Buffer overflow in Advanced Software Production Line Vortex Library before 1.0.3 allows remote attackers to cause a denial of service (listener crash) via unspecified vectors related to the select I/O implementation and the file set buffer. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the Internet E-mail Auto-Protect feature in Symantec AntiVirus Corporate Edition before 10.1 and Client Security before 3.1 allows local users to cause a denial of service (service crash) via a long (1) To (2) From or (3) Subject header in an outbound SMTP e-mail message. NOTE: the original vendor advisory referenced CVE-2006-3456 but this was an error.


unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value which triggers a heap-based buffer overflow.


The ATI kernel driver (atikmdag.sys) in Microsoft Windows Vista allows user-assisted remote attackers to cause a denial of service (crash) via a crafted JPG image as demonstrated by a slideshow possibly due to a buffer overflow.


Buffer overflow in TinyMUX before 2.4 allows attackers to cause a denial of service via unspecified vectors related to \too many substring matches in a regexp $-command.\ NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the LDAP server in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service (crash) via a long malformed DN request which causes only the lower 16 bits of the string length to be used in memory allocation.


Buffer overflow in VMware ESX Server 3.0.0 and 3.0.1 might allow attackers to gain privileges or cause a denial of service (application crash) via unspecified vectors.


Heap-based buffer overflow in SW3eng.exe in the eID Engine service in CA (formerly Computer Associates) eTrust Intrusion Detection 3.0.5.57 and earlier allows remote attackers to cause a denial of service (application crash) via a long key length value to the remote administration port (9191/tcp).


FTPDMIN 0.96 allows remote attackers to cause a denial of service (daemon crash) via a LIST command for a Windows drive letter as demonstrated using \//A:\. NOTE: this has been reported as a buffer overflow by some sources but there is not a long argument.


Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based but it might be stack-based.


Buffer overflow in Packeteer PacketShaper PacketWise 8.x allows remote authenticated users to cause a denial of service (reset or reboot) via (1) a long traffic class argument to the \class show\ command or (2) a long POLICY parameter value in clastree.htm.


Internet Explorer on Windows Mobile 5.0 and Windows Mobile 2003 and 2003SE for Smartphones and PocketPC allows attackers to cause a denial of service (application crash and device instability) via unspecified vectors possibly related to a buffer overflow.


Multiple buffer overflows in the (1) main function in (a) client.c and the (2) server_setup and (3) server_client_connect functions in (b) server.c in gxine 0.5.9 and earlier allow local users to cause a denial of service (daemon crash) or gain privileges via a long HOME environment variable. NOTE: some of these details are obtained from third party information.


FlashFXP 3.4.0 build 1145 allows remote servers to cause a denial of service (CPU consumption) via a response to a PWD command that contains a long string with deeply nested directory structure possibly due to a buffer overflow.


Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.


drivers/media/radio/radio-iris.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices uses an incorrect integer data type which allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application aka Android internal bug 28769368 and Qualcomm internal bug CR539008.


cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.


Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.


Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2 as used in GnuPG allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data which triggers a buffer overflow.


The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header which allows remote attackers to cause a denial of service (crash) via a header with an empty body which triggers a heap-based buffer overflow in the mutt_substrdup function.


Buffer overflow in the Field Device Tool (FDT) Frame application in the HART Device Type Manager (DTM) library as used in MACTek Bullet DTM 1.00.0 GE Vector DTM 1.00.0 GE SVi1000 Positioner DTM 1.00.0 GE SVI II AP Positioner DTM 2.00.1 and GE 12400 Level Transmitter DTM 1.00.0 allows remote attackers to cause a denial of service (DTM outage) via crafted packets.


The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29 5.4.x before 5.4.30 and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.


Stack-based

buffer

overflow

in

the

function

in

in

the

Linux

kernel

before

allows

local

users

to

cause

a

denial

of

service

(system

crash)

or

possibly

gain

privileges

via

a

large

message

length

in

an

ioctl

call.


Stack-based buffer overflow in the build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Multiple off-by-one errors in Icinga possibly 1.10.2 and earlier allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table (2) print_export_link (3) page_num_selector or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c which triggers a stack-based buffer overflow.


Xen 4.4.x does not properly validate the load address for 64-bit ARM guest kernels which allows local users to read system memory or cause a denial of service (crash) via a crafted kernel which triggers a buffer overflow.


Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g (2) A or (3) B parameter.


Buffer overflow in the mconvert function in softmagic.c in file before 5.19 as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14 allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.


The ARM image loading functionality in Xen 4.4.x does not properly validate kernel length which allows local users to read system memory or cause a denial of service (crash) via a crafted 32-bit ARM guest kernel in an image which triggers a buffer overflow.


Buffer

overflow

in

the

clipboard

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

trigger

unexpected

bitmap

data

related

to

and


Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library.


Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid name length in a DNS response related to an infinite loop with no output.


Buffer overflow in Xen 4.4.x allows local users to read system memory or cause a denial of service (crash) via a crafted 32-bit guest kernel related to searching for an appended DTB.


Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service.


Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core possibly 4.0.3rc1 and earlier and Icinga before 1.8.6 1.9 before 1.9.5 and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.


Buffer overflow in the Java GUI Configuration Wizard and Preferences Editor in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.x and 6.x before 6.2.5.2 6.3.x before 6.3.2 and 6.4.x before 6.4.2 on Windows and OS X allows local users to cause a denial of service (application crash or hang) via unspecified vectors.


Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line related to address expansion.


Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier TLXCDSTOFS33 3.5 and earlier TLXCDLUOFS33 3.5 and earlier TLXCDLTOFS33 3.5 and earlier and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.


Multiple

heap-based

buffer

overflows

in

Huawei

Campus

Series

Switches

and

LSW

with

software

before

and

with

software

before

and

LSW

with

software

before

and

and

LSW

with

software

before

allow

remote

attackers

to

cause

a

denial

of

service

(device

restart)

via

a

crafted

length

field

in

a

packet.


Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300 S7700 S9700 S5300 S5700 S6300 and S6700 series switches; AR150 AR160 AR200 AR1200 AR2200 AR3200 AR530 NetEngine16EX SRG1300 SRG2300 and SRG3300 series routers; and WLAN AC6005 AC6605 and ACU2 access controllers allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.


Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier and 2.x through 2.1.2 when using certain format string specifiers allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.


Buffer overflow in ACME micro_httpd as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.


TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) by connecting to a channel with a different client instance and placing crafted data in the Chat/Server tab containing img//http:// substrings.


Buffer overflow in Skia as used in Google Chrome before 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connecting to a channel with a different client instance and placing crafted data in the Chat/Server tab with two \\\\ (backslash) characters a digit a \\ (backslash) character and \z\ in a series of nested img BBCODE tags.


Buffer overflow in OpenJPEG before r2911 in PDFium as used in Google Chrome before 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image.


Buffer

overflow

in

the

mcpq

daemon

in

BIG-IP

systems

before

before

before

before

and

before

and

Enterprise

Manager

through

and

before

allows

remote

authenticated

administrators

to

cause

a

denial

of

service

via

unspecified

vectors.


Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.


Multiple heap-based buffer overflows in (1) webservd and (2) the admin server in Sun Java System Web Server 7.0 Update 7 allow remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long string in an \Authorization: Digest\ HTTP header.


Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv functions in tapset/aux_syscalls.stp in SystemTap 1.1 allow local users to cause a denial of service (script crash or system crash or hang) via a process with a large number of arguments leading to a buffer overflow.


Heap-based buffer overflow in the server in IBM Lotus Domino 7 and 8.5 FP1 allows remote attackers to cause a denial of service (daemon exit) and possibly have unspecified other impact via a long string in a crafted LDAP message to a TCP port a different vulnerability than CVE-2009-3087.


Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long URI in an HTTP OPTIONS request.


Buffer overflow in Trend Micro URL Filtering Engine (TMUFE) in OfficeScan 8.0 before SP1 Patch 5 - Build 3510 possibly tmufeng.dll before 3.0.0.1029 allows attackers to cause a denial of service (crash or OfficeScan hang) via unspecified vectors. NOTE: it is likely that this issue also affects tmufeng.dll before 2.0.0.1049 for OfficeScan 10.0.


Buffer overflow in Dan Pascu python-cjson 1.0.5 when UCS-4 encoding is enabled allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors involving crafted Unicode input to the cjson.encode function.


Buffer overflow in the Authenticate method in the INCREDISPOOLERLib.Pop ActiveX control in ImSpoolU.dll in IncrediMail 2.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in the first argument.


The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not properly allocate memory which might allow local users to trigger a heap-based buffer overflow and consequently cause a denial of service or gain privileges via a long report.


Buffer overflow in libarchive 3.0 pre-release code allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CAB file which is not properly handled during the reading of Huffman code data within LZX compressed data.


Buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to cause a denial of service (application crash) or have unspecified other impact via a GIF file that contains many images leading to long extensions such as .p100 for PNG output files as demonstrated by a CGI program that launches gif2png a different vulnerability than CVE-2009-5018.


Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function.


NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c where insufficient validation of untrusted data may allow a local attacker to cause a memory buffer overflow which may lead to code execution loss of integrity limited denial of service and some impact to confidentiality.


NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function where insufficient validation of untrusted data may allow a local attacker to cause a memory buffer overflow which may lead to code execution limited loss of Integrity and limited denial of service.


NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c where if TFTP is enabled a local attacker can cause a memory buffer overflow which may lead to code execution loss of Integrity limited denial of service and some impact to confidentiality.


xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentation fault) or other unspecified effects by sending a crafted PDF file to the pdftoppm binary.


Tenda AX1803 v1.0.0.1_2890 is vulnerable to Buffer Overflow. The vulnerability lies in rootfs_ In / goform / setsystimecfg of / bin / tdhttpd in ubif file system attackers can access http://ip/goform/SetSysTimeCfg and by setting the ntpserve parameter the stack buffer overflow can be caused to achieve the effect of router denial of service.


A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 which could be exploited by a local authenticated attacker to cause a denial of service.


IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 218379.


IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 217369.


In lighttpd 1.4.46 through 1.4.63 the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1) as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also a 32-bit system is much more likely to be affected than a 64-bit system.


The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length which may result in a buffer overflow potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.


A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10. A specially-crafted PSD file can overflow a stack buffer which could either lead to denial of service or depending on the application to an information leak. An attacker can provide a malicious file to trigger this vulnerability.


The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length which may result in a buffer overflow potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.


Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.


Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.


Mozilla Firefox 3.0.x 3.5 and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exception and application crash) via a long Unicode string argument to the write method. NOTE: this was originally reported as a stack-based buffer overflow. NOTE: on Linux and Mac OS X a crash resulting from this long string reportedly occurs in an operating-system library not in Firefox.


Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file related to a large encrypted key size in a Tag 3 packet.


Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blocking functionality) via a long URL with many / (slash) characters related to \emergency mode.\


Buffer overflow in Softonic International SciTE 1.72 allows user-assisted remote attackers to cause a denial of service (application crash) via a Ruby (.rb) file containing a long string which triggers the crash when a scroll bar is used.


Stack-based buffer overflow in aswMon2.sys in avast! Home and Professional for Windows 4.8.1351 and possibly other versions before 4.8.1356 allows local users to cause a denial of service (system crash) and possibly gain privileges via a crafted IOCTL request to IOCTL 0xb2c80018.


Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.


Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017 as used in AMaViS SpamAssassin and possibly other products allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow as exploited in the wild by Trojan.Downloader-71014 in June 2009.


Off-by-one error in the bzinflate function in Bzip2.xs in the Compress-Raw-Bzip2 module before 2.018 for Perl allows context-dependent attackers to cause a denial of service (application hang or crash) via a crafted bzip2 compressed stream that triggers a buffer overflow a related issue to CVE-2009-1391.


Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort structure member.


Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets.


Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file.


Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.


Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager (ASM) 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1 and Protocol Security Manager (PSM) 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1 allows remote attackers to cause a denial of service (crash) via unknown vectors. NOTE: some of these details are obtained from third party information.


Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial of service (application crash) via a crafted ZIP file that is not properly handled when the victim uses the (1) Update or (2) Plug-In console menu item.


Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0 NT 4.0 Terminal Server Edition 2000 XP and Server 2003 allows remote attackers to cause a denial of service via a crafted request.


Buffer overflow in Web Retriever client for Lotus Notes/Domino R4.5 through R6 allows remote malicious web servers to cause a denial of service (crash) via a long HTTP status line.


Sybase Adaptive Server Enterprise (ASE) 12.5 allows remote attackers to cause a denial of service (hang) via a remote password array with an invalid length which triggers a heap-based buffer overflow.


Buffer overflow in m_join in channel.c for IRCnet IRCD 2.10.x to 2.10.3p3 allows remote attackers to cause a denial of service.


ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1 which causes a negative value to be fed into a read operation leading to a buffer overflow.


The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request possibly triggering a buffer overflow in Exchange 2000.


Buffer overflow in gPS before 0.10.2 may allow local users to cause a denial of service (SIGSEGV) in rgpsp via long command lines.


SonicWall Pro running firmware 6.4.0.1 allows remote attackers to cause a denial of service (device reset) via a long HTTP POST to the internal interface possibly due to a buffer overflow.


eMule 0.29c allows remote attackers to cause a denial of service (crash) via a long password possibly due to a buffer overflow.


Pi3Web web server 2.0.2 Beta 1 when the Directory Index is configured to use the \Name\ column and sort using the column title as a hyperlink allows remote attackers to cause a denial of service (crash) via a malformed URL to the web server possibly involving a buffer overflow.


Buffer overflow in mIRC 6.12 when the DCC get dialog window has been minimized and the user opens the minimized window allows remote attackers to cause a denial of service (crash) via a long filename.


Buffer overflow in CuteFTP 5.0 and 5.0.1 allows local users to cause a denial of service (crash) by copying a long URL into a clipboard.


Buffer overflow in Siemens 45 series mobile phones allows remote attackers to cause a denial of service (disconnect and unavailable inbox) via a Short Message Service (SMS) message with a long image name.


Buffer overflow in mIRC 6.1 and 6.11 allows remote attackers to cause a denial of service (crash) via a long DCC SEND request.


Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.


Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long server name or (2) icy-url followed by a long URL.


Buffer overflow in Eudora Internet Mail Server (EIMS) 2.01 and earlier on MacOS systems allows remote attackers to cause a denial of service via a long USER command to port 106.


Buffer overflow in FTP server in Microsoft IIS 3.0 and 4.0 allows local and sometimes remote attackers to cause a denial of service via a long NLST (ls) command.


Buffer overflow in CSM Proxy 4.1 allows remote attackers to cause a denial of service (crash) via a long string to the FTP port.


Buffer overflow in OSF Distributed Computing Environment (DCE) security demon (secd) in IRIX 6.4 and earlier allows attackers to cause a denial of service via a long principal group or organization.


Buffer overflow in ping CGI program in Xylogics Annex terminal service allows remote attackers to cause a denial of service via a long query parameter.


Buffer overflow in iParty server 1.2 and earlier allows remote attackers to cause a denial of service (crash) by connecting to default port 6004 and sending repeated extended characters.


Buffer overflow in BFTelnet allows remote attackers to cause a denial of service via a long username.


Buffer overflow in NetMeeting allows denial of service and remote command execution.


Buffer overflow in FTP Serv-U 2.5 allows remote authenticated users to cause a denial of service (crash) via a long (1) CWD or (2) LS (list) command.


Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR .IDC or .STM extensions.


Buffer overflows in Windows NT 4.0 print spooler allow remote attackers to gain privileges or cause a denial of service via a malformed spooler request.


The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands.


Buffer overflow in SmartDesk WebSuite allows remote attackers to cause a denial of service via a long URL.


Buffer overflow in Serv-U FTP 2.5 allows remote users to conduct a denial of service via the SITE command.


Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users.


Buffer overflow in Remote Access Service (RAS) client allows an attacker to execute commands or cause a denial of service via a malformed phonebook entry.


Buffer overflow in GoodTech Telnet Server NT allows remote users to cause a denial of service via a long login name.


Buffer overflow in Lotus Notes LDAP (NLDAP) allows an attacker to conduct a denial of service through the ldap_search request.


Remote attackers can perform a denial of service in WinGate machines using a buffer overflow in the Winsock Redirector Service.


Eudora before 6.1.1 allows remote attackers to cause a denial of service (crash) via an e-mail with a long \To:\ field possibly due to a buffer overflow.


The sysinfo script in GeoHttpServer allows remote attackers to cause a denial of service (crash) via a long pwd parameter possibly triggering a buffer overflow.


login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter possibly due to a buffer overflow.


Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via a GET request with a long filename possibly due to a buffer overflow.


The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference. NOTE: in a followup advisory a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However the vendor's bug report clearly shows that the researcher later retracted this claim because the tested product was actually STABLE5.


Red-M Red-Alert 2.7.5 with software 3.1 build 24 allows remote attackers to cause a denial of service (reboot and loss of logged events) via a long request to TCP port 80 possibly triggering a buffer overflow.


WinAgents TFTP Server 3.0 allows remote attackers to cause a denial of service (crash) via a request for a file with a long file name possibly due to an off-by-one buffer overflow.


Buffer overflow in GlobalSCAPE Secure FTP Server 2.0 B03.11.2004.2 allows remote attackers to cause a denial of service (crash) via a SITE command with a long argument.


Buffer overflow in multiple F-Secure Anti-Virus products including F-Secure Anti-Virus 5.42 and earlier allows remote attackers to bypass scanning or cause a denial of service (crash or module restart) depending on the product via a malformed LHA archive.


Buffer overflow in ibserver for Firebird Database 1.0 and other versions before 1.5 and possibly other products that use the InterBase codebase allows remote attackers to cause a denial of service (crash) via a long database name as demonstrated using the gsec command.


Buffer overflow in Gyach Enhanced (Gyach-E) before 1.0.0-SneakPeek-3 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to \URL data.\


chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username parameter possibly due to a buffer overflow. NOTE: it was later reported that 2.2 is also affected.


Nortel Wireless LAN (WLAN) Access Point (AP) 2220 2221 and 2225 allow remote attackers to cause a denial of service (service crash) via a TCP request with a large string followed by 8 newline characters to (1) the Telnet service on TCP port 23 and (2) the HTTP service on TCP port 80 possibly due to a buffer overflow.


Buffer overflow in Alt-N MDaemon 7.0.1 allows remote attackers to cause a denial of service (application crash) via a long STATUS command to the IMAP server.


Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.


Master of Orion III 1.2.5 and earlier allows remote attackers to cause a denial of service (server crash) via multiple connections with long nicknames possibly triggering a buffer overflow.


Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433 possibly triggering a buffer overflow.


Buffer overflow in pop3svr.exe for DMS POP3 1.5.3.27 and earlier allows remote attackers to cause a denial of service (service crash) via a long (1) username or (2) password.


Buffer overflow in CuteFTP Professional 6.0 and possibly other versions allows remote FTP servers to cause a denial of service (application crash) via large replies to FTP commands.


Buffer overflow in Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a long nickname.


rufsi.dll in Symantec Virus Detection allows remote attackers to cause a denial of service (crash) via a long string to the GetPrivateProfileString function. NOTE: this issue was originally reported as a buffer overflow but that specific claim is disputed by the vendor although a crash is acknowledged.


Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\\' (backslash) character which prevents a string from being NULL terminated.


Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username.


Buffer overflow in Soldier of Fortune II 1.03 Gold and earlier allows remote attackers to cause a denial of service (server or client crash) via a long (1) query or (2) reply.


application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (VxWorks OS crash) via a long HTTP GET request possibly triggering a buffer overflow.


Buffer overflow in Terminator 3: War of the Machines 1.0 allows remote attackers to cause a denial of service via a long ServerInfo variable.


Mcafee FreeScan allows remote attackers to cause a denial of service and possibly arbitrary code via a long string in the ScanParam property of a COM object which may trigger a buffer overflow.


The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long filename possibly triggering a buffer overflow.


Buffer overflow in Monolith games including (1) Alien versus Predator 2 1.0.9.6 and earlier (2) Blood 2 2.1 and earlier (3) No one lives forever 1.004 and earlier and (4) Shogo 2.2 and earlier allows remote attackers to cause a denial of service (application crash) via a long secure Gamespy query.


Call of Duty 1.4 and earlier allows remote attackers to cause a denial of service (game end) via a large (1) query or (2) reply packet which is not properly handled by the buffer overflow protection mechanism. NOTE: this issue might overlap CVE-2005-0430.


Buffer overflow in 3Com OfficeConnect Remote 812 ADSL Router 1.1.9.4 allows remote attackers to cause a denial of service (reboot or packet loss) via a long string containing Telnet escape characters to the Telnet port.


LionMax Software WWW File Share Pro 2.60 allows remote attackers to cause a denial of service (crash or hang) via a long URL possibly triggering a buffer overflow.


The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion) and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems via long header lines with large numbers of space or tab characters.


Xlight FTP server 1.52 allows remote authenticated users to cause a denial of service (crash) via a RETR command with a long argument containing a large number of / (slash) characters possibly triggering a buffer overflow.


Buffer overflow in Avirt Soho 4.3 allows remote attackers to cause a denial of service (crash) via (1) a large GET request to port 1080 or (2) a large GET request of % characters to port 8080.


Xlight 1.52 with log to screen enabled allows remote attackers to cause a denial of service by requesting a long directory consisting of . (dot) and / (slash) characters which causes the server to crash when the administrator views the log file possibly triggering a buffer overflow.


Multiple vulnerabilities in Nokia 6310(i) Mobile phones allow remote attackers to cause a denial of service (reset) via malformed Bluetooth OBject EXchange (OBEX) messages probably triggering buffer overflows.


Buffer overflow in sdbscan in SignatureDB 0.1.1 allows local users to cause a denial of service (segmentation fault) via a database file that contains a large key parameter.


Buffer overflow in smallftpd 0.99 allows local users to cause a denial of service (crash) via an FTP request with a large number of \/\ (slash) characters.


Buffer overflow in Netopia Timbuktu 7.0.3 allows remote attackers to cause a denial of service (server process crash) via a certain data string that is sent to multiple simultaneous client connections to TCP port 407.


The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier.


The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.


The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape.


There is a buffer overflow in Liblouis 3.2.0 triggered in the function _lou_showString() in utils.c that will lead to a remote denial of service attack.


Buffer overflow in hasplms in Gemalto ACC (Admin Control Center) all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50 allows remote attackers to shut down the remote process (a denial of service) via a language pack (ZIP file) with invalid HTML files.


There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image which causes a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack.


In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7 ext/intl/msgformat/msgformat_parse.c does not restrict the locale length which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact within International Components for Unicode (ICU) for C/C++ via a long first argument to the msgfmt_parse_message function.


The ExifJpegHUFFTable::deriveTable function in ExifHuffmanTable.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted jpg file.


Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.


unrarlib.c in unrar-free 0.0.1 when _DEBUG_LOG mode is enabled might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via an RAR archive containing a long filename.


In PHP before 5.6.31 7.x before 7.0.21 and 7.1.x before 7.1.7 a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function e.g. a web application for syntax validation of php.ini directives.


A routine within an internal Junos OS sockets library is vulnerable to a buffer overflow. Malicious exploitation of this issue may lead to a denial of service (kernel panic) or be leveraged as a privilege escalation through local code execution. The routines are only accessible via programs running on the device itself and veriexec restricts arbitrary programs from running on Junos OS. There are no known exploit vectors utilizing signed binaries shipped with Junos OS itself. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D67; 12.3X48 prior to 12.3X48-D51 12.3X48-D55; 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R2-S10 14.1R8-S4 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D122 14.1X53-D45 14.1X53-D50; 14.2 prior to 14.2R4-S9 14.2R7-S7 14.2R8; 15.1 prior to 15.1F2-S18 15.1F6-S7 15.1R4-S8 15.1R5-S5 15.1R6-S1 15.1R7; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D231 15.1X53-D47 15.1X53-D48 15.1X53-D57 15.1X53-D64 15.1X53-D70; 16.1 prior to 16.1R3-S4 16.1R4-S3 16.1R4-S4 16.1R5; 16.2 prior to 16.2R2; 17.1 prior to 17.1R1-S3 17.1R2; 17.2 prior to 17.2R1-S1 17.2R2; 17.2X75 prior to 17.2X75-D30. No other Juniper Networks products or platforms are affected by this issue.


The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file possibly related to a read overflow in the grub_disk_read_small_real function in kern/disk.c in GNU GRUB 2.02.


The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 do not ensure a unique PLT entry for a symbol which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file related to elf32-i386.c and elf64-x86-64.c.


The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file related to hevc_decode_init1.


The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.


GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document a different vulnerability than CVE-2017-10928.


Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files.


Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature leading to an error in the skb_to_sgvec function.


Multiple heap-based buffer overflows in parser.c in libming 0.4.7 allow remote attackers to cause a denial of service (listswf application crash) or possibly have unspecified other impact via a crafted SWF file. NOTE: this issue exists because of an incomplete fix for CVE-2016-9831.


The

function

in

in

the

Linux

kernel

before

allows

local

users

to

cause

a

denial

of

service

(buffer

overflow

and

system

crash)

or

possibly

gain

privileges

via

a

crafted

Netlink

packet.


The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call leading to out-of-bounds write access in the sg_write function.


Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecified other impact via a long password.


The dalvik_disassemble function in libr/asm/p/asm_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.


partclone.chkimg in partclone 0.2.89 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to launch a 'Denial of Service attack' in the context of the user running the affected application.


Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator) when the VLANSTRIP feature is enabled on the vmxnet3 device allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.


The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.


The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.


Stack-based buffer overflow in the parse_identifier function in tgsi_text.c in the TGSI auxiliary module in the Gallium driver in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to parsing properties.


Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.


A Stack-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vulnerability causes a buffer overflow which could result in denial of service when a malicious project file is run on the system.


Heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Library (aka audiofile) 0.3.6 0.3.5 0.3.4 0.3.3 0.3.2 0.3.1 0.3.0 allows remote attackers to cause a denial of service (crash) via a crafted file.


mspack/lzxd.c in libmspack 0.5alpha as used in ClamAV 0.99.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.


elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a \buffer overflow on fuzzed archive header \ related to an uninitialized variable an improper conditional jump and the get_archive_member_name process_archive_index_and_symbols and setup_archive functions.


A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13 1.3.7.x before 1.3.7.9 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request thus resulting in denial of service.


A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4. An attacker could cause a denial of service condition or potentially even arbitrary code execution.


WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit_stream.c MagickBitStreamMSBWrite heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string as demonstrated by ZNC.


tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file.


The Enterprise version of SyncBreeze 10.2.12 and earlier is affected by a Remote Denial of Service vulnerability. The web server does not check bounds when reading server requests in the Host header on making a connection resulting in a classic Buffer Overflow that causes a Denial of Service.


WTF/wtf/FastBitVector.h in WebKit as distributed in Safari Technology Preview Release 46 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector size and resizeSlow mishandles cases where the old array length is greater than the new array length.


The ff_free_picture_tables function in libavcodec/mpegpicture.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file related to vc1_decode_i_blocks_adv.


The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 does not properly validate the size of the external string table which allows remote attackers to cause a denial of service (excessive memory consumption or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary.


pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document.


The printMP3Headers function in util/listmp3.c in libming v0.4.8 or earlier is vulnerable to a global buffer overflow which may allow attackers to cause a denial of service via a crafted file a different vulnerability than CVE-2016-9264.


The wav_convert2mono function in lib/wav.c in SWFTools 0.9.2 does not properly validate WAV data which allows remote attackers to cause a denial of service (incorrect malloc and heap-based buffer overflow) or possibly have unspecified other impact via a crafted file.


The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.


coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file related to the AcquireCacheNexus function in magick/pixel_cache.c.


Stack-based

buffer

overflow

in

the

function

in

in

virglrenderer

before

as

used

in

Quick

Emulator

(QEMU)

allows

a

local

guest

users

to

cause

a

denial

of

service

(application

crash)

via

the

argument.


Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A malicious or malformed Flash source file can cause a denial of service condition when parsed by this component causing the application to crash.


picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buffer overflow resulting in code execution or denial of service attack


The

function

in

WildMIDI

since

commit

allows

remote

attackers

to

cause

a

denial

of

service

(heap-based

buffer

overflow

and

application

crash)

or

possibly

have

unspecified

other

impact

via

a

crafted

file.


libavcodec/webp.c in FFmpeg before 2.8.12 3.0.x before 3.0.8 3.1.x before 3.1.8 3.2.x before 3.2.5 and 3.3.x before 3.3.1 does not ensure that pix_fmt is set which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions.


The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of rae insns printing for this file during \objdump -D\ execution.


PJSIP as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 Certified Asterisk 13.13 before 13.13-cert4 and other products allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.


bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during \objdump -D\ execution.


The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


The III_dequantize_sample function in layer3.c in mpglib as used in libmpgdecoder.a in LAME 3.99.5 and other products allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12 3.0.x before 3.0.8 3.1.x before 3.1.8 3.2.x before 3.2.5 and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.


The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.


The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution. NOTE: this may be related to a compiler bug.


The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted document.


opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.


The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12 3.0.x before 3.0.8 3.1.x before 3.1.8 3.2.x before 3.2.5 and 3.3.x before 3.3.1 does not exclude the CHUNKY format which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.


Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12 3.0.x before 3.0.8 3.1.x before 3.1.8 3.2.x before 3.2.5 and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.


Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv0. An example threat model is a web application that launches dnstracer with an untrusted name string.


The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.


The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


The III_i_stereo function in layer3.c in mpglib as used in libmpgdecoder.a in LAME 3.99.5 and other products allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution. NOTE: this may be related to a compiler bug.


opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by mishandling of this file during \objdump -D\ execution.


AeroAdmin 4.1 uses a function to copy data between two pointers where the size of the data copied is taken directly from a network packet. This can cause a buffer overflow and denial of service.


Buffer overflow in Ether Software Easy MOV Converter 1.4.24 Easy DVD Creator Easy MPEG/AVI/DIVX/WMV/RM to DVD Easy Avi/Divx/Xvid to DVD Burner Easy MPEG to DVD Burner Easy WMV/ASF/ASX to DVD Burner Easy RM RMVB to DVD Burner Easy CD DVD Copy MP3/AVI/MPEG/WMV/RM to Audio CD Burner MP3/WAV/OGG/WMA/AC3 to CD Burner MP3 WAV to CD Burner My Video Converter Easy AVI DivX Converter Easy Video to iPod Converter Easy Video to PSP Converter Easy Video to 3GP Converter Easy Video to MP4 Converter and Easy Video to iPod/MP4/PSP/3GP Converter allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecified other impact via a long username.


The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file.


Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file.


The iw_process_cols_to_intermediate function in imagew-main.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image.


Stack-based

buffer

overflow

in

the

function

in

in

RIOT

prior

to

allows

local

attackers

and

potentially

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

malformed

address.


pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.


The strescape function in ec_strings.c in Ettercap 0.8.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted filter that is mishandled by etterfilter.


The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.


Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors related to m_offsets.size.


LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file as demonstrated by mishandling of num_channels.


The read_buf function in stream.c in rzip 2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.


The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before 4.1(2.33) on 7010 MSE 8710 Multiparty Media 310 and 320 and Virtual Machine devices allows remote attackers to cause a denial of service (device crash) via a crafted URL aka Bug ID CSCuu28277.


The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 uses an incorrect argument to the sscanf function which might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via unknown vectors.


Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family name.


The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image.


Stack-based buffer overflow in Hospira Communication Engine (CE) before 1.2 in LifeCare PCA Infusion System 5.07 Plum A+ Infusion System 13.40 and Plum A+3 Infusion System 13.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via traffic on TCP port 5000.


Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier CENTUM CS 3000 R3.09.50 and earlier CENTUM CS 3000 Entry R3.09.50 and earlier CENTUM VP R5.04.20 and earlier CENTUM VP Entry R5.04.20 and earlier ProSafe-RS R3.02.10 and earlier Exaopc R3.72.00 and earlier Exaquantum R2.85.00 and earlier Exaquantum/Batch R2.50.30 and earlier Exapilot R3.96.10 and earlier Exaplog R3.40.00 and earlier Exasmoc R4.03.20 and earlier Exarqe R4.03.20 and earlier Field Wireless Device OPC Server R2.01.02 and earlier PRM R3.12.00 and earlier STARDOM VDS R7.30.01 and earlier STARDOM OPC Server for Windows R3.40 and earlier FAST/TOOLS R10.01 and earlier B/M9000CS R5.05.01 and earlier B/M9000 VP R7.03.04 and earlier and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (network-communications outage) via a crafted packet.


Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors which are not properly handled in (1) json or (2) jsonb values.


Stack-based buffer overflow in the handle_debug_network function in the manager in Websense Content Gateway before 8.0.0 HF02 allows remote administrators to cause a denial of service (crash) via a crafted diagnostic command line request to submit_net_debug.cgi.


Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier CENTUM CS 3000 R3.09.50 and earlier CENTUM CS 3000 Entry R3.09.50 and earlier CENTUM VP R5.04.20 and earlier CENTUM VP Entry R5.04.20 and earlier ProSafe-RS R3.02.10 and earlier Exaopc R3.72.00 and earlier Exaquantum R2.85.00 and earlier Exaquantum/Batch R2.50.30 and earlier Exapilot R3.96.10 and earlier Exaplog R3.40.00 and earlier Exasmoc R4.03.20 and earlier Exarqe R4.03.20 and earlier Field Wireless Device OPC Server R2.01.02 and earlier PRM R3.12.00 and earlier STARDOM VDS R7.30.01 and earlier STARDOM OPC Server for Windows R3.40 and earlier FAST/TOOLS R10.01 and earlier B/M9000CS R5.05.01 and earlier B/M9000 VP R7.03.04 and earlier and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (process outage) via a crafted packet.


Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU when built with SCSI-device emulation support allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.


Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.


Buffer overflow in form2ping.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to cause a denial of service (device outage) via a long ipaddr parameter.


Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43 5.5.x before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.


Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file related to the page global variable.


Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.9); Nexus 3000 devices 6.0(2)U5(1.41) 7.0(3)I2(0.373) and 7.3(0)ZN(0.83); Nexus 4000 devices 4.1(2)E1(1b); Nexus 7000 devices 6.2(14)S1; Nexus 9000 devices 7.3(0)ZN(0.9); and MDS 9000 devices 6.2 (13) and 7.1(0)ZN(91.99) and MDS SAN-OS 7.1(0)ZN(91.99) allows remote attackers to cause a denial of service (device outage) via a crafted ARP packet related to incorrect MTU validation aka Bug IDs CSCuv71933 CSCuv61341 CSCuv61321 CSCuu78074 CSCut37060 CSCuv61266 CSCuv61351 CSCuv61358 and CSCuv61366.


Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request aka the SDK issue.


The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \\ (backslash) followed by a terminator as demonstrated by \\\\\\\0\ which triggers a buffer overflow and over-read.


Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request aka the ISAPI issue.


Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.81) Nexus 3000 devices 7.3(0)ZN(0.81) Nexus 4000 devices 4.1(2)E1(1c) Nexus 7000 devices 7.2(0)N1(0.1) and Nexus 9000 devices 7.3(0)ZN(0.81) allows remote attackers to cause a denial of service (IGMP process restart) via a malformed IGMPv3 packet that is mishandled during memory allocation aka Bug IDs CSCuv69713 CSCuv69717 CSCuv69723 CSCuv69732 and CSCuv48908.


Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request aka the PSIA issue.


The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1964 and CVE-2015-1965.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium as used in Google Chrome before 40.0.2214.91 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted PDF document related to an \intra-object-overflow\ issue a different vulnerability than CVE-2015-1205.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


Heap-based buffer overflow in j2k.c in OpenJPEG before r3002 as used in PDFium in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document.


The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


PDFium as used in Google Chrome before 44.0.2403.89 does not properly handle certain out-of-memory conditions which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 and CVE-2015-1965.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1954 CVE-2015-1962 CVE-2015-1963 and CVE-2015-1964.


Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors a different vulnerability than CVE-2015-1924 CVE-2015-1925 CVE-2015-1929 CVE-2015-1930 CVE-2015-1948 CVE-2015-1953 CVE-2015-1962 CVE-2015-1963 CVE-2015-1964 and CVE-2015-1965.


Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier when the PID for pppd is greater than 65535 allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.


PCRE 7.8 and 8.32 through 8.37 and PCRE2 10.10 mishandle group empty matches which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression as demonstrated by /^(?:(?(1)\\\\.|(^\\\\\\\\W_)?)+)+$/.


Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request aka SAP Security Note 2132584.


Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0 Firefox ESR 31.x before 31.8 and 38.x before 38.1 and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.


The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.


The mp2t_find_next_pcr function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not reserve memory for a trailer which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file.


PCRE before 8.38 mishandles the /(?|(\\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


The

function

in

in

PCRE

before

and

in

before

mishandles

the

/(?J:(?|(:(?|(?'R')(\\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/

and

/(?J:(?|(:(?|(?'R')(\\z(?|(?'R')(\\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/

patterns

and

related

patterns

with

certain

group

references

which

allows

remote

attackers

to

cause

a

denial

of

service

(heap-based

buffer

overflow)

or

possibly

have

unspecified

other

impact

via

a

crafted

regular

expression

as

demonstrated

by

a

JavaScript

RegExp

object

encountered

by

Konqueror.


Buffer overflow in the png_set_PLTE function in libpng before 1.0.65 1.1.x and 1.2.x before 1.2.55 1.3.x 1.4.x before 1.4.18 1.5.x before 1.5.25 and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.


PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\\g{d}))/ pattern and related patterns with certain recursive back references which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror a related issue to CVE-2015-8392 and CVE-2015-8395.


The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \\01 string which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64 1.1.x and 1.2.x before 1.2.54 1.3.x and 1.4.x before 1.4.17 1.5.x before 1.5.24 and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.


PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship between the total length and the capture length which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.


Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.


PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


The

dissect_diameter_base_framed_ipv6_prefix

function

in

in

the

DIAMETER

dissector

in

Wireshark

before

and

before

does

not

validate

the

prefix

length

which

allows

remote

attackers

to

cause

a

denial

of

service

(stack-based

buffer

overflow

and

application

crash)

via

a

crafted

packet.


Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application a different vulnerability than CVE-2015-8318.


PCRE before 8.38 mishandles certain instances of the (?| substring which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror a related issue to CVE-2015-8384 and CVE-2015-8395.


Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU when built with SCSI MegaRAID SAS HBA emulation support allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.


Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application a different vulnerability than CVE-2015-8319.


PCRE before 8.38 mishandles certain repeated conditional groups which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


The Mobile Identity parser in (1) epan/dissectors/packet-ansi_a.c in the ANSI A dissector and (2) epan/dissectors/packet-gsm_a_common.c in the GSM A dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly uses the tvb_bcd_dig_to_wmem_packet_str function which allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted packet.


Heap-based buffer overflow in Mozilla Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service (crash) via a VCard attachment with a malformed base64 field which copies more data than expected due to an integer underflow.


Buffer overflow in wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted Excel files.


DISPUTED

Off-by-one

buffer

overflow

in

the

Instance_options::complete_initialization

function

in

in

the

Instance

Manager

in

MySQL

before

and

before

might

allow

local

users

to

cause

a

denial

of

service

(application

crash)

via

unspecified

vectors

which

triggers

the

overflow

when

the

function

is

called.

NOTE:

the

vendor

has

disputed

this

issue

via

e-mail

to

CVE

saying

that

it

is

only

exploitable

when

the

user

has

access

to

the

configuration

file

or

the

Instance

Manager

daemon.

Due

to

intended

functionality

this

level

of

access

would

already

allow

the

user

to

disrupt

program

operation

so

this

does

not

cross

security

boundaries

and

is

not

a

vulnerability.


Buffer overflow in the TCP/IP listener in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allows remote attackers to cause a denial of service (application crash) via a long MGRLVLLS message inside of an EXCSAT message when establishing a connection.


Multiple unspecified vulnerabilities in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allow remote attackers to cause a denial of service (application crash) via a (1) \long column list\ in the (a) REPLACE INTO and (b) INSERT INTO portions of the LOAD command or a (2) large number of values in an IN clause possibly related to a buffer overflow.


Multiple stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp (TunePimp) 0.4.2 allow remote user-assisted attackers to cause a denial of service (application crash) and possibly execute code via a long (1) Album release date (MBE_ReleaseGetDate) (2) data or (3) error strings.


Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll as used by Microsoft Word and possibly other products in Microsoft Office 2003 2002 and 2000 allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type. NOTE: this issue was originally reported to allow code execution but on 20060710 Microsoft stated that code execution is not possible and the original researcher agrees.


Buffer overflow in filecpnt.exe in FileCOPA 1.01 allows remote attackers to cause a denial of service (application crash) via a username with a large number of newline characters.


Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of service via a long argument to the PORT command.


Buffer overflow in the WebTool HTTP server component in (1) PunkBuster before 1.229 as used by multiple products including (2) America's Army 1.228 and earlier (3) Battlefield 1942 1.158 and earlier (4) Battlefield 2 1.184 and earlier (5) Battlefield Vietnam 1.150 and earlier (6) Call of Duty 1.173 and earlier (7) Call of Duty 2 1.108 and earlier (8) DOOM 3 1.159 and earlier (9) Enemy Territory 1.167 and earlier (10) Far Cry 1.150 and earlier (11) F.E.A.R. 1.093 and earlier (12) Joint Operations 1.187 and earlier (13) Quake III Arena 1.150 and earlier (14) Quake 4 1.181 and earlier (15) Rainbow Six 3: Raven Shield 1.169 and earlier (16) Rainbow Six 4: Lockdown 1.093 and earlier (17) Return to Castle Wolfenstein 1.175 and earlier and (18) Soldier of Fortune II 1.183 and earlier allows remote attackers to cause a denial of service (application crash) via a long webkey parameter.


Buffer overflow in zawhttpd 0.8.23 and possibly previous versions allows remote attackers to cause a denial of service (daemon crash) via a request for a URI composed of several \\\\ (backslash) characters.


Buffer overflow in INETCOMM.DLL as used in Microsoft Internet Explorer 6.0 through 6.0 SP2 Windows Explorer Outlook Express 6 and possibly other programs allows remote user-assisted attackers to cause a denial of service (application crash) via a long mhtml URI in the URL value in a URL file.


Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets possibly involving invalid headers and an attacker-controlled payload length. NOTE: this issue might be a buffer overflow or overread.


Nokia N70 cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet possibly triggering a buffer overflow as demonstrated using the Bluetooth Stack Smasher (BSS).


Buffer overflow in l2cap.c in hcidump 1.29 allows remote attackers to cause a denial of service (crash) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet.


The cairo library (libcairo) as used in GNOME Evolution and possibly other products allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains \Content-Disposition: inline\ in the header and a very long line in the body which causes the client to repeatedly crash until the e-mail message is manually removed possibly due to a buffer overflow as demonstrated using an XML attachment.


Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.


Buffer overflow in Sony Ericsson K600i V600i W800i and T68i cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet.


Buffer overflow in certain versions of South River (aka SRT) WebDrive possibly version 6.08 build 1131 and version 8 allows remote attackers to cause a denial of service (application crash and persistent erratic behavior) via a long string in the name entry field.


NCP Network Communication Secure Client 8.11 Build 146 and possibly other versions allows local users to cause a denial of service (memory usage and cpu utilization) via a flood of arbitrary UDP datagrams to ports 0 to 65000. NOTE: this issue was reported as a buffer overflow but that term usually does not apply in flooding attacks.


Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device crash) via SIP INVITE commands with a long header field name sent during startup and (2) cause a denial of service (device hang or crash) via SIP INVITE commands with a long header field name sent during a call.


NCP Network Communication Secure Client 8.11 Build 146 and possibly other versions allows local users to cause a denial of service (CPU consumption) via a large number of arguments to ncprwsnt.exe possibly due to a buffer overflow.


Buffer overflow in socket/request.c in CrossFire before 1.9.0 when oldsocketmode is enabled allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request.


Buffer overflow in Vavoom 1.19.1 and earlier allows remote attackers to cause a denial of service (application crash) via an invalid comprLength value in a compressed packet.


Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash) as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo which leads to an incorrect memory allocation due to a typo in an expression that uses a \&\ instead of a \*\ operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.


Novell Netware NWFTPD 5.06.05 allows remote attackers to cause a denial of service (ABEND) via an MDTM command that uses a long path for the target file possibly due to a buffer overflow.


Buffer overflow in Tenes Empanadas Graciela (TEG) 0.11.1 automatically appends an _ (underscore) to the end of duplicate nicknames which allows remote attackers to cause a denial of service (application crash) by creating multiple users with long identical nicknames which triggers an off-by-one error.


Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14 and possibly other versions when index files are used and mmap_disable is set to \yes \ allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.


Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers to cause a denial of service (application crash) or have other unknown impact via (1) a long Location field sent by a web server which triggers an overflow in the reconnect function in reader/http/http.c; (2) a long URL sent by a web server when AlsaPlayer is seeking a media file for the playlist which triggers overflows in new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp; and (3) a long response sent by a CDDB server which triggers an overflow in cddb_lookup in input/ccda/cdda_engine.c.


IrfanView 3.98 (with plugins) allows user-assisted attackers to cause a denial of service (application crash) via a crafted ANI image file possibly due to a buffer overflow.


Multiple unspecified vulnerabilities in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allow remote attackers to cause a denial of service (crash) via a crafted RADIUS Access-Request packet. NOTE: it has been reported that at least one issue is a heap-based buffer overflow involving the Tunnel-Password attribute.


Buffer overflow in Tftpd32 3.01 allows remote attackers to cause a denial of service via a long GET or PUT request which is not properly handled when the request is displayed in the title of the gauge window.


Multiple buffer overflows in FTP Print Server 2.4 and 2.4.5 in HP LaserJet 5000 Series printers with firmware R.25.15 or R.25.47 and HP LaserJet 5100 Series printers with firmware V.29.12 allow remote attackers to cause a denial of service (device crash) via a long string in the (1) LIST or (2) NLST command.