of

the

constructor

and

operations

should

use

`BuildTensorShapeBase`

or

`AddDimWithStatus`

to

prevent

`CHECK`-failures

in

the

presence

of

overflows.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.


An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a \PVRDMA_REG_DSRHIGH\ write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory resulting in a denial of service. The highest threat from this vulnerability is to system availability.


In getService of IServiceManager.cpp there is a possible unhandled exception due to an integer overflow. This could lead to local denial of service making the lockscreen unusable with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-197336441


Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks which might lead to denial of service.


XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Integer Overflow vulnerability potentially resulting in application-level denial of service in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.


A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology including BIOSENSE Webpass and BF-630 BF-631 and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.


An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.


Multiple integer overflows in the Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allow remote attackers to cause a denial of service (CPU and memory consumption) via a crafted packet to port 5633/tcp which triggers an infinite loop.


Multiple integer overflows in Dibbler 0.6.0 allow remote attackers to cause a denial of service (daemon crash) via packets containing options with large lengths which trigger attempts at excessive memory allocation as demonstrated by (1) the TSrvMsg constructor in SrvMessages/SrvMsg.cpp; the (2) TClntMsg (3) TClntOptIAAddress (4) TClntOptIAPrefix (5) TOptVendorSpecInfo and (6) TOptOptionRequest constructors; and the (7) TRelIfaceMgr::decodeRelayRepl (8) TRelMsg::decodeOpts and (9) TSrvIfaceMgr::decodeRelayForw methods.


Integer overflow in the LG Mobile handset allows remote attackers to cause a denial of service (reboot) via a crafted HTTP packet. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service (CPU consumption) via a certain PNG file with a large tEXt chunk that possibly triggers an integer overflow in PNG chunk size handling as demonstrated by badlycrafted.png.


Integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel 2.6.21-rc4 when running on 64-bit systems allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value which causes the timer to always be expired.


Integer overflow in ESET NOD32 Antivirus before 2.2289 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted ASPACK packed file which triggers an infinite loop.


Integer overflow in Firebird 2.0.0 allows remote authenticated users to cause a denial of service (CPU consumption) via certain database operations with multi-byte character sets that trigger an attempt to use the value 65536 for a 16-bit integer which is treated as 0 and causes an infinite loop on zero-length data.


Integer overflow in the ktruser function in NetBSD-current before 20061022 NetBSD 3 and 3-0 before 20061024 and NetBSD 2 before 20070209 when the kernel is built with the COMPAT_FREEBSD or COMPAT_DARWIN option allows local users to cause a denial of service and possibly gain privileges.


Integer overflow in the byte_swap_sbin function in bsd/ufs/ufs/ufs_byte_order.c in Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service (kernel panic) by mounting a crafted Unix File System (UFS) DMG image which triggers an invalid pointer dereference.


The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.


Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file which triggers an out-of-bounds memory access.


Integer overflow in imlib2 before 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted image which triggers an invalid read operation.


Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20 10.x before 10.2.22 and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request which triggers a large memory allocation.


Integer overflow in SAP Network Interface Router (SAProuter) 40.4 allows remote attackers to cause a denial of service (resource consumption) via crafted requests.


Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.


Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c.


Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.


Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19 as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16 allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.


Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x 3.3.x 3.2.x and earlier when XSM is enabled allow local users to cause a denial of service (processor fault) via unspecified vectors a different vulnerability than CVE-2014-1891 CVE-2014-1892 and CVE-2014-1894.


Integer

overflow

in

the

SoftwareFrameManager::SwapToNewFrame

function

in

in

the

software

compositor

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

trigger

an

attempted

mapping

of

a

large

amount

of

renderer

memory.


Integer overflow in api.cc in Google V8 as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.


Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier when XSM is enabled allow local users to cause a denial of service (processor fault) via unspecified vectors a different vulnerability than CVE-2014-1891 CVE-2014-1892 and CVE-2014-1893.


Integer

overflow

in

the

AudioInputRendererHost::OnCreateStream

function

in

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

trigger

a

large

shared-memory

allocation.


Multiple integer overflows in the (1) FLASK_GETBOOL (2) FLASK_SETBOOL (3) FLASK_USER and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x 4.2.x 4.1.x 3.2.x and earlier when XSM is enabled allow local users to cause a denial of service (processor fault) via unspecified vectors a different vulnerability than CVE-2014-1892 CVE-2014-1893 and CVE-2014-1894.


Multiple integer overflows in the replace-data functionality in the CharacterData interface implementation in core/dom/CharacterData.cpp in Blink as used in Google Chrome before 34.0.1847.137 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to ranges.


Integer

overflow

in

the

parseChunkHeader

function

in

in

Apache

Tomcat

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(resource

consumption)

via

a

malformed

chunk

size

in

chunked

transfer

coding

of

a

request

during

the

streaming

of

data.


Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.


Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.


The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.


Multiple integer overflows in the HelpServ module (mod-helpserv.c) in srvx 1.3.1 allow remote authenticated IRCops or HelpServ bot managers to cause a denial of service (infinite loop) via a large value in the EmptyInterval parameter or certain other interval configurations.


Integer

overflow

in

the

function

in

in

OpenJPEG

in

PDFium

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

long

segment

in

a

JPEG

image.


Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before 39.0.2171.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data.


Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split function.


Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file followed by a sync operation.


Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier and 8.5 through 8.5alpha2 allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses related to certain hashtable size calculations.


The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not use the correct variables in calculations designed to prevent integer overflows which allows attackers to leverage renderer access to cause a denial of service or possibly have unspecified other impact via bitmap data related to deserialization.


Integer overflow in the ReadDirectory function in tiffdump.c in tiffdump in LibTIFF before 3.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF file containing a directory data structure with many directory entries.


A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. There are a number of implementation errors in the parsing of HPACK-encoded header blocks that allow maliciously crafted HPACK header blocks to cause crashes in processes using swift-nio-http2. Each of these crashes is triggered instead of an integer overflow. A malicious HPACK header block could be sent on any of the HPACK-carrying frames in a HTTP/2 connection (HEADERS and PUSH_PROMISE) at any position. Sending a HPACK header block does not require any special permission so any HTTP/2 connection peer may send one. For clients this means any server to which they connect may launch this attack. For servers anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send an appropriately crafted field block. The impact on availability is high: receiving a frame carrying this field block immediately crashes the server dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted field blocks so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the field block in memory-safe code and the crash is triggered instead of an integer overflow. However sudden process crashes can lead to violations of invariants in services so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle all conditions in the function. The principal issue was found by automated fuzzing by oss-fuzz but several associated bugs in the same code were found by code audit and fixed at the same time


Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to integer overflows. These can be used to trigger large allocations (so OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so assert failures based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. The implementation of `AddManySparseToTensorsMap` is vulnerable to an integer overflow which results in a `CHECK`-fail when building new `TensorShape` objects (so an assert failure based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


In subtitle service there is a possible application crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330673; Issue ID: DTV03330673.


Integer underflow in the NTLM authentication feature in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows remote attackers to cause a denial of service (reboot) via a malformed packet aka \Local Security Authority Subsystem Service Integer Overflow Vulnerability.\


Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow as demonstrated by voltage-exploit.emf aka the \Microsoft GdiPlus EMF GpFont.SetData integer overflow.\


Integer

overflow

in

the

PulseAudioTargetDataL

class

in

in

Pulse-Java

as

used

in

OpenJDK

and

other

products

allows

remote

attackers

to

cause

a

denial

of

service

(applet

crash)

via

a

crafted

Pulse

Audio

source

data

line.


Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree related to the fts_level structure member as demonstrated by (a) du (b) rm (c) chmod and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.


Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file related to (1) JBIG2Stream::readSymbolDictSeg (2) JBIG2Stream::readSymbolDictSeg and (3) JBIG2Stream::readGenericBitmap.


Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string as demonstrated by a crafted first argument to the money_format function in PHP a related issue to CVE-2008-1391.


Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string as demonstrated by the %99999999999999999999n string a related issue to CVE-2008-1391.


The httpClientDiscardBody function in client.c in Polipo 0.9.8 0.9.12 1.0.4 and possibly other versions allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value which triggers an integer overflow a signed-to-unsigned conversion error with a negative value and a segmentation fault.


Integer overflow in BitchX IRC client 1.0-0c19 and earlier allows remote malicious IRC servers to cause a denial of service (crash).


Multiple integer overflows in the 32bit emulation for AMD64 architectures in Linux 2.4 kernel before 2.4.21 allows attackers to cause a denial of service or gain root privileges via unspecified vectors that trigger copy_from_user function calls with improper length arguments.


Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.


The IMAP Client for Outlook Express 6.00.2800.1106 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause either integer signedness errors or integer overflow errors.


The IMAP Client for Sylpheed 0.8.11 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause either integer signedness errors or integer overflow errors.


Integer overflow in the InitialDirContext in Java Runtime Environment (JRE) 1.4.2 1.5.0 and possibly other versions allows remote attackers to cause a denial of service (Java exception and failed DNS requests) via a large number of DNS requests which causes the xid variable to wrap around and become negative.


Integer overflow in Gadu-Gadu allows remote attackers to cause a denial of service (disk consumption) via a user packet to the DCC file transfer capability with an invalid file length.


Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.


Integer overflow in the asn_decode_string() function defined in asn1.c in radiusd for GNU Radius 1.1 and 1.2 before 1.2.94 when compiled with the --enable-snmp option allows remote attackers to cause a denial of service (daemon crash) via certain SNMP requests.


Integer overflow on Apple QuickTime before 6.5.2 when running on Windows systems allows remote attackers to cause a denial of service (memory consumption) via certain inputs that cause a large memory operation.


The iSNS dissector for Ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (process abort) via an integer overflow.


Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.


There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP before 0.11.0. For example a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack.


The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next during \readelf -a\ execution.


The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 interpret a -1 value as a sorting count instead of an error flag which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file related to elf32-i386.c and elf64-x86-64.c.


Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file leading to a denial of service (application crash) or disclosure of sensitive information from process memory.


The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data which allows local users to trigger an integer overflow and out-of-bounds write and cause a denial of service (system hang or crash) or possibly gain privileges via a crafted ioctl call for a /dev/dri/renderD* device.


LibTIFF 4.0.7 has a signed integer overflow which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a signed integer overflow which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.


Artifex jbig2dec 0.13 as used in Ghostscript allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file leading to a denial of service (application crash) or possibly execution of arbitrary code.


The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket.


Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.


Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.


Integer overflow in the vrend_create_shader function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (process crash) via crafted pkt_length and offlen values which trigger an out-of-bounds access.


kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.


coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 does not validate the symbol count which allows remote attackers to cause a denial of service (integer overflow and application crash or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.


Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu) when built with the CCID Card device emulator support allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.


Integer overflow in libjasper/jpc/jpc_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.


Integer overflow in the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted size value in a VC4_SUBMIT_CL ioctl call.


Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.


EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service.


Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.


The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl.


An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file.


The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value as demonstrated by an incorrect sample-rate calculation.


The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory bypass the bl1_plat_mem_check protection mechanism cause a denial of service or possibly have unspecified other impact via a crafted AArch32 image which triggers an integer overflow.


The readString function in util/read.c and util/old/read.c in libming 0.4.8 allows remote attackers to cause a denial of service via a large file that is mishandled by listswf listaction etc. This occurs because of an integer overflow that leads to a memory allocation error.


Integer overflow in the FontData::Bound function in data/font_data.cc in Google sfntly as used in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.


Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92 R352 before 354.35 and R358 before 358.87 on Windows and R304 before 304.131 R340 before 340.96 R352 before 352.63 and R358 before 358.16 on Linux allow local users to obtain sensitive information cause a denial of service (crash) or possibly gain privileges via unknown vectors which trigger uninitialized or out of bounds memory access. NOTE: this identifier has been SPLIT per ADT2 and ADT3 due to different vulnerability type and affected versions. See CVE-2015-8328 for the vulnerability in the NVAPI support layer in NVIDIA drivers for Windows.


The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values which allows local users to cause a denial of service (incorrect data representation or integer overflow and OOPS) via a crafted UDF filesystem.


Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps aka internal bug 19666945.


Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia as used in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value leading to an out-of-bounds write operation.


Integer overflow in FreeBSD before 8.4 p24 9.x before 9.3 p10. 10.0 before p18 and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet which triggers an incorrect size calculation and allocation of insufficient memory.


Integer overflow in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia as used in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering.


Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.


Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device inoperability) via crafted Matroska data aka internal bug 21296336.


Integer overflow in the HwpApp::CHncSDS_Manager function in Hancom Office HanWord processor as used in Hwp 2014 VP before 9.1.0.2342 HanWord Viewer 2007 and Viewer 2010 8.5.6.1158 and HwpViewer 2014 VP 9.1.0.2186 allows remote attackers to cause a denial of service (crash) and possibly \influence the program's execution flow\ via a document with a large paragraph size which triggers heap corruption.


Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.


Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message related to pointer validation.


Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.


Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5 2.7.x before 2.7.3 and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.


PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


Integer overflow in the WebCursor::Deserialize function in content/common/cursors/webcursor.cc in Google Chrome before 47.0.2526.106 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an RGBA pixel array with crafted dimensions a different vulnerability than CVE-2015-6792.


Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression.


PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


DataSourceControl in Internet Explorer 6 on Windows XP SP2 with Office installed allows remote attackers to cause a denial of service (crash) via a large negative integer argument to the getDataMemberName method of a OWC11.DataSourceControl.11 object which leads to an integer overflow and a null dereference.


Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.


Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) via a (1) Forms.ListBox.1 or (2) Forms.ListBox.1 object with the ListWidth property set to (a) 0x7fffffff which triggers an integer overflow exception or to (b) 0x7ffffffe which triggers a null dereference.


Multiple integer overflows in the (1) dodecrypt and (2) doencrypt functions in cfs_fh.c in cfsd in Matt Blaze Cryptographic File System (CFS) 1.4.1 before Debian GNU/Linux package 1.4.1-17 allow local users to cause a denial of service (daemon crash) by appending data to a file that is larger than 2 Gb.


Integer overflow in the loadChunk function in loaders/load_gt2.c in libmikmod in Mikmod Sound System 3.2.2 allows remote attackers to cause a denial of service via a GRAOUMF TRACKER (GT2) module file with a large (0xffffffff) comment length value in an XCOM chunk.


parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20 and earlier versions allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string) which could lead to an integer overflow as demonstrated using the --no-armor option.


Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large regular expression.


Integer overflow in the systrace_preprepl function (STRIOCREPLACE) in systrace in OpenBSD 3.9 and NetBSD 3 allows local users to cause a denial of service (crash) gain privileges or read arbitrary kernel memory via large numeric arguments to the systrace ioctl.


Integer overflow in AnywhereUSB/5 1.80.00 allows local users to cause a denial of service (crash) via a 1 byte header size specified in the USB string descriptor.


Integer overflow in OpenOffice.org (OOo) 2.1 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted DOC file as demonstrated by the 12122006-djtest.doc file a variant of CVE-2006-6561 in a separate codebase.


The minix filesystem code in Linux kernel 2.6.x before 2.6.24 including 2.6.18 allows local users to cause a denial of service (hang) via a malformed minix file stream that triggers an infinite loop in the minix_bmap function. NOTE: this issue might be due to an integer overflow or signedness error.


Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248.


Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array (2) Float32Array (3) Float64Array (4) Uint32Array (5) Int16Array or (6) ArrayBuffer function. NOTE: the vendor reportedly characterizes this as \a stability issue not a security issue.\


Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file which triggers a large memory allocation.


Integer overflow in the ff_j2k_dwt_init function in libavcodec/j2k_dwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value.


Integer

overflow

in

the

function

in

in

the

Direct

Rendering

Manager

(DRM)

subsystem

in

the

Linux

kernel

before

on

platforms

allows

local

users

to

cause

a

denial

of

service

(out-of-bounds

write)

or

possibly

have

unspecified

other

impact

via

a

crafted

ioctl

call.


Multiple integer overflows in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux and before 21.0.1180.60 on Windows and Chrome Frame allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.


Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI dissectors a different vulnerability than CVE-2012-2392.


Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.


Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


Integer overflow in the dissect_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Number of Sources value.


The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted value in a packet.


Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.


The dissect_eigrp_metric_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wrong data type for a certain offset value which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a malformed packet.


Integer overflow in CimWebServer.exe in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0 and Proficy Process Systems with CIMPLICITY allows remote attackers to cause a denial of service (daemon crash) via a malformed HTTP request.


Integer overflow in the dissect_xtp_ecntl function in epan/dissectors/packet-xtp.c in the XTP dissector in Wireshark 1.4.x before 1.4.15 1.6.x before 1.6.10 and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop or application crash) via a large value for a span length.


Integer overflow in RNADiagnostics.dll in Rockwell Automation FactoryTalk Services Platform (FTSP) CPR9 CPR9-SR1 CPR9-SR2 CPR9-SR3 CPR9-SR4 CPR9-SR5 CPR9-SR5.1 and CPR9-SR6 allows remote attackers to cause a denial of service (service outage or RNADiagReceiver.exe daemon crash) via UDP data that specifies a large integer value.


drivers/leds/leds-aw2023.c in the led driver for custom Linux kernels on the Xiaomi Redmi 6pro daisy-o-oss phone has several integer overflows because of a left-shifting operation when the right-hand operand can be equal to or greater than the integer length. This can be exploited by a crafted application for denial of service.


An issue was discovered in Xpdf 4.00. XRef::readXRefStream in XRef.cc allows attackers to launch a denial of service (Integer Overflow) via a crafted /Size value in a pdf file as demonstrated by pdftohtml. This is mainly caused by the program attempting a malloc operation for a large amount of memory.


An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values the overrun can be larger than INT_MAX but the accounting is int based. This basically makes the accounting values which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun random. For example a local user can cause a denial of service (signed integer overflow) via crafted mmap futex timer_create and timer_settime system calls.


In libpng 1.6.34 a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file leading to a denial of service.


RSA BSAFE Micro Edition Suite version 4.1.6 contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service.


A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.


miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in remote denial of service. This attack appear to be exploitable via the victim must load a specially-crafted map which calls SetLayerSize in its entry script. This vulnerability appears to have been fixed in 5.0.3 5.1.5 5.2.10 and later.


The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value.


In GNU Binutils 2.30 there's an integer overflow in the function load_specific_debug_section() in objdump.c which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information as demonstrated by nm.


The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file as demonstrated by objdump.


Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be abused to cause a denial of service attack.


Integer overflow in subsystem for Intel(R) AMT versions before 11.8.80 11.12.80 11.22.80 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable denial of service via adjacent access.


An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g. an infinite loop).


An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages multiple integer overflows can be triggered leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability.


An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process resulting in a denial of service.


Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77 11.12.77 11.22.77 and Intel(R) TXE versions before 3.1.75 4.0.25 and Intel(R) Server Platform Services (SPS) versions before SPS_E5_04.01.04.380.0 SPS_SoC-X_04.00.04.128.0 SPS_SoC-A_04.00.04.211.0 SPS_E3_04.01.04.109.0 SPS_E3_04.08.04.070.0 may allow a privileged user to potentially enable denial of service via local access.


In exif_data_load_data_content of exif-data.c there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941


In exif_data_load_data_thumbnail of exif-data.c there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076


In QEMU through 5.0.0 an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host resulting in a denial of service.


ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) 1.0.12 allows an integer overflow and denial of service via a crafted EMF file.


Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.


drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file.


Integer overflow in libavcodec/mpegvideo_parser.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.


Integer overflow in libswscale/x86/swscale.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file.