Heap-based buffer overflow in Adobe Reader and Acrobat 8.x before 8.3.1 9.x before 9.4.6 and 10.x before 10.1.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2433 and CVE-2011-2437.


Heap-based buffer overflow in qcpfformat.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted QCP file.

buffer overflow
arbitrary code execution


Heap-based buffer overflow in the image-parsing library in Adobe Reader and Acrobat 8.x before 8.3.1 9.x before 9.4.6 and 10.x before 10.1.1 allows attackers to execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted SIPR stream.


Heap-based buffer overflow in Adobe Reader and Acrobat 8.x before 8.3.1 9.x before 9.4.6 and 10.x before 10.1.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2434 and CVE-2011-2437.


Heap-based buffer overflow in Adobe Reader and Acrobat 8.x before 8.3.1 9.x before 9.4.6 and 10.x before 10.1.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2433 and CVE-2011-2434.


Stack-based buffer overflow in the Lotus Word Pro import filter in LibreOffice before 3.3.3 allows remote attackers to execute arbitrary code via a crafted .lwp file.


Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.


Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote attackers to execute arbitrary code via a long second argument to the ValidateUser method.


Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OES2) SP3 allows remote attackers to execute arbitrary code via a long (1) hostname or (2) port field.


Stack-based buffer overflow in Iceni Argus 6.20 and earlier and Infix 5.04 allows remote attackers to execute arbitrary code via a crafted PDF document that uses flate compression.


Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.


Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command as demonstrated using (1) GETLIST or (2) GETFILE in a ScriptFTP script.


Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted profile-time parameter in a printer-url.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_INTEGUTIL message.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed GET_FILE message.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed bm message.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted core-package parameter in a printer-url.


Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted op-printer-list-all-jobs cookie.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted uri parameter in a printer-url.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted profile-name parameter in a printer-url.


Stack-based buffer overflow in assr.dll in Autonomy KeyView as used in IBM Lotus Notes before 8.5.2 FP3 allows remote attackers to execute arbitrary code via crafted tag data in an Applix spreadsheet attachment aka SPR PRAD8823A7.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_SCRIPT message.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_BAR message.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed omniiaputil message.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url.


Stack-based buffer overflow in oninit in IBM Informix Dynamic Server (IDS) 11.50 allows remote attackers to execute arbitrary code via crafted arguments in the USELASTCOMMITTED session environment option in a SQL SET ENVIRONMENT statement.


Stack-based buffer overflow in the logging functionality in dbman.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via vectors related to a received action.


Heap-based buffer overflow in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors.


Stack-based buffer overflow in img.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a crafted length field in a packet.


Stack-based buffer overflow in rtfsr.dll in Autonomy KeyView as used in IBM Lotus Notes before 8.5.2 FP3 allows remote attackers to execute arbitrary code via a crafted link in a .rtf attachment aka SPR PRAD8823JQ.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted driver-version parameter in a printer-url.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed stutil message.


Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted op-printer-list-all-jobs parameter in a printer-url.


Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted file-date-time parameter in a printer-url.


Stack-based buffer overflow in mw8sr.dll in Autonomy KeyView as used in IBM Lotus Notes before 8.5.2 FP3 allows remote attackers to execute arbitrary code via a crafted link in a Microsoft Office document attachment aka SPR PRAD8823ND.


Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00 6.10 and 6.11 allows remote attackers to execute arbitrary code via a malformed HPFGConfig message.


Heap-based buffer overflow in xlssr.dll in Autonomy KeyView as used in IBM Lotus Notes before 8.5.2 FP3 allows remote attackers to execute arbitrary code via a malformed BIFF record in a .xls Excel spreadsheet attachment aka SPR PRAD8E3HKR.


Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1 4.1 4.1.1 and 4.3.1 allows remote authenticated users to execute arbitrary code via a long opts field.


Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted iprint-client-config-info parameter in a printer-url.


Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute arbitrary code via a crafted S3M file.


Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers to execute arbitrary code via a crafted .pcap file.


Stack-based buffer overflow in tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allows remote attackers to execute arbitrary code via a long mode field.


Stack-based buffer overflow in the SMTP service in IBM Lotus Domino allows remote attackers to execute arbitrary code via long arguments in a filename parameter in a malformed MIME e-mail message aka SPR KLYH889M8H.


Heap-based buffer overflow in HistorySvr.exe in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a long request to TCP port 777.


Stack-based buffer overflow in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a long HTTP request for a .css file.


Stack-based buffer overflow in NFRAgent.exe in Novell File Reporter (NFR) before 1.0.2 allows remote attackers to execute arbitrary code via unspecified XML data.


Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long line in a .mamx file.


Stack-based buffer overflow in ovutil.dll in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long COOKIE variable.


Stack-based buffer overflow in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP getEnvironmentString request related to the local variable cache.


Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code via a document that contains a crafted embedded OpenType font.


Stack-based buffer overflow in the pdfmoz_onmouse function in apps/mozilla/moz_main.c in the MuPDF plug-in 2008.09.02 for Firefox allows remote attackers to execute arbitrary code via a crafted web site.


Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code via a crafted embedded TrueType font.


Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers to execute arbitrary code via a crafted login request.


Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url a different vulnerability than CVE-2011-1705.


Heap-based buffer overflow in the RealVideo renderer in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in lmadmin in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allows remote attackers to execute arbitrary code via a crafted 0x2f packet.


Stack-based buffer overflow in MPAUploader.dll in HP Managed Printing Administration before 2.6.4 allows remote attackers to execute arbitrary code via a long filename parameter in an uploadfile action to Default.asp.


Heap-based buffer overflow in nettransdll.dll in HistorySvr.exe (aka HistoryServer.exe) in WellinTech KingView 6.53 and 65.30.2010.18018 allows remote attackers to execute arbitrary code via a crafted op-code 3 packet.


Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier as used on the ABB AC500 PLC and possibly other products allows remote attackers to execute arbitrary code via a long URI to TCP port 8080.


Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attackers to execute arbitrary code via a long request to TCP port 4659.


Stack-based buffer overflow in the BCAAA component before build 60258 as used by Blue Coat ProxySG 4.2.3 through 6.1 and ProxyOne allows remote attackers to execute arbitrary code via a large packet to the synchronization port (16102/tcp).


Stack-based buffer overflow in StoryBoard Quick 6 Build 3786 and possibly StoryBoard Artist and StoryBoard Studio allows remote attackers to execute arbitrary code via a long string in the string element field in a frame xml file.


Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted \Rows Per Strip\ and \Samples Per Pixel\ values in a TIFF image file.


Stack-based buffer overflow in QQPlayer 3.2.845 allows remote attackers to execute arbitrary code via a crafted PnSize value in a MOV file.


Stack-based buffer overflow in GOM Player 2.1.33.5071 allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the \ref href\ tag. NOTE: this issue exists because of a CVE-2007-0707 regression.


Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514.


Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code via a long track name in an m3u playlist.


Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute arbitrary code via a crafted file name in a LIST command response.


Stack-based buffer overflow in Free MP3 CD Ripper 1.1 2.6 and earlier when converting a file allows user-assisted remote attackers to execute arbitrary code via a crafted .wav file.


Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request.


A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string as demonstrated by SMTP RCPT TO POP3 USER POP3 LIST POP3 TOP or POP3 RETR.


A buffer overflow in the SMTP response service in MailCarrier 2.51 allows the attacker to execute arbitrary code remotely via a long HELP command a related issue to CVE-2019-11395.


A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers a different vulnerability than CVE-2021-34170.


A buffer overflow in TenFour TFS Gateway SMTP mail server 3.2 allows an attacker to crash the mail server and possibly execute arbitrary code by offering more than 128 bytes in a MAIL FROM string.


Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center) all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50 allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters.


Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center) all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50 allows remote attackers to execute arbitrary code via malformed ASN.1 streams in V2C and similar input files.


A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long \Title name\ field in \mail box\ data that is mishandled in an \Open from mail box\ action.


Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


A buffer overflow in reggo.dll file used by Trend Micro InterScan VirusWall prior to 3.51 build 1349 for Windows NT 3.5 and InterScan WebManager 1.2 allows a local attacker to execute arbitrary code.


A buffer overflow in InterScan VirusWall 3.23 and 3.3 allows a remote attacker to execute arbitrary code by sending a long HELO command to the server.


A buffer overflow in Linux fetchmail before 5.8.6 allows remote attackers to execute arbitrary code via a large 'To:' field in an email header.


A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network.


A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP frames.


Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1. An attacker could craft a special map file to execute arbitrary code when the map file is loaded.


A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.


A buffer overflow vulnerability in Formats!ReadRAS_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.


A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x340 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.


A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa74 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.0xa74


A buffer overflow vulnerability in WPG+0x1dda of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted WPG file.


A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa30 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.


A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.


A

Buffer

Overflow

vulnerability

exists

in

TP-LINK

in

the

feature

which

allows

malicious

users

to

execute

arbitrary

code

on

the

system

via

a

crafted

post

request.


A

Buffer

Overflow

vulnerability

exists

in

TP-LINK

in

the

feature

which

allows

malicous

users

to

execute

arbitrary

code

on

the

system

via

a

crafted

post

request.


A

Buffer

Overflow

vulnerability

exists

in

TP-LINK

in

the

function

which

could

let

a

remove

malicious

user

execute

arbitrary

code

via

a

crafted

post

request.


A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/upgrade_info feature which allows malicious users to execute arbitrary code on the system via a crafted post request.


A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.


A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.


A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.


A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.


A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and earlier versions allows an attacker to potentially execute arbitrary code in the host windows operating system.


A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET request.


A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026 4.3.3.0378 build 20171117 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.


A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026 4.3.3.0378 build 20171117 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.


A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.


A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026 4.3.3.0378 build 20171117 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.


A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026 4.3.3.0378 build 20171117 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.


A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long response.


A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9124.


A buffer overflow vulnerability in the control protocol of Flexense SyncBreeze Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9121.


A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated remote attacker to execute arbitrary code.


A buffer overflow vulnerability in Code::Blocks 17.12 allows an attacker to execute arbitrary code via a crafted project file.


A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2 watchOS 5.1.3. An application may be able to execute arbitrary code with kernel privileges.


A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to execute arbitrary code with kernel privileges.


A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.1 Security Update 2021-008 Catalina macOS Big Sur 11.6.2. A malicious application may be able to execute arbitrary code with kernel privileges.


A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.1 Security Update 2021-008 Catalina macOS Big Sur 11.6.2. An application may be able to execute arbitrary code with kernel privileges.


Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 81024 RPC call.


Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained the vulnerability has been removed.


The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote authenticated attacker to /GponForm/usb_Form?script/. An attacker can leverage this vulnerability to potentially execute arbitrary code.


The Crestron AM-100 firmware 1.6.0.2 Crestron AM-101 firmware 2.7.0.1 Barco wePresent WiPG-1000P firmware 2.3.0.10 Barco wePresent WiPG-1600W before firmware 2.4.1.19 Extron ShareLink 200/250 firmware 2.0.3.4 Teq AV IT WIPS710 firmware 1.1.0.7 SHARP PN-L703WA firmware 1.4.2.3 Optoma WPS-Pro firmware 1.0.0.5 Blackbox HD WPS firmware 1.0.0.5 InFocus LiteShow3 firmware 1.0.16 and InFocus LiteShow4 2.0.0.7 are vulnerable to a stack buffer overflow in libAwgCgi.so's PARSERtoCHAR function. A remote unauthenticated attacker can use this vulnerability to execute arbitrary code as root via a crafted request to the return.cgi endpoint.


A

heap-based

buffer

overflow

in

in

in

GNOME

gThumb

before

and

Linux

Mint

Pix

before

allows

attackers

to

cause

a

crash

and

potentially

execute

arbitrary

code

via

a

crafted

JPEG

file.


Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.


Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.


In Fuji Electric V-Server 4.0.6 and prior several heap-based buffer overflows have been identified which may allow an attacker to remotely execute arbitrary code.


In Advantech DiagAnywhere Server Versions 3.07.11 and prior multiple stack-based buffer overflow vulnerabilities exist in the file transfer service listening on the TCP port. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code with the privileges of the user running DiagAnywhere Server.


Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so and download_mgr.cgi makes it possible to enter large-sized f_idx inputs.


Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest accounts) to remotely execute arbitrary code via a download_mgr.cgi stack-based buffer overflow.


Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4 Sagemcom F@st 3890 prior to 05.76.6.3f Sagemcom F@st 3686 3.428.0 Sagemcom F@st 3686 4.83.0 NETGEAR CG3700EMR 2.01.05 NETGEAR CG3700EMR 2.01.03 NETGEAR C6250EMR 2.01.05 NETGEAR C6250EMR 2.01.03 Technicolor TC7230 STEB 01.25 COMPAL 7284E 5.510.5.11 and COMPAL 7486E 5.510.5.11.


Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 is vulnerable to a stack-based buffer overflow caused by improper bounds checking by the \Wireless\ section in the web-UI. By sending a specially crafted hostname a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.


TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow caused by improper bounds checking by the ipAddrDispose function. By sending specially crafted ICMP echo request packets a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with elevated privileges.


Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier EOS-1D X MKII firmware version 1.1.6 and earlier EOS-1D C firmware version 1.4.1 and earlier EOS 5D MARK III firmware version 1.3.5 and earlier EOS 5D MARK IV firmware version 1.2.0 and earlier EOS 5DS firmware version 1.1.2 and earlier EOS 5DS R firmware version 1.1.2 and earlier EOS 6D firmware version 1.1.8 and earlier EOS 6D MARK II firmware version 1.0.4 and earlier EOS 7D MARK II firmware version 1.1.2 and earlier EOS 70 D firmware version 1.1.2 and earlier EOS 80 D firmware version 1.0.2 and earlier EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier EOS 9000D / EOS 77D firmware version 1.0.2 and earlier EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier EOS R firmware version 1.3.0 and earlier EOS RP firmware version 1.2.0 and earlier EOS RP GOLD firmware version 1.2.0 and earlier EOS M2 firmware version 1.0.3 and earlier EOS M3 firmware version 1.2.0 and earlier EOS M5 firmware version 1.0.1 and earlier EOS M6 firmware version 1.0.1 and earlier EOS M6(China) firmware version 5.0.0 and earlier EOS M10 firmware version 1.1.0 and earlier EOS M100 firmware version 1.0.0 and earlier EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier PowerShot SX70 HS firmware version 1.1.0 and earlier and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via sendhostinfo command.


Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier EOS-1D X MKII firmware version 1.1.6 and earlier EOS-1D C firmware version 1.4.1 and earlier EOS 5D MARK III firmware version 1.3.5 and earlier EOS 5D MARK IV firmware version 1.2.0 and earlier EOS 5DS firmware version 1.1.2 and earlier EOS 5DS R firmware version 1.1.2 and earlier EOS 6D firmware version 1.1.8 and earlier EOS 6D MARK II firmware version 1.0.4 and earlier EOS 7D MARK II firmware version 1.1.2 and earlier EOS 70 D firmware version 1.1.2 and earlier EOS 80 D firmware version 1.0.2 and earlier EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier EOS 9000D / EOS 77D firmware version 1.0.2 and earlier EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier EOS R firmware version 1.3.0 and earlier EOS RP firmware version 1.2.0 and earlier EOS RP GOLD firmware version 1.2.0 and earlier EOS M2 firmware version 1.0.3 and earlier EOS M3 firmware version 1.2.0 and earlier EOS M5 firmware version 1.0.1 and earlier EOS M6 firmware version 1.0.1 and earlier EOS M6(China) firmware version 5.0.0 and earlier EOS M10 firmware version 1.1.0 and earlier EOS M100 firmware version 1.0.0 and earlier EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier PowerShot SX70 HS firmware version 1.1.0 and earlier and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via setadapterbatteryreport command.


IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 is vulnerable to a buffer overflow caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 165481.


IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents are vulnerable to a stack-based buffer overflow caused by improper bounds checking by servers and storage agents in response to specifically crafted communication exchanges. By sending an overly long request a remote attacker could overflow a buffer and execute arbitrary code on the system with instance id privileges or cause the server or storage agent to crash. IBM X-Force ID: 157510.


Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier EOS-1D X MKII firmware version 1.1.6 and earlier EOS-1D C firmware version 1.4.1 and earlier EOS 5D MARK III firmware version 1.3.5 and earlier EOS 5D MARK IV firmware version 1.2.0 and earlier EOS 5DS firmware version 1.1.2 and earlier EOS 5DS R firmware version 1.1.2 and earlier EOS 6D firmware version 1.1.8 and earlier EOS 6D MARK II firmware version 1.0.4 and earlier EOS 7D MARK II firmware version 1.1.2 and earlier EOS 70 D firmware version 1.1.2 and earlier EOS 80 D firmware version 1.0.2 and earlier EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier EOS 9000D / EOS 77D firmware version 1.0.2 and earlier EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier EOS R firmware version 1.3.0 and earlier EOS RP firmware version 1.2.0 and earlier EOS RP GOLD firmware version 1.2.0 and earlier EOS M2 firmware version 1.0.3 and earlier EOS M3 firmware version 1.2.0 and earlier EOS M5 firmware version 1.0.1 and earlier EOS M6 firmware version 1.0.1 and earlier EOS M6(China) firmware version 5.0.0 and earlier EOS M10 firmware version 1.1.0 and earlier EOS M100 firmware version 1.0.0 and earlier EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier PowerShot SX70 HS firmware version 1.1.0 and earlier and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via blerequest command.


Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier EOS-1D X MKII firmware version 1.1.6 and earlier EOS-1D C firmware version 1.4.1 and earlier EOS 5D MARK III firmware version 1.3.5 and earlier EOS 5D MARK IV firmware version 1.2.0 and earlier EOS 5DS firmware version 1.1.2 and earlier EOS 5DS R firmware version 1.1.2 and earlier EOS 6D firmware version 1.1.8 and earlier EOS 6D MARK II firmware version 1.0.4 and earlier EOS 7D MARK II firmware version 1.1.2 and earlier EOS 70 D firmware version 1.1.2 and earlier EOS 80 D firmware version 1.0.2 and earlier EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier EOS 9000D / EOS 77D firmware version 1.0.2 and earlier EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier EOS R firmware version 1.3.0 and earlier EOS RP firmware version 1.2.0 and earlier EOS RP GOLD firmware version 1.2.0 and earlier EOS M2 firmware version 1.0.3 and earlier EOS M3 firmware version 1.2.0 and earlier EOS M5 firmware version 1.0.1 and earlier EOS M6 firmware version 1.0.1 and earlier EOS M6(China) firmware version 5.0.0 and earlier EOS M10 firmware version 1.1.0 and earlier EOS M100 firmware version 1.0.0 and earlier EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier PowerShot SX70 HS firmware version 1.1.0 and earlier and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via SendObjectInfo command.


Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier EOS-1D X MKII firmware version 1.1.6 and earlier EOS-1D C firmware version 1.4.1 and earlier EOS 5D MARK III firmware version 1.3.5 and earlier EOS 5D MARK IV firmware version 1.2.0 and earlier EOS 5DS firmware version 1.1.2 and earlier EOS 5DS R firmware version 1.1.2 and earlier EOS 6D firmware version 1.1.8 and earlier EOS 6D MARK II firmware version 1.0.4 and earlier EOS 7D MARK II firmware version 1.1.2 and earlier EOS 70 D firmware version 1.1.2 and earlier EOS 80 D firmware version 1.0.2 and earlier EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier EOS 9000D / EOS 77D firmware version 1.0.2 and earlier EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier EOS R firmware version 1.3.0 and earlier EOS RP firmware version 1.2.0 and earlier EOS RP GOLD firmware version 1.2.0 and earlier EOS M2 firmware version 1.0.3 and earlier EOS M3 firmware version 1.2.0 and earlier EOS M5 firmware version 1.0.1 and earlier EOS M6 firmware version 1.0.1 and earlier EOS M6(China) firmware version 5.0.0 and earlier EOS M10 firmware version 1.1.0 and earlier EOS M100 firmware version 1.0.0 and earlier EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier PowerShot SX70 HS firmware version 1.1.0 and earlier and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via notifybtstatus command.


Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device.


Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie of the web application that would allow an attacker to execute arbitrary code on the device.


TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for the setup wizard allowing an unauthenticated user to execute arbitrary code. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.


Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node.


Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a heap buffer overflow vulnerability as the IPP service did not parse attribute names properly. This would allow an attacker to execute arbitrary code on the device.


TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure to resolve a hostname during a ping or traceroute attempt. This allows an authenticated user to execute arbitrary code. The exploit can be exercised on the local intranet or remotely if remote administration is enabled.


Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print implementation that would allow an unauthenticated attacker to execute arbitrary code on the device. This was caused by an insecure handling of the register parameters because the size used within a memcpy() function which copied the action value into a local variable was not checked properly.


Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Content-Type HTTP Header of the web application that would allow an attacker to execute arbitrary code on the device.


TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow in the ssi binary. The overflow allows an unauthenticated user to execute arbitrary code by providing a sufficiently long query string when POSTing to any valid cgi txt asp or js file. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.


Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.


UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data due to a buffer overflow in a library. That leads remote attacker to execute arbitrary code via crafted https packets.


The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd the camera's web server. The overflow allows a remotely authenticated attacker to execute arbitrary code by providing a long string in the WEPEncryption parameter when requesting wireless.htm. Vulnerable devices include DCS-5009L (1.08.11 and below) DCS-5010L (1.14.09 and below) DCS-5020L (1.15.12 and below) DCS-5025L (1.03.07 and below) DCS-5030L (1.04.10 and below) DCS-930L (2.16.01 and below) DCS-931L (1.14.11 and below) DCS-932L (2.17.01 and below) DCS-933L (1.14.11 and below) and DCS-934L (1.05.04 and below).


Delta Industrial Automation CNCSoft CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.


The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execute arbitrary code via a long configuration key value. An attacker must be able to download files to the device in order to exploit this vulnerability.


Delta Electronics CNCSoft ScreenEditor Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.


PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.


Delta Industrial Automation CNCSoft CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack.


The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes a heap buffer overflow is triggered in wlc_wpa_sup_eapol. In the worst case scenario by sending specially-crafted WiFi packets a remote unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically this vulnerability will result in denial-of-service conditions.


The

Broadcom

brcmfmac

WiFi

driver

prior

to

commit

is

vulnerable

to

a

heap

buffer

overflow.

If

the

Wake-up

on

Wireless

LAN

functionality

is

configured

a

malicious

event

frame

can

be

constructed

to

trigger

an

heap

buffer

overflow

in

the

function.

This

vulnerability

can

be

exploited

with

compromised

chipsets

to

compromise

the

host

or

when

used

in

combination

with

can

be

used

remotely.

In

the

worst

case

scenario

by

sending

specially-crafted

WiFi

packets

a

remote

unauthenticated

attacker

may

be

able

to

execute

arbitrary

code

on

a

vulnerable

system.

More

typically

this

vulnerability

will

result

in

denial-of-service

conditions.


Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow allows remote attackers to execute arbitrary code.


The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario by sending specially-crafted WiFi packets a remote unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically this vulnerability will result in denial-of-service conditions.


Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI.


A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthenticated attackers to execute arbitrary code via the HTTP DELETE method a similar issue to CVE-2019-16724 and CVE-2010-2331.


NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying file name from an attacker controlled FTP server. That leads attacker to execute arbitrary code by sending a crafted filename.


A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6 Security Update 2019-004 High Sierra Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code.


Heap-based buffer overflow in paintlib as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap (BMP). NOTE: this issue was SPLIT from CVE-2013-3664 due to different affected products and codebases (ADT1).


Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long string in a .m3u file.


Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows and Mac RealPlayer before 12.0.1.1738 allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file a different issue than CVE-2013-6877.


Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie.


Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the SourcePath value in a .wcf file.


Buffer overflow in the flow daemon (flowd) in Juniper Junos 10.4 before 10.4S14 11.4 before 11.4R7-S2 12.1.X44 before 12.1X44-D15 12.1X45 before 12.1X45-D10 on SRX devices when using telnet pass-through authentication on the firewall might allow remote attackers to execute arbitrary code via a crafted telnet message.


Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the name attribute of the cols element in a .wstyle file.


Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows and Mac RealPlayer before 12.0.1.1738 allows remote attackers to execute arbitrary code via a long string in the TRACKID element of an RMP file a different vulnerability than CVE-2013-7260.


Buffer overflow in IrfanView before 4.37 when a multibyte-character directory name is used allows user-assisted remote attackers to execute arbitrary code via a crafted file that is incorrectly handled by the Thumbnail tooltips feature in the Thumbnails window.


Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.


Buffer overflow in iNotes in IBM Domino 8.5.3 before FP5 IF1 and 9.0 before IF4 allows remote authenticated users to execute arbitrary code via unspecified vectors aka SPR PTHN9ADPA8.


Buffer overflow in the PPP Access Concentrator (PPPAC) on the SEIL/x86 with firmware before 2.82 SEIL/X1 with firmware before 4.32 SEIL/X2 with firmware before 4.32 SEIL/B1 with firmware before 4.32 SEIL/Turbo with firmware before 2.16 and SEIL/neu 2FE Plus with firmware before 2.16 allows remote attackers to execute arbitrary code via a crafted L2TP message.


Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. This component is used on routers of multiple vendors including ASUS RT-AC66U and TRENDnet TEW-812DRU.


Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14 11.4 before 11.4R7 12.1 before 12.1R6 and 12.1X44 before 12.1X44-D15 on SRX devices when Captive Portal is enabled with the UAC enforcer role allows remote attackers to execute arbitrary code via crafted HTTP requests aka PR 849100.


Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision (2) nextprecision (3) function or (4) nextfunction value in a savevm image.


Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22 4.0.x before 4.0.13 and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.


Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.


Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.


Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level (2) gpio_level or (3) gpio_dir value in a savevm image.


Integer underflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a crafted JPEG tag that triggers a heap-based buffer overflow as demonstrated using a Canon RAW CR2 file with a large JPEG tag value and a small size.


Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.4.1 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters. NOTE: the previous information is from the October 2013 CPU. Oracle has not commented on claims from a third party that the issue is a stack-based buffer overflow in the Microsoft Access 1.x parser in vsacs.dll before 8.4.0.108 and before 8.4.1.52 which allows attackers to execute arbitrary code via a long field (aka column) name.


Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 and CVE-2013-1373.


Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0606 CVE-2013-0612 CVE-2013-0615 CVE-2013-0617 and CVE-2013-0621.


Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco Unified Computing System (UCS) 1.0 and 1.1 before 1.1(1j) and 1.2 before 1.2(1b) allows remote attackers to execute arbitrary code via malformed data in a UDP packet aka Bug ID CSCtd32371.


Stack-based buffer overflow in the nim: protocol handler in Novell GroupWise Messenger 2.04 and earlier and Novell Messenger 2.1.x and 2.2.x before 2.2.2 allows remote attackers to execute arbitrary code via an import command containing a long string in the filename parameter.


A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s 7.01 SR1 7.02 SP06 and 7.30 SP04 which could let a remote malicious user execute arbitrary code.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1365 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 and CVE-2013-1373.


Buffer overflow in secars.dll in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1.x before 12.1.3 and Symantec Endpoint Protection Center (SPC) Small Business Edition 12.0.x allows remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1365 CVE-2013-1366 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 and CVE-2013-1373.


stunnel 4.21 through 4.54 when CONNECT protocol negotiation and NTLM authentication are enabled does not correctly perform integer conversion which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 and CVE-2013-1372.


Buffer overflow in the SNMP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allows remote authenticated users to execute arbitrary code via a crafted SNMP request aka Bug ID CSCtx54822.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 and CVE-2013-1373.


Multiple buffer overflows in the (1) SNMP and (2) License Manager implementations in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allow remote authenticated users to execute arbitrary code via a crafted SNMP request aka Bug ID CSCtx54830.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1370 CVE-2013-1372 and CVE-2013-1373.


Heap-based buffer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X before 10.3.183.68 and 11.x before 11.2.202.275 on Linux before 11.1.111.44 on Android 2.x and 3.x and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.


Multiple

buffer

overflows

in

the

Cisco

Discovery

Protocol

(CDP)

implementation

in

Cisco

NX-OS

on

Nexus

devices

and

before

and

before

Nexus

and

devices

and

before

Nexus

devices

before

Nexus

devices

before

Nexus

devices

before

MDS

devices

and

before

Unified

Computing

System

(UCS)

and

devices

before

and

Connected

Grid

Router

(CGR)

devices

before

allow

remote

attackers

to

execute

arbitrary

code

via

malformed

CDP

packets

aka

Bug

IDs

and


Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitrary code via a long filename in a GET request.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 and CVE-2013-1373.


Buffer overflow in the nsFloatManager::GetFlowArea function in Mozilla Firefox before 24.0 Firefox ESR 17.x before 17.0.9 Thunderbird before 24.0 Thunderbird ESR 17.x before 17.0.9 and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via crafted use of lists and floats within a multi-column layout.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-0645 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1372 and CVE-2013-1373.


Buffer overflow in the Transaction MIB agent in IBM Tivoli Netcool System Service Monitors (SSM) and Application Service Monitors (ASM) 4.0.0 before FP14 allows remote attackers to execute arbitrary code via a SQL transaction with a long table name that is not properly handled by a packet decoder.


Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.0 SP2 3.5 3.5.1 4 and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages improper counting of objects during a memory copy operation aka \WinForms Buffer Overflow Vulnerability.\


Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0606 CVE-2013-0612 CVE-2013-0615 and CVE-2013-0621.


Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0 Firefox ESR 17.x before 17.0.3 Thunderbird before 17.0.3 Thunderbird ESR 17.x before 17.0.3 and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Kingsoft Writer 2007 and 2010 before 2724 allows remote attackers to execute arbitrary code via a crafted RTF document.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0642 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 and CVE-2013-1373.


Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0606 CVE-2013-0615 CVE-2013-0617 and CVE-2013-0621.


Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.


Buffer overflow in the broker service in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0612 CVE-2013-0615 CVE-2013-0617 and CVE-2013-0621.


Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X before 10.3.183.51 and 11.x before 11.2.202.262 on Linux before 11.1.111.32 on Android 2.x and 3.x and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code via crafted SWF content as exploited in the wild in February 2013.


Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2 3.0 SP2 3.5 3.5.1 4 and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a missing array-size check during a memory copy operation aka \S.DS.P Buffer Overflow Vulnerability.\


Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0 Firefox ESR 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 17.x before 17.0.2 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via an HTML document that specifies invalid width and height values.


Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0606 CVE-2013-0612 CVE-2013-0615 and CVE-2013-0617.


Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.


Buffer overflow in Adobe Flash Player before 10.3.183.50 and 11.x before 11.5.502.146 on Windows and Mac OS X before 10.3.183.50 and 11.x before 11.2.202.261 on Linux before 11.1.111.31 on Android 2.x and 3.x and before 11.1.115.36 on Android 4.x; Adobe AIR before 3.5.0.1060; and Adobe AIR SDK before 3.5.0.1060 allows attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0 Firefox ESR 17.x before 17.0.1 Thunderbird before 17.0.2 Thunderbird ESR 17.x before 17.0.1 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.


Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0606 CVE-2013-0612 CVE-2013-0617 and CVE-2013-0621.


Buffer overflow in Drive Control Program (DCP) in EMC AlphaStor 4.0 before build 814 allows remote attackers to execute arbitrary code via vectors involving a new device name.


Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0645 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 and CVE-2013-1373.


Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514 and 2.5.1 through 2.5.3 before 26623 on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050 related to a missing size check during extraction of a group number from CNCT information.


Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27 8.1 before SIM 25 and 8.2 before SIM 19 and Proficy Process Systems with CIMPLICITY allow remote attackers to execute arbitrary code via crafted data in packets to TCP port 10212 aka ZDI-CAN-1621 and ZDI-CAN-1624.


Buffer overflow in Groovy Media Player 3.2.0 allows remote attackers to execute arbitrary code via a long string in a .m3u file.


Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header.


Heap-based buffer overflow in Xper in Philips Xper Information Management Physiomonitoring 5 components Xper Information Management Vascular Monitoring 5 components and Xper Information Management servers and workstations for Flex Cardio products before XperConnect 1.5.4.053 SP2 allows remote attackers to execute arbitrary code via a crafted HTTP request to the Connect broker on TCP port 6000.


Buffer overflow in XnView before 2.04 allows remote attackers to execute arbitrary code via a crafted PCT file.


Multiple stack-based buffer overflows in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allow attackers to execute arbitrary code via unspecified vectors.


Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X before 11.2.202.297 on Linux before 11.1.111.64 on Android 2.x and 3.x and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via unspecified vectors.


Timbre SketchUp (formerly Google SketchUp) before 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture which triggers a stack-based buffer overflow.


xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file which leads to an unexpected sign extension error and a heap-based buffer overflow.


Buffer overflow in Cisco Unified Communications Manager (Unified CM) 7.1(x) before 7.1(5b)su6 8.5(x) before 8.5(1)su6 8.6(x) before 8.6(2a)su3 and 9.x before 9.1(2) allows remote authenticated users to execute arbitrary code via unspecified vectors aka Bug ID CSCud54358.


Xjp2.dll in XnView before 2.13 allows remote attackers to execute arbitrary code via (1) the Csiz parameter in a SIZ marker which triggers an incorrect memory allocation or (2) the lqcd field in a QCD marker in a crafted JPEG2000 file which leads to a heap-based buffer overflow.


Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote attackers to execute arbitrary code via a crafted RealMedia .rm file


Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.


Buffer overflow in the Lotus Quickr for Domino ActiveX control in qp2.cab in IBM Lotus Quickr 8.1 before FP 8.1.0.32-001a 8.2 before FP 8.2.0.28-001a and 8.5.1 before FP 8.5.1.39-002a for Domino allows remote attackers to execute arbitrary code via a crafted web site.


Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3 as distributed in Citect CitectFacilities 7.10 and CitectScada 7.10r1 allow remote attackers to execute arbitrary code via a long string as demonstrated by a long WzTitle property value to a certain ActiveX control.


Buffer overflow in logout.cgi in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allows remote authenticated users to execute arbitrary code via the SID parameter.


Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC* H8DG* H8SCM-F H8SGL-F H8SM* X7SP* X8DT* X8SI* X9DAX-* X9DB* X9DR* X9QR* X9SBAA-F X9SC* X9SPU-F and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC) as demonstrated by the (1) username or (2) password field in login.cgi.


A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.


RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow which may allow a local attacker to execute arbitrary code.


RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow which may allow a local attacker to execute arbitrary code.


A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite QVR Pro QVR Guard. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite QVR Pro QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later


A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later


FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files which could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code.


A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite QVR Pro QVR Guard. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite QVR Pro QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 and later QTS 5.0.0: QVR Guard 2.1.3.0 and later


A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 (32 bit): Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later QTS 4.3.3: Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later


All versions of GurumDDS are vulnerable to heap-based buffer overflow which may cause a denial-of-service condition or remotely execute arbitrary code.


A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)


A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS QuTScloud QuTS hero. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS QuTScloud QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later


Xerox

Phaser

before

and

(Bridge)

WorkCentre

before

and

(Bridge)

VersaLink

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

and

(Bridge)

before

allows

remote

attackers

to

execute

arbitrary

code

through

a

buffer

overflow

in

Web

page

parameter

handling.


IBM Spectrum Protect Client 8.1.0.0-8 through 1.11.0 is vulnerable to a stack-based buffer overflow caused by improper bounds checking when processing the current locale settings. A local attacker could overflow a buffer and execute arbitrary code on the system with elevated privileges or cause the application to crash. IBM X-Force ID: 199479


A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.


A Buffer Overflow vulnerabiltiy exists in TP-LINK WR-886N 20190826 2.3.8 in thee /cloud_config/router_post/login feature which allows malicious users to execute arbitrary code on the system via a crafted post request.


A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/register feature which allows malicious users to execute arbitrary code on the system via a crafted post request.


A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet.


A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later


A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android iOS Linux macOS and Windows) before version 5.8.4 Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1 Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4 Zoom Client for Meetings for Chrome OS before version 5.0.1 Zoom Rooms for Conference Room (for Android AndroidBali macOS and Windows) before version 5.8.3 Controllers for Zoom Rooms (for Android iOS and Windows) before version 5.8.3 Zoom VDI Windows Meeting Client before version 5.8.4 Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64 IGEL x64 Ubuntu x64 HP ThinPro OS x64) before version 5.8.4.21112 Zoom VDI Citrix Plugins (for Windows x86 or x64 Mac Universal Installer & Uninstaller IGEL x64 eLux RP6 x64 HP ThinPro OS x64 Ubuntu x64 CentOS x 64 Dell ThinOS) before version 5.8.4.21112 Zoom VDI VMware Plugins (for Windows x86 or x64 Mac Universal Installer & Uninstaller IGEL x64 eLux RP6 x64 HP ThinPro OS x64 Ubuntu x64 CentOS x 64 Dell ThinOS) before version 5.8.4.21112 Zoom Meeting SDK for Android before version 5.7.6.1922 Zoom Meeting SDK for iOS before version 5.7.6.1082 Zoom Meeting SDK for macOS before version 5.7.6.1340 Zoom Meeting SDK for Windows before version 5.7.6.1081 Zoom Video SDK (for Android iOS macOS and Windows) before version 1.1.2 Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115 Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115 Zoom On-Premise Recording Connector before version 5.1.0.65.20211116 Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117 Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117 Zoom Hybrid Zproxy before version 1.0.1058.20211116 and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application or leverage this vulnerability to execute arbitrary code.


A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS QuTScloud QuTS hero. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS QuTScloud QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later


A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QUSBCam2: QTS 4.5.4: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 5.0: QUSBCam2 2.0.1 ( 2021/08/03 ) and later QTS 4.3.6: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 4.3.3: QUSBCam2 1.1.4 ( 2021/08/06 ) and later QuTS hero 4.5.3: QUSBCam2 1.1.4 ( 2021/07/30 ) and later


A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3 this permission is not enabled by default.


Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.


A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1 7.0.0 6.4.0 through 6.4.6 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images.


PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files which may allow an attacker to execute arbitrary code.


FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files which may allow an attacker to execute arbitrary code.


Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code.


WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files which may allow an attacker to execute arbitrary code.


libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g. with additional configuration Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.


libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g. with additional configuration Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.


An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.


A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.


An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.


An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copied to the stack variable.


An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.


Multiple stack-based buffer overflow vulnerabilities CWE-121 both in network daemons and in the command line interpreter of FortiWAN before 4.5.9 may allow an unauthenticated attacker to potentially corrupt control data in memory and execute arbitrary code via specifically crafted requests.


Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/\IPMacBindIndex \request. This occurs because the \formIPMacBindDel\ function directly passes the parameter \IPMacBindIndex\ to strcpy without limit.


Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/\portMappingIndex \request. This occurs because the \formDelPortMapping\ function directly passes the parameter \portMappingIndex\ to strcpy without limit.


A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3) APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3) APOGEE PXC Compact (BACnet) (All versions < V3.5.3) APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8) APOGEE PXC Modular (BACnet) (All versions < V3.5.3) APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8) TALON TC Compact (BACnet) (All versions < V3.5.3) TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.


Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/\qosIndex \request. This occurs because the \formQOSRuleDel\ function directly passes the parameter \qosIndex\ to strcpy without limit.


Omron CX-One Versions 4.60 and prior including CX-Server Versions 5.0.29.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code.


GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and cmd_pgnreplay functions in frontend/cmd.cc.


Buffer overflow in dtterm in HP-UX 11.0 and HP Tru64 UNIX 4.0f through 5.1a allows local users to execute arbitrary code via a long -tn option.


Buffer overflow in Live for Speed (LFS) S2 ALPHA PATCH 0.5x allows user-assisted remote attackers to execute arbitrary code via a .mpr file (replay file) that contains a long car name.


Multiple buffer overflows in ALPass 2.7 English and 3.02 Korean allow user-assisted remote attackers to execute arbitrary code via an ALPass DB (APW) file containing (1) a long file-key or (2) a \Site Information and Folder entry\ with a ciphertext_length value much larger than the plaintext_length value.


Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern which is incorrectly optimized.


Multiple heap-based buffer overflows in GlobalLink 2.7.0.8 allow remote attackers to execute arbitrary code via (1) a long eighth argument to the SetInfo method in a certain ActiveX control in glItemCom.dll or (2) a long second argument to the SetClientInfo method in a certain ActiveX control in glitemflat.dll.


Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length as demonstrated by overwriting the SCRIPT_FILENAME variable aka a \header overflow.\


Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6.0.2.827 as packaged in Microsoft DirectX Media 6.0 SDK allows remote attackers to execute arbitrary code via a long SourceUrl property value.


Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability possibly a buffer overflow in Justsystem Ichitaro 2007 and earlier allows remote attackers to execute arbitrary code via a modified document as actively exploited in August 2007 by malware such as Tarodrop.D (Tarodrop.Q) a different vulnerability than CVE-2006-4326 CVE-2006-5424 CVE-2006-6400 and CVE-2007-1938.


Multiple input validation errors in ACD ACDSee Photo Manager 9.0 build 108 Pro Photo Manager 8.1 build 99 and Photo Editor 4.0 build 195 allow user-assisted remote attackers to execute arbitrary code via a long section string in (1) a PSP image to the ID_PSP.apl plug-in or (2) an LHA archive to the AM_LHA.apl plug-in resulting in a heap-based buffer overflow.


Multiple buffer overflows in a certain ActiveX control in sparser.dll in Baofeng Storm 2.8 and earlier allow remote attackers to execute arbitrary code via malformed input in an unknown set of arguments or property values a different DLL than CVE-2007-4816. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Stack-based buffer overflow in certain ActiveX controls in (1) FPOLE.OCX 6.0.8450.0 and (2) Foxtlib.ocx as used in the Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library; and Internet Explorer 5.01 6 SP1 and SP2 and 7; allows remote attackers to execute arbitrary code via a long first argument to the FoxDoCmd function.


Buffer overflow in the ftp client in IBM AIX 5.3 SP6 and 5.2.0 allows local users to execute arbitrary code via unspecified vectors that trigger the overflow in a gets function call. NOTE: the client is setuid root on AIX so this issue crosses privilege boundaries.


Buffer overflow in the Client Acceptor Daemon (CAD) dsmcad.exe in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1 5.2 before 5.2.5.2 5.3 before 5.3.5.3 and 5.4 before 5.4.1.2 allows remote attackers to execute arbitrary code via crafted HTTP headers aka IC52905.


Buffer overflow in IMail Client 9.22 as shipped with IPSwitch IMail Server 2006.22 allows remote attackers to execute arbitrary code via a long boundary parameter in a multipart MIME e-mail message.


Multiple stack-based buffer overflows in the Oracle JInitiator ActiveX control (beans.ocx) 1.1.8.16 and earlier as used by Oracle Forms applications from Oracle and third parties allow remote attackers to execute arbitrary code via unspecified \initialization parameters.\ NOTE: it was later reported that 1.1.8.3 through 1.1.8.25 and probably 1.1.5.x and 1.1.7.x are affected.


Multiple stack-based buffer overflows in the Quantum Streaming Internet Explorer Player ActiveX control in qsp2ie07051001.dll 1.0.0.1 in Move Media Player allow remote attackers to execute arbitrary code via a long string to the (1) Play and (2) Buzzer methods.


Multiple buffer overflows in Live for Speed (LFS) S1 and S2 allow user-assisted remote attackers to execute arbitrary code via (1) a .spr file (single player replay file) containing a long user name or (2) a .ply file containing a long number plate string different vectors than CVE-2007-4140.


Buffer overflow in AtomixMP3 2.3 allows user-assisted remote attackers to execute arbitrary code via long strings in file and title fields in a .pls file as demonstrated by the (1) File1 and (2) Title1 fields different vectors than CVE-2006-6287 and CVE-2007-2487.


Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0 8.0.450.0 and 7.1.758.0 as used in multiple CA products including Anti-Virus for the Enterprise 7.1 through r11.1 and Threat Manager for the Enterprise 8.1 and r8 allow remote authenticated users to execute arbitrary code via crafted RPC requests.


Multiple buffer overflows in the ServerProtect service (SpntSvc.exe) in Trend Micro ServerProtect for Windows before 5.58 Security Patch 4 allow remote attackers to execute arbitrary code via certain RPC requests to certain TCP ports that are processed by the (1) RPCFN_ENG_NewManualScan (2) RPCFN_ENG_TimedNewManualScan and (3) RPCFN_SetComputerName functions in (a) StRpcSrv.dll; the (4) RPCFN_CMON_SetSvcImpersonateUser and (5) RPCFN_OldCMON_SetSvcImpersonateUser functions in (b) Stcommon.dll; the (6) RPCFN_ENG_TakeActionOnAFile and (7) RPCFN_ENG_AddTaskExportLogItem functions in (c) Eng50.dll; the (8) NTF_SetPagerNotifyConfig function in (d) Notification.dll; or the (9) RPCFN_CopyAUSrc function in the (e) ServerProtect Agent service.


Buffer overflow in the EasyMailSMTPObj ActiveX control in emsmtp.dll 6.0.1 in the Quiksoft EasyMail SMTP Object as used in Postcast Server Pro 3.0.61 and other products allows remote attackers to execute arbitrary code via a long argument to the SubmitToExpress method a different vulnerability than CVE-2007-1029. NOTE: this may have been fixed in version 6.0.3.15.


Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these details are obtained from third party information.


Buffer overflow in Ots Labs OTSTurntables 1.00 allows user-assisted remote attackers to execute arbitrary code via a long file path in an m3u file.


Integer signedness error in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted AppleTalk message with a negative value which satisfies a signed comparison during mbuf allocation but is later interpreted as an unsigned value which triggers a heap-based buffer overflow.


Multiple buffer overflows in php_iisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code probably during Unicode conversion as demonstrated by a long string in the first argument to the iis_getservicestate function related to the ServiceId argument to the (1) fnStartService (2) fnGetServiceState (3) fnStopService and possibly other functions.


Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.