Integer overflow in KmxSbx.sys 6.2.0.22 in CA Internet Security Suite Plus 2010 allows local users to cause a denial of service (pool corruption) and execute arbitrary code via crafted arguments to the 0x88000080 IOCTL which triggers a buffer overflow.


Integer overflow in the wxImage::Create function in src/common/image.cpp in wxWidgets 2.8.10 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JPEG file which triggers a heap-based buffer overflow. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

denial of service
integer overflow
buffer overflow
arbitrary code execution


Integer overflow in Apple CoreGraphics as used in Safari before 4.0.3 Mozilla Firefox before 3.0.12 and Mac OS X 10.4.11 and 10.5.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long text run that triggers a heap-based buffer overflow during font glyph rendering a related issue to CVE-2009-1194.


Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc (4) apr_rmm_calloc or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.


Integer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5.8 and Safari before 4.0.4 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ColorSync profile embedded in an image leading to a heap-based buffer overflow.


Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22 when running on Windows allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) the tiff_instantiate function processing a crafted TIFF file (2) the png_instantiate function processing a crafted PNG file and (3) the jpeg_instantiate function processing a crafted JPEG file all which trigger a heap-based buffer overflow. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Integer overflow in QuickLook in Apple Mac OS X 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Office document that triggers a buffer overflow.


Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow as demonstrated by a long document.location value in Firefox.


Integer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows attackers to cause a denial of service or possibly execute arbitrary code via a PDF file containing unspecified parameters to the FlateDecode filter which triggers a heap-based buffer overflow.


Multiple integer overflows in the (1) user_info_callback (2) user_endrow_callback and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file which triggers a buffer overflow.


Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information.


Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6.5.2-8 and GraphicsMagick allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file which triggers a buffer overflow. NOTE: some of these details are obtained from third party information.


Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x as used in the pdftops filter in CUPS 1.1.17 1.1.22 and 1.3.7 GPdf and kdegraphics KPDF allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow possibly related to (1) Decrypt.cxx (2) FoFiTrueType.cxx (3) gmem.c (4) JBIG2Stream.cxx and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.


Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter leading to a heap-based buffer overflow.


Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib) as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain \native color space \ related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.


Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib) as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain \native color space \ related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images. NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.


Multiple vulnerabilities in NetPBM 9.20 and earlier and possibly other versions may allow remote attackers to cause a denial of service or execute arbitrary code via \maths overflow errors\ such as (1) integer signedness errors or (2) integer overflows which lead to buffer overflows.


Integer overflow in Trillian 0.74 and earlier and Trillian Pro 2.01 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.


Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow.


Integer overflow in the real_setup_and_get_header function in real.c for Unix MPlayer 1.0pre5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a Real RTSP streaming media file with a -1 content-length field which leads to a heap-based buffer overflow.


Integer overflow in Gaim 0.74 and earlier and Ultramagnetic before 0.81 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.


Integer overflow in the ubsec_keysetup function for Linux Broadcom 5820 cryptonet driver allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a negative add_dsa_buf_bytes variable which leads to a buffer overflow.


Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2) and possibly other versions allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function a different set of vulnerabilities than CVE-2004-0941.


libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn:// (2) svn+ssh:// and (3) other svn protocol URL strings which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.


Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request which triggers a heap-based buffer overflow.


Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries which triggers a buffer overflow.


Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48 as used on Axis cameras and other devices allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.


Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file which triggers a heap-based buffer overflow.


Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5 as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux Google Chrome on Linux and other products allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.


Integer overflow in filter/texttopdf.c in texttopdf in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job which triggers a heap-based buffer overflow.


Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier as used in the ZIP extension in PHP before 5.4.39 5.5.x before 5.5.23 and 5.6.x before 5.6.7 and other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries leading to a heap-based buffer overflow.


Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string which triggers a stack-based buffer overflow.


Multiple integer overflows in the (1) pixops_composite_nearest (2) pixops_composite_color_nearest and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image which triggers a heap-based buffer overflow.


Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes which triggers a heap-based buffer overflow.


Integer overflow in ClamAV 0.88.1 and 0.88.4 and other versions before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.


Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components which triggers a heap-based buffer overflow.


Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via large (1) bytes_per_pixel (2) columns and (3) rows values which trigger a heap-based buffer overflow.


Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SWF file which triggers a heap-based buffer overflow.


Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3 3.4 Beta and possibly earlier and LibreOffice before 3.5.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object as demonstrated by a JPEG image in a .DOC file which triggers a heap-based buffer overflow.


Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.


Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3 3.4 Beta and possibly earlier and LibreOffice before 3.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher graphics record in a PowerPoint (.ppt) document which triggers a buffer overflow.


Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.


Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted channels header value in a PSD image file which triggers a heap-based buffer overflow a different vulnerability than CVE-2009-3909.


Multiple integer overflows in the (1) strtod (2) strtof (3) strtold (4) strtod_l and other unspecified \related functions\ in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string which triggers a stack-based buffer overflow.


Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string which triggers a heap-based buffer overflow.


Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors which triggers a buffer overflow infinite loop or possibly some other unspecified vulnerabilities.


Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map (ppm) image which triggers a heap-based buffer overflow.


ppm2tiff does not check the return value of the TIFFScanlineSize function which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow a zero-memory allocation and a heap-based buffer overflow.


An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves pktmnglr_ipfilter_input in com.apple.packet-mangler in the \Kernel\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (integer overflow and stack-based buffer overflow) via a crafted app.


Multiple integer overflows in libXpm before 3.5.12 when a program requests parsing XPM extensions on a 64-bit platform allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file which triggers a heap-based buffer overflow.


Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive which trigger a buffer overflow.


Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) on a system running an application compiled by ASN1C via crafted ASN.1 data.


Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value which causes less memory to be allocated than expected possibly due to an integer overflow.


Buffer overflows in (1) circle_poly (2) path_encode and (3) path_add (also incorrectly identified as path_addr) for PostgreSQL 7.2.3 and earlier allow attackers to cause a denial of service and possibly execute arbitrary code possibly as a result of an integer overflow.


PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.


Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet with a large string length value to UDP port 14000 which triggers a heap-based buffer overflow.


Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.


Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11 10.5.2 and 10.5.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF file with a long Type 1 font which triggers a heap-based buffer overflow.


Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1 as used in clamd allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file which triggers a heap-based buffer overflow.


Integer overflow in the CFDataReplaceBytes function in the CFData API in CoreFoundation in Apple Mac OS X before 10.5.3 allows context-dependent attackers to execute arbitrary code or cause a denial of service (crash) via an invalid length argument which triggers a heap-based buffer overflow.


Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows. NOTE: this issue is due to an incomplete fix for CVE-2007-4965.


Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow a different vulnerability than CVE-2008-0984.


Integer overflow in the XSPF playlist parser in VideoLAN VLC media player 0.8.5 through 1.1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a heap-based buffer overflow.


Integer overflow in the CSoundFile::ReadWav function in src/load_wav.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted WAV file which triggers a heap-based buffer overflow.


Integer overflow in libsndfile before 1.0.25 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PARIS Audio Format (PAF) file that triggers a heap-based buffer overflow.


Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8 and libxml 1.8.16 and earlier allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node related to handling of XPath expressions.


Multiple integer overflows in the load_image function in file-pcx.c in the Personal Computer Exchange (PCX) plugin in GIMP 2.6.x and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PCX image that triggers a heap-based buffer overflow.


Integer overflow in ColorSync in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image containing a crafted embedded ColorSync profile that triggers a heap-based buffer overflow.


Integer overflow in the vp3_dequant function in the VP3 decoder (vp3.c) in libavcodec in FFmpeg 0.5.x before 0.5.7 0.6.x before 0.6.4 0.7.x before 0.7.9 and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6 0.6.x before 0.6.4 and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VP3 stream which triggers a buffer overflow.


Multiple integer overflows in CoreGraphics in Apple Mac OS X 10.5.8 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document that triggers a heap-based buffer overflow.


Multiple integer overflows in the font libraries for XFree86 4.3.0 allow local or remote attackers to cause a denial of service or execute arbitrary code via heap-based and stack-based buffer overflow attacks.


Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image which triggers a heap-based buffer overflow.


Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JBIG2 stream in a PDF file leading to a heap-based buffer overflow.


Integer overflow in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image that triggers a heap-based buffer overflow.


Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow.


Integer overflow in the SMB component in Apple Mac OS X 10.5.6 allows remote SMB servers to cause a denial of service (system shutdown) or execute arbitrary code via a crafted SMB file system that triggers a heap-based buffer overflow.


Integer overflow in the FORMATS Plugin before 4.23 for IrfanView allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large XPM file that triggers a heap-based buffer overflow.


Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier which may trigger a buffer overflow.


Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.


** DISPUTED ** plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7 and possibly other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MKV file possibly involving an integer overflow and out-of-bounds read or heap-based buffer overflow or an uncaught exception. NOTE: the vendor disputes the severity and claimed vulnerability type of this issue stating \This PoC crashes VLC indeed but does nothing more... this is not an integer overflow error but an uncaught exception and I doubt that it is exploitable. This uncaught exception makes VLC abort not execute random code on my Linux 64bits machine.\ A PoC posted by the original researcher shows signs of an attacker-controlled out-of-bounds read but the affected instruction does not involve a register that directly influences control flow.

denial of service
integer overflow
buffer overflow
arbitrary code execution
out of bound read


Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x 1.8.x before 1.8.15 and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body which triggers an out-of-bounds read and heap-based buffer overflow.


Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata.


Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2 3.3 4.0 and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.


Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size which triggers a buffer overflow or out-of-bounds read.


The MSM QDSP6 audio driver (aka sound driver) for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allows attackers to gain privileges or cause a denial of service (integer overflow and buffer overflow or buffer over-read) via a crafted application that performs a (1) AUDIO_EFFECTS_WRITE or (2) AUDIO_EFFECTS_READ operation aka Qualcomm internal bug CR1006609.

denial of service
integer overflow
buffer overflow
buffer overread


libpcp in Performance Co-Pilot (PCP) before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a PDU with the numcreds field value greater than the number of actual elements to the __pmDecodeCreds function in p_creds.c; (2) the string byte number value to the __pmDecodeNameList function in p_pmns.c; (3) the numids value to the __pmDecodeIDList function in p_pmns.c; (4) unspecified vectors to the __pmDecodeProfile function in p_profile.c; the (5) status number value or (6) string number value to the __pmDecodeNameList function in p_pmns.c; (7) certain input to the __pmDecodeResult function in p_result.c; (8) the name length field (namelen) to the DecodeNameReq function in p_pmns.c; (9) a crafted PDU_FETCH request to the __pmDecodeFetch function in p_fetch.c; (10) the namelen field in the __pmDecodeInstanceReq function in p_instance.c; (11) the buflen field to the __pmDecodeText function in p_text.c; (12) PDU_INSTANCE packets to the __pmDecodeInstance in p_instance.c; or the (13) c_numpmid or (14) v_numval fields to the __pmDecodeLogControl function in p_lcontrol.c which triggers integer overflows heap-based buffer overflows and/or buffer over-reads.

denial of service
integer overflow
buffer overflow
buffer overread
arbitrary code execution


An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.

denial of service
integer overflow
buffer overflow
dos


Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number which triggers a stack-based buffer overflow.

denial of service
integer overflow
buffer overflow
memory corruption


An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.


Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.


Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12 Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.

denial of service
integer overflow
buffer overflow
memory corruption
arbitrary code execution


Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.


Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.


Integer overflow in Terminal in Apple Mac OS X 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted size value in a CSI4 xterm resize escape sequence that triggers a heap-based buffer overflow.


Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file which triggers a buffer overflow.


Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages which triggers a heap-based buffer overflow.


Multiple integer overflows in the block drivers in QEMU possibly before 2.0.0 allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c or (7) a large number of blocks in the cloop_open function in cloop.c which trigger buffer overflows memory corruption large memory allocations and out-of-bounds read and writes.

denial of service
integer overflow
buffer overflow
memory corruption
out of bound read


Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data which triggers a buffer overflow and an out-of-bounds read.

denial of service
integer overflow
buffer overflow
out of bound read


Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED (4) RPY_CLIENT_ACCESSES (5) RPY_CLIENT_ACCESSES_BY_INDEX or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function which triggers an out-of-bounds read or buffer overflow. NOTE: versions 1.27 and 1.28 do not require authentication to exploit.


Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via certain base64-encoded data on the pop3 port (110/tcp) which triggers an integer overflow.

denial of service
integer overflow
buffer underflow
arbitrary code execution


Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application causing a Denial of Service (DoS). This occurs when the attacker uses the command line option \-ImgDir\ on a directory that contains 1048576 files.


FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node can trigger an integer overflow and cause a Denial of Service (DoS) via an unusually large viewchange message packet.


stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.


An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1 as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping some input validation (e.g. for an integer overflow) was missing or flawed leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses potentially resulting in one or more of privilege escalation Denial of Service (DoS) or information leaks.


An integer overflow in DTSStreamReader::findFrame() of tsMuxer git-2678966 allows attackers to cause a Denial of Service (DoS) via a crafted file.


TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.


NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_mount function where Insufficient validation of untrusted data may allow a highly privileged local attacker to cause an integer overflow. This difficult- to-exploit vulnerability may lead to code execution escalation of privileges limited denial of service and some impact to confidentiality and integrity.

denial of service
integer overflow
escalated privilege


NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function where insufficient validation of untrusted data may allow a highly privileged local attacker to cause a integer overflow which may lead to code execution escalation of privileges limited denial of service and some impact to confidentiality and integrity.


All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges.


kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic.

denial of service
integer overflow
memory corruption


** DISPUTED ** Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says \the Linux kernel is *not* affected; media hype.\


Integer overflow in the LZ4 algorithm implementation as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2 on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation a different vulnerability than CVE-2014-4715.


Yann Collet LZ4 before r119 when used on certain 32-bit platforms that allocate memory beyond 0x80000000 does not properly detect integer overflows which allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run a different vulnerability than CVE-2014-4611.


Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.


Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in sandbox/src/crosscall_server.cc in Google Chrome before 4.0.249.89 allows attackers to leverage renderer access to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a malformed message related to deserializing of sandbox messages.


The dechunk filter in PHP 5.3 through 5.3.2 when decoding an HTTP chunked encoding stream allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size which bypasses a signed comparison related to an integer overflow in the chunk size decoder.


Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory corruption and panic) via a crafted IOCTL_ASWFW_COMM_PIDINFO_RESULTS DeviceIoControl request to \\\\.\\aswFW.


Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.


Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma.c) in Linux kernel 2.6.35 allows local users to cause a denial of service (crash) and possibly trigger memory corruption via a crafted Reliable Datagram Sockets (RDS) request a different vulnerability than CVE-2010-3865.


Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.


Integer overflow in the ioc_general function in drivers/scsi/gdth.c in the Linux kernel before 2.6.36.1 on 64-bit platforms allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large argument in an ioctl call.


Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable which triggers a denial of service (application crash) or the possibility of execution of arbitrary code.


Multiple

integer

overflows

in

the

GraphicBuffer::unflatten

function

in

in

Android

through

allow

attackers

to

gain

privileges

or

cause

a

denial

of

service

(memory

corruption)

via

vectors

that

trigger

a

large

number

of

file

descriptors

or

integer

values.


Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application aka internal bug 19334482.


Integer overflow in the drm_mode_dirtyfb_ioctl function in drivers/gpu/drm/drm_crtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call.


Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0 4.1 and 4.2 allow local guest OS users to cause a denial of service (memory corruption and host crash) via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497 which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the kernel. See NCC-ZEP-005 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.


drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks and cause a denial of service (memory corruption) or have unspecified other impact by leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call aka a \state machine confusion bug.\


Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption) obtain sensitive information from kernel memory or possibly have unspecified other impact via a write or read request involving the \RDMA protocol over infiniband\ (aka Soft RoCE) technology.


Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.


The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 Thunderbird 2.x before 2.0.0.19 and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to (1) a reachable assertion or (2) an integer overflow.


Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations. NOTE: the handling of certain integer values is also affected by related integer underflows and an off-by-one error.


Integer overflow in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction aka \CSRSS Local EOP SrvWriteConsoleOutput Vulnerability.\


Integer overflow in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction aka \CSRSS Local EOP SrvWriteConsoleOutputString Vulnerability.\


An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.


Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls.


Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption as demonstrated via a crafted PNG image.


Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.


Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.


Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to cause a denial of service (crash) via a large string length argument which triggers memory corruption.


Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image in a Windows Write (.wri) document which is not properly handled in WordPad aka \Graphics Device Interface Integer Overflow Vulnerability.\

denial of service
integer overflow
memory corruption
arbitrary code execution


An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 . The IOCTL Handler 0x22005B in the Accops HyWorks DVM Tools prior to v3.3.1.105 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


An Integer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22005B in the Accops HyWorks Windows Client prior to v 3.2.8.200 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


NoMachine Cloud Server is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Cloud Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


NoMachine Server is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


NoMachine Enterprise Desktop is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Desktop above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


NoMachine Enterprise Client is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Client above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 .The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


An Integer Overflow exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22001B in the Accops HyWorks Windows Client prior to v 3.2.8.200 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


Donglify is affected by Integer Overflow. IOCTL Handler 0x22001B in the Donglify above 1.0.12309 below 1.7.14110 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


FlexiHub For Windows is affected by Integer Overflow. IOCTL Handler 0x22001B in the FlexiHub For Windows above 2.0.4340 below 5.3.14268 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


Eltima USB Network Gate is affected by Integer Overflow. IOCTL Handler 0x22001B in the USB Network Gate above 7.0.1370 below 9.2.2420 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


Amzetta zPortal Windows zClient is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amzetta zPortal Windows zClient <= v3.2.8180.148 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


AmZetta Amzetta zPortal DVM Tools is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amzetta zPortal DVM Tools <= v3.3.148.148 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.


Integer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.0.1 Mac RealPlayer 11.0 through 11.1 and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed MLLT atom in an AAC file.


Integer overflow in httpAdapter.c in httpAdapter in SBLIM SFCB 1.3.4 through 1.3.7 when the configuration sets httpMaxContentLength to a zero value allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a large integer in the Content-Length HTTP header aka bug #3001915. NOTE: some of these details are obtained from third party information.


Integer overflow in the 3D object functionality in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted size value in a 0xFFFFFF45 RIFF record in a Director movie.


Multiple integer overflows in the allocator in the TextXtra.x32 module in Adobe Shockwave Player before 11.5.8.612 allow remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted (1) element count or (2) element size value in a file.


Multiple integer overflows in Skia as used in Google Chrome before 4.0.249.78 allow remote attackers to execute arbitrary code in the Chrome sandbox or cause a denial of service (memory corruption and application crash) via vectors involving CANVAS elements.


Integer overflow in librpc.dll in portmap.exe (aka the ISM Portmapper service) in ISM before 2.20.TC1.117 in IBM Informix Dynamic Server (IDS) 7.x before 7.31.xD11 9.x before 9.40.xC10 10.00 before 10.00.xC8 and 11.10 before 11.10.xC2 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted parameter size aka idsdb00146931 idsdb00146930 idsdb00146929 and idsdb00138308.


SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data aka internal bug 20139950 a different vulnerability than CVE-2015-1538. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7915 CVE-2014-7916 and/or CVE-2014-7917.


Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1 as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.


The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom aka internal bug 20923261.


Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX aka internal bug 20923261.


Integer overflow in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via \jsstr tagify \ which leads to memory corruption.


Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.


The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which in situations where marshalled data is accepted from an untrusted source allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.


Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.


Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation aka internal bug 27855419.


Integer

overflow

in

in

libstagefright

in

mediaserver

in

Android

before

before

before

and

before

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

(memory

corruption)

via

a

crafted

media

file

aka

internal

bug


Integer overflow in codecs/on2/h264dec/source/h264bsd_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file aka internal bug 28533562.


Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2 Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via an mtd element with a large integer value in the rowspan attribute related to the layout engine.


Multiple

unspecified

vulnerabilities

in

Mozilla

Firefox

before

allow

remote

attackers

to

cause

a

denial

of

service

(memory

corruption

and

application

crash)

or

possibly

execute

arbitrary

code

via

vectors

related

to

graphics

rendering

and

handling

of

a

long

alert

messagebox

in

the

function

integer

overflows

when

handling

animated

PNG

data

in

the

function

in

nsPNGDecoder.cpp

and

an

integer

overflow

when

handling

SVG

data

in

the

nsSVGFEGaussianBlurElement::SetupPredivide

function

in

nsSVGFilters.cpp.


Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier 1.8.5 before 1.8.5-p231 1.8.6 before 1.8.6-p230 1.8.7 before 1.8.7-p22 and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption a different issue than CVE-2008-2663 CVE-2008-2664 and CVE-2008-2725. NOTE: as of 20080624 there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative although it is likely to change.


Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption.


Integer overflow in libresolv in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via crafted DNS data.


Integer overflow in QuickLook as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft Office document with a crafted size field in the OfficeArtMetafileHeader related to OfficeArtBlip as demonstrated on the iPhone by Charlie Miller and Dion Blazakis during a Pwn2Own competition at CanSecWest 2011.


Multiple integer overflows in Adobe Shockwave Player before 11.5.7.609 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .dir (aka Director) file that triggers an array index error.


Integer overflow in Google Chrome before 31.0.1650.57 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors as demonstrated during a Mobile Pwn2Own competition at PacSec 2013.


Integer overflow in Google SketchUp before 7.1 M2 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a crafted SKP file.


Integer overflow in the fatfile_getarch2 in Apple Mac OS X allows local users to cause a denial of service and possibly execute arbitrary code via a crafted Mach-O Universal program that triggers memory corruption.


Integer overflow in the Security Framework in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted input.


Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.


Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value which triggers a buffer underflow.

denial of service
integer overflow
memory corruption
buffer underflow
arbitrary code execution


Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.

denial of service
integer overflow
memory corruption
out of bound read


Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow NULL pointer dereference and application crash) via a crafted PCF file that specifies negative values for the first column and first row.

denial of service
integer overflow
null pointer dereference


In SWFTools 0.9.2 the wav_convert2mono function in lib/wav.c does not properly restrict a multiplication within a malloc call which allows remote attackers to cause a denial of service (integer overflow and NULL pointer dereference) via a crafted WAV file.


Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count which triggers an unchecked multiplication and NULL pointer dereference.


Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1 as used in GPdf kdegraphics KPDF and CUPS pdftops allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.

denial of service
integer overflow
null pointer dereference
buffer overread


epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types which allows remote attackers to cause a denial of service (integer overflow and heap memory corruption or NULL pointer dereference and application crash) via a malformed packet.

denial of service
integer overflow
null pointer dereference
memory corruption


Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function related to crypto/bn/bn.h and crypto/bn/bn_print.c.


An exploitable denial-of-service vulnerability exists in the Weave certificate loading functionality of Nest Cam IQ Indoor camera version 4620002. A specially crafted weave packet can cause an integer overflow and an out-of-bounds read on unmapped memory to occur resulting in a denial of service. An attacker can send a specially crafted packet to trigger.

denial of service
integer overflow
out of bound read


A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.


In

before

kex_method_diffie_hellman_group_exchange_sha256_key_exchange

in

kex.c

has

an

integer

overflow

that

could

lead

to

an

out-of-bounds

read

in

the

way

packets

are

read

from

the

server.

A

remote

attacker

who

compromises

a

SSH

server

may

be

able

to

disclose

sensitive

information

or

cause

a

denial

of

service

condition

on

the

client

system

when

a

user

connects

to

the

server.

This

is

related

to

an

mistake

and

is

different

from

the

various

issues

fixed

in

such

as


Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2 as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products allows remote attackers to cause a denial of service (out-of-bounds read) via a long packet.


Multiple integer overflows in PHP 4 before 4.4.8 and PHP 5 before 5.2.4 allow remote attackers to obtain sensitive information (memory contents) or cause a denial of service (thread crash) via a large len value to the (1) strspn or (2) strcspn function which triggers an out-of-bounds read. NOTE: this affects different product versions than CVE-2007-3996.


The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.


The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.


sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.


Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image related to dimensions which triggers an out-of-bounds read.


Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file which triggers an out-of-bounds read related to compiler optimizations.


An integer overflow (CWE-190) potentially causing an out-of-bounds read (CWE-125) vulnerability in Micro Focus VisiBroker 8.5 can lead to a denial of service.


Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file as demonstrated by using the ps2pdf command which triggers an out-of-bounds read or write.


Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record which triggers an out-of-bounds read.


Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259.


An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144 one can cause an integer overflow in the function handle_80211 which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).


The outputSWF_TEXT_RECORD function (util/outputscript.c) in libming through 0.4.8 is vulnerable to an integer overflow and resultant out-of-bounds read which may allow attackers to cause a denial of service or unspecified other impact via a crafted SWF file.


Multiple integer overflows in the (1) sycc422_to_rgb and (2) sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium as used in Google Chrome before 48.0.2564.82 allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.


Integer overflow in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted WebP image.


Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message which triggers an out-of-bounds read.


Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.


Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.


Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.


Integer

overflow

in

in

the

driver

in

the

Direct

Rendering

Manager

(DRM)

subsystem

in

the

Linux

kernel

through

as

used

in

Google

Chrome

OS

before

and

other

products

allows

local

users

to

cause

a

denial

of

service

(heap-based

buffer

overflow)

or

possibly

have

unspecified

other

impact

via

a

crafted

application

that

triggers

many

relocation

copies

and

potentially

leads

to

a

race

condition.

denial of service
integer overflow
race condition
buffer overflow


Integer overflow in the sys_oabi_semtimedop function in arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 2.6.39 on the ARM platform when CONFIG_OABI_COMPAT is enabled allows local users to gain privileges or cause a denial of service (heap memory corruption) by providing a crafted argument and leveraging a race condition.

denial of service
integer overflow
race condition
memory corruption


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

SMF

services

legacy

daemons).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).

denial of service
low privilege infrastructure logon
infrastructure logon privilege


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Filesystem).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

While

the

vulnerability

is

in

Oracle

Solaris

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Oracle

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Zones).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L).

denial of service
low privilege infrastructure logon
infrastructure logon privilege
dos


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Utility).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Install).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Fault

Management

Architecture).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Kernel).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Client

programs).

Supported

versions

that

are

affected

are

and

earlier

and

and

earlier.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

MySQL

Server

executes

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

VM

VirtualBox

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Oracle

Java

Web

Console).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Hospitality

RES

component

of

Oracle

Hospitality

Applications

(subcomponent:

OPS

Operations).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Hospitality

RES

executes

to

compromise

Oracle

Hospitality

RES

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Hospitality

RES

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

RES

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

RES

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

RES

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Oracle

Hospitality

component

of

Oracle

Hospitality

Applications

(subcomponent:

PMS).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Hospitality

executes

to

compromise

Oracle

Hospitality

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Hospitality

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Hospitality

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Hospitality

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Network

Services

Library).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Shell:

Core

Client).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

MySQL

Server

executes

to

compromise

MySQL

Server.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Solaris

Cluster

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Cluster

Geo).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

Cluster

executes

to

compromise

Solaris

Cluster.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Solaris

Cluster

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

Cluster

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Solaris

Cluster.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Confidentiality

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L).


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Device

Driver

Utility).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L).


Vulnerability

in

the

Primavera

Enterprise

Project

Portfolio

Management

product

of

Oracle

Construction

and

Engineering

(component:

Core).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Primavera

Enterprise

Project

Portfolio

Management

executes

to

compromise

Primavera

Enterprise

Project

Portfolio

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Primavera

Enterprise

Project

Portfolio

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Primavera

Enterprise

Project

Portfolio

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Primavera

Enterprise

Project

Portfolio

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L).


Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

Supported

versions

that

are

affected

are

Prior

to

prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


NetProwler 3.0 allows remote attackers to cause a denial of service by sending malformed IP packets that trigger NetProwler's Man-in-the-Middle signature.


NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information gain privileges or cause a denial of service by leveraging failure to enable SMB signing enforcement in its default state.


The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery related to ssl/d1_both.c and ssl/t1_enc.c.


VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 does not properly implement the Network File Copy (NFC) protocol which allows man-in-the-middle attackers to cause a denial of service (unhandled exception and application crash) by modifying the client-server data stream.


Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic from a Man-in-the-Middle (MITM) attack to the component \FrameworX.exe\in the module \fxVPStatcTcp.dll\.


An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.


SlackRoll before 8 accepts gpg exit codes other than 0 and 1 as evidence of a valid signature which allows remote Slackware mirror sites or man-in-the-middle attackers to cause a denial of service (data inconsistency) or possibly install Trojan horse packages via malformed gpg signatures.


The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients in certain deployments or configurations which allows remote attackers to change DNS records for a web proxy server and conduct man-in-the-middle (MITM) attacks on web traffic conduct pharming attacks by poisoning DNS records and cause a denial of service (erroneous name resolution).


The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial of service (application exit) via a crafted (1) bbversion (2) prev_hash (3) nbit or (4) ntime parameter in a mining.notify action stratum message.


The SMB client in the kernel in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to cause a denial of service (infinite loop and system hang) via a (1) SMBv1 or (2) SMBv2 response packet that contains (a) an incorrect length value in a NetBIOS header or (b) an additional length field at the end of this response packet aka \SMB Client Incomplete Response Vulnerability.\


The DNS implementation in Cisco Adaptive Security Appliance (ASA) Software 7.2 before 7.2(5.16) 8.2 before 8.2(5.57) 8.3 before 8.3(2.44) 8.4 before 8.4(7.28) 8.5 before 8.5(1.24) 8.6 before 8.6(1.17) 8.7 before 8.7(1.16) 9.0 before 9.0(4.33) 9.1 before 9.1(6.1) 9.2 before 9.2(3.4) and 9.3 before 9.3(3) allows man-in-the-middle attackers to cause a denial of service (memory consumption or device outage) by triggering outbound DNS queries and then sending crafted responses to these queries aka Bug ID CSCuq77655.


The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.


The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with which allows remote attackers to cause a denial of service (bad response) or have other unspecified impact by performing a man-in-the-middle attack.


Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2 allow man-in-the-middle attackers to cause a denial of service via crafted packets on TCP port 102.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \Security\ component which allows man-in-the-middle attackers to cause a denial of service (application crash) via vectors related to OCSP responder URLs.


The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-middle attackers to conduct Call Relay spoofing attacks and cause a denial of service via unspecified vectors.


The GPS component in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service (memory consumption and device hang or reboot) via a large xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host aka internal bug 29555864.


The GPS component in Android before 2016-12-05 allows man-in-the-middle attackers to cause a denial of service (GPS signal-acquisition delay) via an incorrect xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host aka internal bug 31470303 and external bug 211602 (and AndroidID-7225554).


NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information gain privileges or cause a denial of service via vectors related to the SMB protocol.


libndp before 1.6 as used in NetworkManager does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.


NetApp Data ONTAP 8.1 and 8.2 when operating in 7-Mode allows man-in-the-middle attackers to obtain sensitive information gain privileges or cause a denial of service via vectors related to the SMB protocol.