ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_LAN_Content.asp.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function ReadGF_IPMPX_WatermarkingInit() in odf/ipmpx_code.c.


OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects GS728TPPv2 before 6.0.0.48 GS728TPv2 before 6.0.0.48 GS750E before 1.0.1.4 GS752TPP before 6.0.0.48 and GS752TPv2 before 6.0.0.48.


An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user.


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos chipsets) software. A buffer overflow in the HDCP Trustlet affects secure TEEGRIS memory. The Samsung ID is SVE-2019-15283 (November 2019).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (Exynos chipsets) software. There is a Buffer Overflow in the Touch Screen Driver. The Samsung ID is SVE-2019-14990 (October 2019).


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a stack-based buffer overflow in the function av1_parse_tile_group() in media_tools/av_parsers.c.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


dimC_Read in isomedia/box_code_3gpp.c in GPAC 0.8.0 has a stack-based buffer overflow.


NETGEAR R7000 devices before 1.0.9.42 are affected by a buffer overflow by an authenticated user.


An issue was discovered on Samsung mobile devices with P(9.0) devices (Qualcomm chipsets) software. There is a buffer overflow in the bootloader. The Samsung ID is SVE-2019-15399 (November 2019).


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects DGN2200v4 before 1.0.0.110 DGND2200Bv4 before 1.0.0.109 R7300 before 1.0.0.70 R8300 before 1.0.2.130 and R8500 before 1.0.2.130.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled but terminates the process. An authenticated attacker can send a FTP command string of 472 bytes or more to overflow a buffer causing an exception that terminates the server.


Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.


The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults leading to denial-of-service as demonstrated by wasm2js.


The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address which can then be leveraged to execute attacker-controlled code on the server.


An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However when copying this header to parse it does not check the size of the header leading to a stack-based buffer overflow.


In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1 a local attacker can cause a buffer overflow in the indexer-worker process which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.


File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution and obtain a command shell by sending a HTTP GET request including the malicious payload in the URL. A similar issue to CVE-2019-17415 CVE-2019-16724 and CVE-2010-2331.


Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.


cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements which allows a heap-based buffer overflow (4-byte out-of-bounds write).


In wolfSSL 4.1.0 through 4.2.0c there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten there is an invalid free.


In Sudo before 1.8.26 if pwfeedback is enabled in /etc/sudoers users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however it is NOT the default for upstream and many other packages and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.


CODESYS 3 web server before 3.5.15.20 as distributed with CODESYS Control runtime systems has a Buffer Overflow.


idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.


On the Cypress CYW20735 evaluation board any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow an attacker can either send packets over the air or as unprivileged local user. Over the air the minimal PoC is sending \l2ping -s 600\ to the target address prior to any pairing. Locally the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because in WICED Studio 6.2 and 6.4 BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384.


Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via crafted GET/POST parameters.


OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.


HTMLDOC 1.9.7 allows a stack-based buffer overflow in the hd_strlcpy() function in string.c (when called from render_contents in ps-pdf.cxx) via a crafted HTML document.


NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. This affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files.


read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.


In

in

has

a

heap-based

buffer

overflow.


An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.


A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server.


In GraphicsMagick 1.4 snapshot-20190423 Q8 there is a heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c.


Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c.


freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command (this is exploitable even if logging is disabled).


The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server.


Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified which may allow arbitrary code execution. Mat Powell Ziad Badawi and Natnael Samson working with Trend Micro's Zero Day Initiative reported these vulnerabilities to NCCIC.


D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol message which is mishandled in /usr/sbin/udhcpd during reading of the /var/servd/LAN-1-udhcpd.conf file.


A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLinx Classic where the data in a Forward Open service request is passed to a fixed size buffer allowing an attacker to exploit a stack-based buffer overflow condition.


A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3 allowing an unauthenticated attacker to execute code via a long username.


An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. A heap-based buffer overflow bug in svgpp_agg_render may lead to code execution. In the render_scanlines_aa_solid function the blend_hline function is called repeatedly multiple times. blend_hline is equivalent to a loop containing write operations. Each call writes a piece of heap data and multiple calls overwrite the data in the heap.


gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5 as used in the imagecolormatch function in PHP before 5.6.40 7.x before 7.1.26 7.2.x before 7.2.14 and 7.3.x before 7.3.1 has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.


HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419) HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an IPP Parser potentially vulnerable to Buffer Overflow.


In QEMU 3.0.0 tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.


examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through 3.15.7 has a heap-based buffer overflow.


HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419) HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have embedded web server attributes which may be potentially vulnerable to Buffer Overflow.


Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage these vulnerabilities to execute code under the context of the current process. Mat Powell Ziad Badawi and Natnael Samson working with Trend Micro's Zero Day Initiative reported these vulnerabilities to NCCIC.


The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow. This could allow execution of arbitrary code on the local system or the application to crash. IBM X-Force ID: 160200.


An exploitable heap buffer overflow vulnerability exists in the iocheckd service \I/O-Check\ functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.


An

exploitable

stack

buffer

overflow

vulnerability

vulnerability

exists

in

the

iocheckd

service

\I/O-Check\

functionality

of

WAGO

PFC

An

attacker

can

send

a

specially

crafted

packet

to

trigger

the

parsing

of

this

cache

file.At

the

extracted

interface

element

name

from

the

xml

file

is

used

as

an

argument

to

interface=<contents

of

interface

element>

using

sprintf().

The

destination

buffer

is

overflowed

with

the

call

to

sprintf()

for

any

interface

values

that

are

greater

than

512-len(\/etc/config-tools/config_interfaces

interface=\)

in

length.

Later

at

strcpy()

is

used

to

copy

the

contents

of

the

stack

buffer

that

was

overflowed

into

The

buffer

is

immediately

adjacent

to

on

the

stack.

Therefore

there

is

no

termination

on

the

buffer

since

it

overflowed

into

The

strcpy()

will

result

in

invalid

memory

access.

An

interface

value

of

length

will

cause

the

service

to

crash.


A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.


An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets sent to the iocheckd service \I/O-Check\ can cause a stack buffer overflow in the sub-process getcouplerdetails resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.


An exploitable heap buffer overflow vulnerability exists in the iocheckd service ''I/O-Chec'' functionality of WAGO PFC 200 Firmware version 03.01.07(13) and 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.


An exploitable stack buffer overflow vulnerability exists in the iocheckd service ''I/O-Check'' functionality of WAGO PFC200 Firmware version 03.01.07(13) WAGO PFC200 Firmware version 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a stack buffer overflow resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.


An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.


An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV before version 4.2.0. A specially crafted JSON file can cause a buffer overflow resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.


An exploitable command execution vulnerability exists in the ASN1 certificate writing functionality of Openweave-core version 4.0.2. A specially crafted weave certificate can trigger a heap-based buffer overflow resulting in code execution. An attacker can craft a weave certificate to trigger this vulnerability.


An

exploitable

stack

buffer

overflow

vulnerability

vulnerability

exists

in

the

iocheckd

service

\I/O-Check\

functionality

of

WAGO

PFC

An

attacker

can

send

a

specially

crafted

packet

to

trigger

the

parsing

of

this

cache

file.

At

the

extracted

state

value

from

the

xml

file

is

used

as

an

argument

to

state=<contents

of

state

node>

using

sprintf().

The

destination

buffer

is

overflowed

with

the

call

to

sprintf()

for

any

state

values

that

are

greater

than

state=\)

in

length.

Later

at

strcpy()

is

used

to

copy

the

contents

of

the

stack

buffer

that

was

overflowed

into

The

buffer

is

immediately

adjacent

to

on

the

stack.

Therefore

there

is

no

termination

on

the

buffer

since

it

overflowed

into

The

strcpy()

will

result

in

invalid

memory

access.

An

state

value

of

length

will

cause

the

service

to

crash.


AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.


P30 Mate 20 P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21) versions earlier than Hima-AL00B 9.1.0.135(C00E200R2P1) versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12) have a buffer overflow vulnerability on several the system does not properly validate certain length parameter which an application transports to kernel. An attacker tricks the user to install a malicious application successful exploit could cause malicious code execution.


Huawei smart phones with earlier versions than ELLE-AL00B 9.1.0.222(C00E220R2P1) have a buffer overflow vulnerability. An attacker may intercept and tamper with the packet in the local area network (LAN) to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal.


Huawei Atlas 300 Atlas 500 have a buffer overflow vulnerability. A local authenticated attacker may craft specific parameter and send to the process to exploit this vulnerability. Successfully exploit may cause service crash.


A buffer overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro MR1 (7 0 2019 0220). While parsing a document text info container the TxMasterStyleAtom::parse function is incorrectly checking the bounds corresponding to the number of style levels causing a vtable pointer to be overwritten which leads to code execution.


A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.


An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.


An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200 Firmware version 03.01.07(13) WAGO PFC200 Firmware version 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.


ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow.


An exploitable command execution vulnerability exists in the print-tlv command of Weave tool. A specially crafted weave TLV can trigger a stack-based buffer overflow resulting in code execution. An attacker can trigger this vulnerability by convincing the user to open a specially crafted Weave command.


Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application.


SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on Port 987.


Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c related to codedoc_strlcpy.


nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long variable string in a Map Objects text file.


nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.


dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.


The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv4 address in zone data.


FreeTDS through 1.1.11 has a Buffer Overflow.


CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.


In ZeroMQ libzmq before 4.0.9 4.1.x before 4.1.7 and 4.2.x before 4.3.2 a remote unauthenticated client connecting to a libzmq application running with a socket listening with CURVE encryption/authentication enabled may cause a stack overflow and overwrite the stack with arbitrary data due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible as there are no known mitigations.


The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.


A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions) EN100 Ethernet module IEC 61850 variant (All versions < V4.37) EN100 Ethernet module IEC104 variant (All versions) EN100 Ethernet module Modbus TCP variant (All versions) EN100 Ethernet module PROFINET IO variant (All versions). An unauthorized user could exploit a buffer overflow vulnerability in the webserver. Specially crafted packets sent could cause a Denial-of-Service condition and if certain conditions are met the affected devices must be restarted manually to fully recover. At the time of advisory publication no public exploitation of this security vulnerability was known.


Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem which results in a stack buffer overflow and likely code execution.


The set_ipv6() function in zscan_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv6 address in zone data.


A vulnerability in the FTP application layer gateway (ALG) functionality used by Network Address Translation (NAT) NAT IPv6 to IPv4 (NAT64) and the Zone-Based Policy Firewall (ZBFW) in Cisco IOS XE Software could allow an unauthenticated remote attacker to cause an affected device to reload. The vulnerability is due to a buffer overflow that occurs when an affected device inspects certain FTP traffic. An attacker could exploit this vulnerability by performing a specific FTP transfer through the device. A successful exploit could allow the attacker to cause the device to reload.


A

Buffer

Overflow

exists

in

Citrix

NetScaler

Gateway

before

before

before

and

before

and

Citrix

Application

Delivery

Controller

before

before

before

and

before


Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.


apps/gsudo.c in gsudo in ToaruOS through 1.10.9 has a buffer overflow allowing local privilege escalation to the root user via the DISPLAY environment variable.


An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.


Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.


Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.


Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.


An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.


An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.


Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2 Cam v2 Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.


Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.


Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability caused by improper bounds checking during the parsing of crafted ISO archive file format. By persuading a victim to open a specially-crafted ISO archive file an attacker could execution arbitrary code.


An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges). It is possible to perform a buffer overflow via a crafted file.


An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.


Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3 13.27.0 15.7.2 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.


An

issue

was

discovered

in

GPAC

There

is

a

heap-based

buffer

overflow

in

the

function

ReadGF_IPMPX_RemoveToolNotificationListener

in

in

libgpac.a

as

demonstrated

by


An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer leading to a heap-based buffer overflow with user controlled data.


GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension.


Buffer

overflow

during

SIB

read

when

network

configures

complete

sib

list

along

with

first

and

last

segment

of

other

SIB

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.


A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.


Possible

buffer

overflow

issue

due

to

lack

of

length

check

when

parsing

the

extended

cap

IE

header

length

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Buffer

overflow

can

occur

in

wlan

module

if

supported

rates

or

extended

rates

element

length

is

greater

than

max

rate

set

length

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

in

Nicobar


While

processing

MT

Secondary

PDP

request

Buffer

overflow

will

happen

due

to

incorrect

calculation

of

buffer

size

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto Snapdragon Mobile Snapdragon Wearables in MDM9607 MSM8909W Qualcomm 215 SD 210/SD 212/SD 205 SD 425 SD 439 / SD 429 SD 450 SD 625 SD 632 SDM439


Buffer

overflow

can

occur

when

processing

non

standard

SDP

video

Image

attribute

parameter

in

a

VILTE\\VOLTE

call

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


Missing

length

check

before

copying

the

data

from

kernel

space

to

userspace

through

the

copy

function

can

lead

to

buffer

overflow

in

some

cases

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell

Saipan


Lack

of

check

of

data

truncation

on

user

supplied

data

in

kernel

leads

to

buffer

overflow

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


An issue was discovered in D-Link DIR-806 devices. There is a stack-based buffer overflow in function hnap_main at /htdocs/cgibin. The function will call sprintf without checking the length of strings in parameters given by HTTP header and can be controlled by users. And it finally leads to a stack-based buffer overflow via a special HTTP header.


Filling

media

attribute

tag

names

without

validating

the

destination

buffer

size

which

can

result

in

the

buffer

overflow

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


Buffer

overflow

scenario

if

the

client

sends

more

than

requests

to

the

server

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Buffer

overflow

can

occur

in

WLAN

firmware

while

parsing

frames

during

roaming

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.


The Netskope client service v57 before 57.2.0.219 and v60 before 60.2.0.214 running with NT\\SYSTEM privilege accepts network connections from localhost. The connection handling function in this service suffers from a stack based buffer overflow in \doHandshakefromServer\ function. Local users can use this vulnerability to trigger a crash of the service and potentially cause additional impact on the system.


Buffer

overflow

can

occur

while

processing

clip

due

to

lack

of

check

of

object

size

before

parsing

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Lack

of

checking

a

variable

received

from

driver

and

populating

in

Firmware

data

structure

leads

to

buffer

overflow

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdragon Auto Snapdragon Compute Snapdragon Consumer Electronics Connectivity Snapdragon Industrial IOT Snapdragon Mobile in APQ8096AU MSM8996AU QCA6574AU QCN7605 Rennell SC8180X SDM710 SDX55 SM7150 SM8150 SM8250 SXR2130


While

playing

the

clip

which

is

nonstandard

buffer

overflow

can

occur

while

parsing

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Stack

buffer

overflow

due

to

instance

id

is

misplaced

inside

definition

of

hardware

accelerated

effects

in

makefile

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Mobile

in


In Apache HTTP Server 2.4.32-2.4.39 when mod_remoteip was configured to use a trusted intermediary proxy server using the \PROXY\ protocol a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.


Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in IPQ8074 MSM8996AU QCA6174A QCA6574AU QCA8081 QCA9377 QCA9379 QCS404 QCS405 QCS605 SD 636 SD 665 SD 675 SD 712 / SD 710 / SD 670 SD 730 SD 820 SD 835 SD 845 / SD 850 SD 855 SD 8CX SDA660 SDM630 SDM660 SXR1130


pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open as used in Inside Secure TLS Toolkit has a stack-based buffer overflow during X.509 certificate verification because of missing validation in psRsaDecryptPubExt in crypto/pubkey/rsa_pub.c.


Buffer

overflow

can

occur

due

to

usage

of

wrong

datatype

and

missing

length

check

before

copying

into

buffer

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The attack vector is: Send a specific MMS protocol packet.


NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846 CVE-2018-3847 CVE-2018-3848 and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.


** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \this is being treated as a non-security bug and no real threat.\


Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.


GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service Memory Disclosure and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.


Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv0 to an insane length with execl. The fixed version is: There's no fix yet.


A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.


gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.


In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 8.3RX before 8.3R7.1 8.2RX before 8.2R12.1 and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 5.4RX before 5.4R7.1 5.3RX before 5.3R12.1 5.2RX before 5.2R12.1 and 5.1RX before 5.1R15.1 an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow.


system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp function. Attackers can exploit the vulnerability by using the languse parameter with a long string. This affects 1.2.2 build 28 64 65 and 68.


A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.


dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.


An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in librec.a.


Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension resulting in a buffer overflow.


A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.


An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.


A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotely run arbitrary code by sending a special RTSP over HTTP packet. The vulnerability was found in many cameras using hisilicon's hardware and software as demonstrated by TENVIS cameras 1.3.3.3 1.2.7.2 1.2.1.4 7.1.20.1.2 and 13.1.1.1.7.2; FDT FD7902 11.3.14.1.3 and 10.3.14.1.3; FOSCAM cameras 3.2.1.1.1_0815 and 3.2.2.2.1_0815; and Dericam cameras V11.3.8.1.12.


An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in librec.a.


An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base specifically within tftpd_file.c tftp_file.c tftpd_mtftp.c and tftp_mtftp.c.


apply.cgi on the TRENDnet TEW-632BRP 1.010B32 router has a buffer overflow via long strings to the SOAPACTION:HNAP1 interface.


An

issue

was

discovered

on

TRENDnet

and

devices.

A

buffer

overflow

occurs

through

the

parameter.


BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.


A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0 4.9.5 4.9.4 that may allow code execution as root.


A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.


An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. Extended Inquiry Responses (EIRs) are improperly handled which causes a heap-based buffer overflow during device inquiry. This overflow can be used to overwrite existing functions with arbitrary code. The Reserved for Future Use (RFU) bits are not discarded by eir_handleRx() and are included in an EIR's length. Therefore one can exceed the expected 240 bytes which leads to a heap-based buffer overflow in eir_getReceivedEIR() called by bthci_event_SendInquiryResultEvent(). In order to exploit this bug an attacker must repeatedly connect to the victim's device in a short amount of time from different source addresses. This will cause the victim's Bluetooth stack to resolve the device names and therefore allocate buffers with attacker-controlled data. Due to the heap corruption the name will be eventually written to an attacker-controlled location leading to a write-what-where condition.


The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7 Firefox < 67 and Firefox ESR < 60.7.


ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.


TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function which can potentially result code execution. This attack appear to be exploitable via network connectivity.


An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp.


TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler which can potentially result code execution.. This attack appear to be exploitable via network connectivity.


Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.


Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy.


hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation leading to a buffer overflow involving the PCIe extended config space.


FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.


An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4 cast to uint32. If ld->buffer_size - words*4 is negative a buffer overflow is later performed via getdword_n(&ld->startwords ld->bytes_left).


An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.


Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy.


filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size triggering a heap-based buffer overflow that can lead to root access by a local Linux user.


Possible buffer overflow while processing clientlog and serverlog due to lack of validation of data received in logs in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Mobile in APQ8096AU QCS605 SDM439 SM8150 SXR1130


Buffer

overflow

can

occur

in

function

wlan

firmware

while

copying

association

frame

content

if

frame

length

is

more

than

the

maximum

buffer

size

in

case

of

SAP

mode

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.


Buffer

overflow

due

to

lack

of

upper

bound

check

on

channel

length

which

is

used

for

a

loop.

in

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


Buffer

overflow

in

WLAN

firmware

while

parsing

GTK

IE

containing

GTK

key

having

length

more

than

the

buffer

size

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply.


Buffer

overflow

occur

while

playing

the

clip

which

is

nonstandard

due

to

lack

of

offset

length

check

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


Buffer

overflow

occurs

while

processing

LMP

packet

in

which

name

length

parameter

exceeds

value

specified

in

BT-specification

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell

Saipan


An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c a different vulnerability than CVE-2019-14465.


AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp.


Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.


SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow


Possible buffer overflow issue in error processing due to improper validation of array index value in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in APQ8064 APQ8096AU IPQ4019 IPQ8064 IPQ8074 MDM9607 MDM9615 MDM9640 MSM8996AU QCN7605


Out-of-bound

writes

occurs

due

to

lack

of

check

of

buffer

size

will

cause

buffer

overflow

only

in

architecture.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file.


Possible buffer overflow while handling NAN reception of NMF in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in IPQ6018 IPQ8074 Nicobar QCA6390 QCA8081 QCN7605 QCS404 QCS405 Rennell SC7180 SC8180X SM6150 SM7150 SM8150 SXR2130


XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow.


Heap

buffer

overflow

can

occur

while

parsing

invalid

MKV

clip

which

is

not

standard

and

have

invalid

vorbis

codec

data

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


A flaw was found with the RHSA-2019:3950 erratum where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages SDL versions through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow flaw while copying an existing surface into a new optimized one due to a lack of validation while loading a BMP image is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw which could allow an attacker to make the application crash or execute code.


Possible

buffer

overflow

in

WLAN

WMI

handler

due

to

lack

of

ssid

length

check

when

copying

data

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


A buffer overflow flaw was found in versions from 2.6.34 to 5.2.x in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway could use this flaw to increase their privileges on the host.


Possible

buffer

overflow

in

data

offload

handler

due

to

lack

of

check

of

keydata

length

when

copying

data

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply.


Buffer

overflow

occur

while

playing

the

clip

which

is

nonstandard

due

to

lack

of

check

of

size

duration

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp.


ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.


Buffer

overflow

can

occur

in

In

WLAN

firmware

while

unwraping

data

using

CCMP

cipher

suite

during

parsing

of

EAPOL

handshake

frame

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


A

stack-based

buffer

overflow

exists

in

the

initialization

of

the

identification

stage

due

to

lack

of

check

on

the

number

of

templates

provided.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.


An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply.


Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-trustable in Snapdragon Auto Snapdragon Compute Snapdragon Mobile Snapdragon Wired Infrastructure and Networking in Kamorta QCS404 Rennell SC7180 SDX55 SM6150 SM7150 SM8250 SXR2130


LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.


ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.


Buffer

overflow

occurs

while

processing

an

subsample

data

length

out

of

range

due

to

lack

of

user

input

validation

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Kamorta

Nicobar

Rennell


Potential

buffer

overflow

while

processing

CBF

frames

due

to

lack

of

check

of

buffer

length

before

copy

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile in Nicobar SDM670 SDM710 SDM845 SM6150 SM8150 SM8250 SXR2130


An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply.


Possible

buffer

overflow

while

playing

mkv

clip

due

to

lack

of

validation

of

atom

size

buffer

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell

Saipan


An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply.


Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call.


SSDP Responder 1.x through 1.5 mishandles incoming network messages leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.


Buffer

overflow

occurs

while

processing

invalid

MKV

clip

which

has

invalid

EBML

size

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp.


Possible

buffer

overflow

in

WLAN

Parser

due

to

lack

of

length

check

when

copying

data

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


Buffer

overflows

while

decoding

setup

message

from

Network

due

to

lack

of

check

of

IE

message

length

received

from

network

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Kamorta

Nicobar

Rennell


Buffer

overflow

can

occur

while

parsing

RSN

IE

containing

list

of

PMK

ID`s

which

are

more

than

the

buffer

size

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar


An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAP_AUTH HTTP header.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the z dimension.


An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment processing in the face of truncated fragments in os/net/ipv6/sicslowpan.c. This results in accesses of unmapped memory crashing the application. An attacker can cause a denial-of-service via a crafted 6LoWPAN frame.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow problem in the function ReadNextCell() in mat5.c.


** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink which currently cannot happen: \This issue allows theoretical compromise of security but a practical attack is usually impossible.\


A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker (without Administrator privileges) to escalate privileges or crash the machine by loading an image such as a DLL with a long path.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.


DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow in the function InflateVarName() in inflate.c when called from ReadNextCell in mat5.c.


process_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow via a crafted TLS certificate handshake message with zero certificates.


Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1 Firefox ESR < 60.6.1 and Thunderbird < 60.6.1.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow in the function ReadNextFunctionHandle() in mat5.c.


In PuTTY versions before 0.71 on Unix a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the y dimension.


An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.


Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX IPC-HDW1XXX IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information which can not be used by product basic functions. After an attacker logs in locally this vulnerability can be exploited to cause device restart or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing process so it has gradually deleted this function which is no longer available in the newer devices and softwares. Dahua has released versions of the affected products to fix the vulnerability.


In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6 the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values.


The British Airways Entertainment System as installed on Boeing 777-36N(ER) and possibly other aircraft does not prevent the USB charging/data-transfer feature from interacting with USB keyboard and mouse devices which allows physically proximate attackers to conduct unanticipated attacks against Entertainment applications as demonstrated by using mouse copy-and-paste actions to trigger a Chat buffer overflow or possibly have unspecified other impact.


The specific fields of CGI interface of some Dahua products are not strictly verified an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X IPC-HFW1X2X IPC-HDW2X2X IPC-HFW2X2X IPC-HDW4X2X IPC-HFW4X2X IPC-HDBW4X2X IPC-HDW5X2X IPC-HFW5X2X for versions which Build time is before August 18 2019.


Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).


An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature scheme.


ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.


CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow.


File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer overflow in an HTTP POST parameter a similar issue to CVE-2010-2330 and CVE-2010-2331.


In XS 9.0.0 in Moddable SDK OS180329 there is a heap-based buffer overflow in fxBeginHost in xsAPI.c when called from fxRunDefine in xsRun.c as demonstrated by crafted JavaScript code to xst.


An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head leading to a buffer overflow.


Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2).


BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message where two of the overflow bytes are attacker-controlled and two are fixed.


process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.


In TensorFlow before 1.15 a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.


ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.


A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below 6.2.2 and below and FortiProxy 1.0.x 1.1.x 1.2.9 and below 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution.


A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under root priviledge crashes via sending specially crafted \StartAvCustomScan\ type IPC client requests to the fctsched process due the argv data not been well sanitized.


The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L2CAP payload length allowing attackers in radio range to cause a buffer overflow via a crafted Link Layer packet.


A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system.


In libopenmpt before 0.3.19 and 0.4.x before 0.4.9 ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API leading to a buffer overflow.


in

in

the

Linux

kernel

through

lacks

a

certain

upper-bound

check

leading

to

a

buffer

overflow.


The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 1.0.14.1081 for DA1468x devices responds to link layer packets with a payload length larger than expected allowing attackers in radio range to cause a buffer overflow via a crafted packet. This affects for example August Smart Lock.


A

buffer

overflow

vulnerability

has

been

found

in

the

baremetal

component

of

Apache

CloudStack.

This

applies

to

all

versions

prior

to

The

vulnerability

is

due

to

the

lack

of

validation

of

the

mac

parameter

in

baremetal

virtual

router.

If

you

insert

an

arbitrary

shell

command

into

the

mac

parameter

v-router

will

process

the

command.

For

example:

Normal:

Abnormal:

Mitigation

of

this

issue

is

an

upgrade

to

Apache

CloudStack

or

beyond.


LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize) affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \only a few specific / uncommon usages of the API are at risk.\


A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code execution on the device. This issue affects: Belkin WeMo Insight Switch firmware version 2.00.11396 and prior versions.


The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks cause anomalous behavior in the BLE state machine or trigger a buffer overflow via a crafted BLE Link Layer frame.


FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.


In Network Security Services (NSS) before 3.46 several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.


The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks cause anomalous behavior in the BLE state machine or trigger a buffer overflow via a crafted BLE Link Layer frame.


Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer as well as by the 0xFF delimiter byte. Inside each while loop the check of the value of *packet_data_pptr is not strictly enforced. More specifically inside a loop *packet_data_pptr could be increased and then dereferenced without checking. Moreover there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows depending on how the CoAP packet buffer is allocated.


The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length allowing attackers in radio range to cause a buffer overflow via a crafted packet.


RIOT

RIOT-OS

version

after

commit

contains

a

Buffer

Overflow

vulnerability

in

an

implementation

of

the

DNS

protocol

utilizing

the

RIOT

sock

API

that

can

result

in

Remote

code

executing.

This

attack

appears

to

be

exploitable

via

network

connectivity.


An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded such that it can lead to write access outside of the statically declared array aka a stack-based buffer overflow.


UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1199.


tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged.


UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler which can potentially result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.


Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary code execution


A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2 Security Update 2019-002 Mojave and Security Update 2019-007 High Sierra. In certain configurations a remote attacker may be able to submit arbitrary print jobs.


UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.


A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c) which also allocates the response buffer.


TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function which can potentially result code execution. This attack appear to be exploitable via network connectivity.


In Signiant Manager+Agents before 13.5 the implementation of the set command has a Buffer Overflow.


UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204.


A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15 tvOS 13 iTunes for Windows 12.10.1 iCloud for Windows 10.7 iCloud for Windows 7.14. Processing a maliciously crafted text file may lead to arbitrary code execution.


UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.


Buffer overflow in Hancom Office 2010 SE allows remote attackers to execute arbitrary via a long string in the Text attribute in a TEXTART XML element in an HML file.


Belkin n750 routers have a buffer overflow.


Buffer overflow in the Interstage HTTP Server log functionality as used in Fujitsu Interstage Application Server 9.0.0 9.1.0 9.2.0 9.3.1 and 10.0.0; and Interstage Studio 9.0.0 9.1.0 9.2.0 and 10.0.0 has unspecified impact and attack vectors related to \ihsrlog/rotatelogs.\


ClamAV before 0.97.7 has buffer overflow in the libclamav component


The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header which triggers a buffer overflow.


Multiple

stack-based

buffer

overflows

in

the

MSM

camera

driver

for

the

Linux

kernel

as

used

in

Qualcomm

Innovation

Center

(QuIC)

Android

contributions

for

MSM

devices

and

other

products

allow

attackers

to

gain

privileges

via

a

crafted

ioctl

call

related

to

or

a

crafted

ioctl

call

related

to


Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10 1.2x before 1.21.4 and 1.22.x before 1.22.1 has unspecified impact and remote vectors.


Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33 when CONFIG_IP_VS is used allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call related to the do_ip_vs_get_ctl function or (2) a setsockopt system call related to the do_ip_vs_set_ctl function.


FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability


The JavaScript engine in Mozilla Firefox before 25.0 Firefox ESR 17.x before 17.0.10 and 24.x before 24.1 Thunderbird before 24.1 Thunderbird ESR 17.x before 17.0.10 and SeaMonkey before 2.22 does not properly allocate memory for unspecified functions which allows remote attackers to conduct buffer overflow attacks via a crafted web page.


Buffer overflow in Gretech GOM Media Player before 2.2.53.5169 has unspecified impact and attack vectors.


X.org libXi 1.7.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to an unexpected sign extension in the XListInputDevices function.


Stack-based buffer overflow in maintenanceservice.exe in the Mozilla Maintenance Service in Mozilla Firefox before 23.0 Firefox ESR 17.x before 17.0.8 Thunderbird before 17.0.8 and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line.


Stack-based buffer overflow in Mozilla Updater in Mozilla Firefox before 23.0 Firefox ESR 17.x before 17.0.8 Thunderbird before 17.0.8 and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line to the Mozilla Maintenance Service.


Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory aka \Win32k Buffer Overflow Vulnerability.\


X.org libFS 1.0.4 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to an unexpected sign extension in the FSOpenServer function.


Buffer overflow in yaSSL as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30 has unspecified impact and attack vectors a different vulnerability than CVE-2012-0553.


Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters a different vulnerability than CVE-2013-0393. NOTE: the previous information was obtained from the January 2013 CPU. Oracle has not commented on claims from an independent researcher that this is a heap-based buffer overflow in the Paradox database stream filter (vspdx.dll) that can be triggered using a table header with a crafted \number of fields\ value.


Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument.


Buffer overflow in dsmtca in IBM Tivoli Storage Manager (TSM) through 5.5.4.0 6.1.0 through 6.1.5.4 6.2.0 through 6.2.4.7 and 6.3.0 through 6.3.0.17 on UNIX and Linux allows local users to gain privileges via unspecified vectors.


MiniDLNA has heap-based buffer overflow


Buffer overflow in MedCoreD.sys in AhnLab V3 Internet Security 8.0.7.5 (Build 1373) allows local users to gain privileges via a crafted 0xA3350014 IOCTL call.


Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory aka \Win32k Buffer Overwrite Vulnerability.\


Buffer overflow in Dell BIOS on Dell Latitude D### E#### XT2 and Z600 devices and Dell Precision M#### devices allows local users to bypass intended BIOS signing requirements and install arbitrary BIOS images by leveraging administrative privileges and providing a crafted rbu_packet.pktNum value in conjunction with a crafted rbu_packet.pktSize value.


XMP Toolkit SDK version 2020.1 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.


An issue was discovered in libredwg through v0.10.1.3751. bit_read_fixed() in bits.c has a heap-based buffer overflow.


IBM i2 Analyst's Notebook 9.2.0 9.2.1 and 9.2.2 is vulnerable to a stack-based buffer overflow caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 214440.


An issue was discovered in libslax through v0.22.1. slaxLexer() in slaxlexer.c has a stack-based buffer overflow.


An issue was discovered in libjpeg through 2020021. LineBuffer::FetchRegion() in linebuffer.cpp has a heap-based buffer overflow.


The screen lock module has a Stack-based Buffer Overflow vulnerability.Successful exploitation of this vulnerability may affect user experience.


An issue was discovered in libslax through v0.22.1. slaxIsCommentStart() in slaxlexer.c has a heap-based buffer overflow.


An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2nlen() in bits.c has a heap-based buffer overflow.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in sela through 20200412. file::WavFile::readFromFile() in wav_file.c has a heap-based buffer overflow.


IBM i2 Analyst's Notebook 9.2.0 9.2.1 and 9.2.2 is vulnerable to a stack-based buffer overflow caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 214439.


An issue was discovered in sela through 20200412. rice::RiceDecoder::process() in rice_decoder.cpp has a heap-based buffer overflow.


An issue was discovered in libxsmm through v1.16.1-93. The JIT code has a heap-based buffer overflow.


There is a Heap-based buffer overflow vulnerability with the NFC module in smartphones. Successful exploitation of this vulnerability may cause memory overflow.


An issue was discovered in sela through 20200412. file::SelaFile::readFromFile() in sela_file.cpp has a heap-based buffer overflow.


An issue was discovered in sela through 20200412. file::WavFile::writeToFile() in wav_file.c has a heap-based buffer overflow.


An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2len() in bits.c has a heap-based buffer overflow.


An issue was discovered in libredwg through v0.10.1.3751. appinfo_private() in decode.c has a heap-based buffer overflow.


Certain HP Enterprise LaserJet HP LaserJet Managed HP Enterprise PageWide HP PageWide Managed products may be vulnerable to potential buffer overflow.


Adobe

svg-native-viewer

and

earlier

versions

are

affected

by

a

heap

buffer

overflow

vulnerability

due

to

insecure

handling

of

a

malicious

.svg

file

potentially

resulting

in

arbitrary

code

execution

in

the

context

of

the

current

user.

User

interaction

is

required

to

exploit

this

vulnerability.


An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.


An issue was discovered in libslax through v0.22.1. slaxLexer() in slaxlexer.c has a heap-based buffer overflow.


An issue was discovered in sela through 20200412. file::SelaFile::readFromFile() in sela_file.c has a heap-based buffer overflow.


The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic Induction) protocol.


Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.


Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process.


NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback().


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


All versions of GurumDDS improperly calculate the size to be used when allocating the buffer which may result in a buffer overflow.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.)


Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function.


FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code.


NXP

MCUXpresso

SDK

was

discovered

to

contain

a

buffer

overflow

in

the

function

USB_HostParseDeviceConfigurationDescriptor().


NETGEAR R6400 devices before 1.0.1.52 are affected by a stack-based buffer overflow by an authenticated user.


Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX35 before 1.0.3.94 RAX38 before 1.0.3.94 and RAX40 before 1.0.3.94.


NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.


Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to remotely execute code.


Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module when GOARCH=wasm GOOS=js is used.


Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.


** UNSUPPORTED WHEN ASSIGNED ** Polipo through 1.1.1 when NDEBUG is used allows a heap-based buffer overflow during parsing of a Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer which may result in a buffer overflow.


NETGEAR R6400 devices before 1.0.1.70 are affected by a stack-based buffer overflow by an authenticated user.


A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c.


LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.


Adobe After Effects version 18.2 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe After Effects version 18.2 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


SerenityOS

fixed

as

of

contains

a

buffer

overflow

vulnerability

in

LibTextCode

through

opening

a

crafted

file.


Adobe Animate version 21.0.6 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8 the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\\0' termination aka CID-cc7a0bb058b8.


A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.


Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Heap-based Buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.)


Adobe Bridge version 11.0.2 (and earlier) are affected by a Heap-based Buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Heap-based buffer overflow vulnerability in the PDFLibTool component. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

is

vulnerable

to

a

heap

buffer

overflow.

The

fails

to

validate

that

indices

used

to

access

elements

of

input/output

arrays

are

valid.

Whereas

accesses

to

are

guarded

by

`FastBoundsCheck`

the

indexing

in

can

result

in

OOB

access.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

heap

buffer

overflow

in

`QuantizedReshape`

by

passing

in

invalid

thresholds

for

the

quantization.

This

is

because

the

assumes

that

the

arguments

are

always

valid

scalars

and

tries

to

access

the

numeric

value

directly.

However

if

any

of

these

tensors

is

empty

then

`.flat<T>()`

is

an

empty

buffer

and

accessing

the

element

at

position

results

in

overflow.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

heap

buffer

overflow

to

occur

in

This

is

because

the

computes

the

size

of

the

filter

tensor

but

does

not

validate

that

it

matches

the

number

of

elements

in

Later

when

reading/writing

to

this

buffer

code

uses

the

value

computed

here

instead

of

the

number

of

elements

in

the

tensor.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader ArcGIS Desktop ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

heap

buffer

overflow

in

This

is

because

the

accesses

an

array

element

based

on

a

user

controlled

offset.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

If

the

`splits`

argument

of

`RaggedBincount`

does

not

specify

a

valid

then

an

attacker

can

trigger

a

heap

buffer

overflow.

This

will

cause

a

read

from

outside

the

bounds

of

the

`splits`

tensor

buffer

in

the

implementation

of

the

`RaggedBincount`

Before

the

`for`

loop

is

set

to

The

user

controls

the

`splits`

array

making

it

contain

only

one

element

Thus

the

code

in

the

`while`

loop

would

increment

and

then

try

to

read

which

is

outside

of

bounds.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

and

TensorFlow

as

these

are

also

affected.


Multiple buffer overflow security vulnerabilities have been identified in HPE iLO Amplifier Pack version(s): Prior to 2.12. These vulnerabilities could be exploited by a highly privileged user to remotely execute code that could lead to a loss of confidentiality integrity and availability. HPE has provided a software update to resolve this vulnerability in HPE iLO Amplifier Pack.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

heap

buffer

overflow

in

This

is

because

the

uses

the

same

index

to

access

two

arrays

in

parallel.

Since

the

user

controls

the

shape

of

the

input

arguments

an

attacker

could

trigger

a

heap

OOB

access

when

is

shorter

than

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata which is a less frequently used Exiv2 operation than _reading_ the metadata. For example to trigger the bug in the Exiv2 command-line application you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.