In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler ndp_cfg len and num_ndp_app_info is from fw. If they are not checked it may cause buffer over-read once the value is too large.


htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header.


TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read as demonstrated by bmp2tiff.


in

image.cpp

in

has

a

heap-based

buffer

over-read.


An

issue

was

discovered

in

The

Exiv2::Internal::PngChunk::parseTXTChunk

function

has

a

heap-based

buffer

over-read.


bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5T_copy in H5T.c.


An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A buffer over-read can occur in pbc_wmessage_string in wmessage.c for PTYPE_ENUM.


The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().


In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7 the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5VM_memcpyvv in H5VM.c.


An issue was discovered in libthulac.so in THULAC through 2018-02-25. A heap-based buffer over-read can occur in NGramFeature::find_bases in include/cb_ngram_feature.h.


The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print().


An

issue

was

discovered

in

There

is

a

heap-based

buffer

over-read

in

in

after

a

call

from

a

related

issue

to


The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().


The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().


An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c as demonstrated by aubionotes.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_sdspace_decode in H5Osdspace.c.


The

LMP

parser

in

tcpdump

before

has

a

buffer

over-read

in

print-lmp.c:lmp_print_data_link_subobjs().


The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().


The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().


The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c related to HDmemcpy.


The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.


The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().


The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().


While parsing a Flac file with a corrupted comment block a buffer over-read can occur in Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear.


libreadstat.a in WizardMac ReadStat 0.1.1 has a heap-based buffer over-read via an unterminated string.


In wlan_hdd_cfg80211_set_privacy_ibss() in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05 a buffer over-read can potentially occur.


While reading the data from buffer in dci_process_ctrl_status() there can be buffer over-read problem if the len is not checked correctly in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


While processing a WMI_APFIND event in all Android releases from CAF using the Linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-07-05 a buffer over-read and information leak can potentially occur.


While padding or shrinking a nested wmi packet in all Android releases from CAF using the Linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-07-05 a buffer over-read can potentially occur.


Buffer over-read may happen in wma_process_utf_event() due to improper buffer length validation before writing into param_buf->num_wow_packet_buffer in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


LibTIFF before 4.0.6 mishandles the reading of TIFF files as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.


While processing a debug log event from firmware in all Android releases from CAF using the Linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-07-05 an integer underflow and/or buffer over-read can occur.


** DISPUTED ** The libesedb_page_read_tags function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments.


** DISPUTED ** The libesedb_catalog_definition_read function in libesedb_catalog_definition.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments.


** DISPUTED ** The libesedb_key_append_data function in libesedb_key.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments.


** DISPUTED ** The libesedb_page_read_values function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments.


** DISPUTED ** The libfsclfs_block_read function in libfsclfs_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a heap-based buffer over-read via a crafted clfs file. NOTE: the vendor has disputed this as described in the GitHub issue comments.


JSON++ through 2016-06-15 has a buffer over-read in yyparse() in json.y.


An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.


An integer underflow bug in the process_EXIF function of the exif.c file of jhead 3.00 raises a heap-based buffer over-read when processing a malicious JPEG file which may allow a remote attacker to cause a denial-of-service attack or unspecified other impact.


An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image a different vulnerability than CVE-2018-7588. This is in a Monochrome case aka case 1.


An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer dereference of the parse_SST function.


An

issue

was

discovered

in

Exempi

through

mishandles

a

case

of

a

zero

length

leading

to

a

heap-based

buffer

over-read

in

the

function

in


An

issue

was

discovered

in

Exempi

through

A

certain

case

of

a

length

is

mishandled

in

leading

to

a

heap-based

buffer

over-read

in

the

function.


An

issue

was

discovered

in

Exempi

through

There

is

a

stack-based

buffer

over-read

in

the

function

in


An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image a different vulnerability than CVE-2018-7588. This is in a \16 colors\ case aka case 4.


An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image a different vulnerability than CVE-2018-7588. This is in a \32 bits colors\ case aka case 32.


An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function.


An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the function read_mini_biff_next_record.


An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image a different vulnerability than CVE-2018-7588. This is in a \16 bits colors\ case aka case 16.


An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function.


The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.


An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image a different vulnerability than CVE-2018-7588. This is in a \256 colors\ case aka case 8.


An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image.


An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_unicode_string function.


The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().


The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().


An issue was discovered in Contiki-NG through 4.1. There is a buffer over-read in lookup in os/storage/antelope/lvm.c while parsing AQL (lvm_register_variable lvm_set_variable_value create_intersection create_union).


_bson_iter_next_internal in bson-iter.c in libbson 1.12.0 as used in MongoDB mongo-c-driver and other products has a heap-based buffer over-read via a crafted bson buffer.


libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c leading to a heap-based buffer over-read and an application crash.


The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.


The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \\MAILSLOT\\BROWSE and \\PIPE\\LANMAN.


In Pillow before 8.1.0 SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.


In Pillow before 8.1.0 PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.


An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.


An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.


An issue was discovered in fast_ber through v0.4. yy::yylex() in asn_compiler.hpp has a heap-based buffer over-read.


An issue was discovered in cpp-peglib through v0.1.12. peg::resolve_escape_sequence() in peglib.h has a heap-based buffer over-read.


Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow related to adaptmap_reg.c and adaptmap.c.


Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream related to tiffio.c.


Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c.


An issue was discovered in Arm Mbed TLS before 2.24.0. mbedtls_x509_crl_parse_der has a buffer over-read (of one byte).


Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.


A buffer over-read vulnerability exists in bl <4.0.3 <3.0.1 <2.2.1 and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative the BufferList state can be corrupted tricking it into exposing uninitialized memory via regular .slice() calls.


An issue was discovered in gpac 0.8.0. The strdup function in box_code_base.c has a heap-based buffer over-read.


An issue was discovered in gpac 0.8.0. The gf_odf_del_ipmp_tool function in odf_code.c has a heap-based buffer over-read.


has

a

global

buffer

over-read

in

Exiv2::Internal::Nikon1MakerNote::print0x0088

in

which

can

result

in

an

information

leak.


JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.


GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.


An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a heap-based buffer over-read in the Shannon baseband. The Samsung ID is SVE-2020-17239 (August 2020).


hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.


GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy_compressed_bytes in decode_r2007.c.


GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c.


jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.


GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c.


jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.


GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr_read in decode.c.


An issue was discovered in Qt through 5.12.9 and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.


Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.


In MediaInfoLib in MediaArea MediaInfo 20.03 there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).


Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in QCA6390 QCN7605 QCS404 SA415M SA515M SC8180X SDX55 SM8250


Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses packet in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.


Possible Buffer over-read in ARP/NS parsing due to lack of check of packet length received in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory requirement in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it as more number of immutable schedules in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


Buffer over-read can happen while processing WPA RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap configuration request received from peer device.' in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in APQ8009 APQ8053 QCA6390 QCN7605 SA415M SA515M SC8180X SDX55 SM8250


Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.


ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.


slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.


libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.


In version 4.8.0 and earlier of The Sleuth Kit (TSK) there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.


u'Buffer

over-read

issue

in

Bluetooth

peripheral

firmware

due

to

lack

of

check

for

invalid

opcode

and

length

of

opcode

received

from

central

device(This

CVE

is

equivalent

to

Link

Layer

Length

Overfow

issue

and

Silent

Length

Overflow

mentioned

in

sweyntooth

paper)'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

in

Bitra

Kamorta

Nicobar

Rennell


A

buffer

over-read

was

discovered

in

the

CoAP

library

in

Arm

Mbed

OS

The

CoAP

parser

is

responsible

for

parsing

received

CoAP

packets.

The

function

sn_coap_parser_options_parse_multiple_options()

parses

CoAP

options

that

may

occur

multiple

consecutive

times

in

a

single

packet.

While

processing

the

options

is

accessed

after

being

incremented

by

without

a

prior

out-of-bounds

memory

check.

The

is

validated

for

a

correct

range

but

the

range

valid

for

is

derived

from

the

amount

of

allocated

heap

memory

not

the

actual

input

size.

Therefore

the

check

of

may

be

insufficient

for

safe

access

to

the

area

pointed

to

by

As

a

result

access

to

a

memory

area

outside

of

the

intended

boundary

of

the

packet

buffer

is

made.


tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c.


Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer as well as by the option delta and option length bytes. The actual input packet length is not verified against the number of bytes read when processing the option extended delta and the option extended length. Moreover the calculation of the message_left variable in the case of non-extended option deltas is incorrect and indicates more data left for processing than provided in the function input. All of these lead to heap-based or stack-based memory location read access that is outside of the intended boundary of the buffer. Depending on the platform-specific memory management mechanisms it can lead to processing of unintended inputs or system memory access violation errors.


A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the CoAP packet header starting from the message token. The length of the token in the received message is provided in the first byte parsed by the sn_coap_parser_options_parse() function. The length encoded in the message is not validated against the actual input buffer length before accessing the token. As a result memory access outside of the intended boundary of the buffer may occur.


ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c.


libjpeg-turbo 2.0.4 and mozjpeg 4.0.0 has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.


ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.


In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7 the AllJoyn dissector could crash with a buffer over-read triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by ensuring that a length variable properly tracked the state of a signature variable.


Artifex

Software

Inc.

MuJS

before

allows

context-dependent

attackers

to

obtain

sensitive

information

by

using

the

\crafted

JavaScript\

approach

related

to

a

\Buffer

Over-read\

issue.


parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read as demonstrated by a string that begins with a \ character and ends with a \\ character.


Yodl before 3.07.01 has a Buffer Over-read in the queue_push function in queue/queuepush.c.


In GIMP 2.8.22 there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image.


In GIMP 2.8.22 there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.


In GIMP 2.8.22 there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser related to mishandling of UTF-8 data.


In GIMP 2.8.22 there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\\0' character after the version string.


elfutils 0.170 has a buffer over-read in the ebl_dynamic_tag_name function of libebl/ebldynamictagname.c because SYMTAB_SHNDX is unsupported.


SMPlayer 19.5.0 has a buffer overflow via a long .m3u file.


Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.


GPAC 0.7.1 has a buffer overflow issue in gf_import_message() in media_import.c.


GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.


PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled.


GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.


Samba has a buffer overflow which allows a remote attacker to obtain root access by specifying a long password.


tcpdump 4.9.0 has a buffer overflow in the sliplink_print function in print-sl.c.


has

a

heap-based

buffer

over-read

in

in

rafimage.cpp.


Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.


Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class a different issue than CVE-2018-14531.


Potrace 1.14 has a heap-based buffer over-read in the interpolate_cubic function in mkbitmap.c.


tcpdump 4.9.0 has a heap-based buffer over-read in the pimv1_print function in print-pim.c.


tcpdump 4.9.0 has a heap-based buffer over-read in the lldp_print function in print-lldp.c related to util-print.c.


tinyexr 0.9.5 has a heap-based buffer over-read in LoadEXRImageFromMemory in tinyexr.h.


tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h related to OpenEXR code.


tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.


Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.


GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.


When ImageMagick 7.0.6-1 processes a crafted file in convert it can lead to a heap-based buffer over-read in the WritePSImage() function in coders/ps.c.


When ImageMagick 7.0.6-1 processes a crafted file in convert it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c related to the GetPixelLuma function in MagickCore/pixel-accessor.h.


When ImageMagick 7.0.6-1 processes a crafted file in convert it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c.


When ImageMagick 7.0.6-1 processes a crafted file in convert it can lead to a heap-based buffer over-read in the GetPixelIndex() function called from the WritePICONImage function in coders/xpm.c.


There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.


There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.


An issue has been found in LuPng through 2017-03-10. It is a heap-based buffer over-read in internalPrintf in miniz/lupng.c.


An

issue

has

been

found

in

in

has

a

heap-based

buffer

over-read

after

a

call

from

a

related

issue

to


An issue has been found in HTSlib 1.8. It is a buffer over-read in sam_parse1 in sam.c.


An issue has been discovered in Bento4 1.5.1-624. AP4_AvccAtom::Create in Core/Ap4AvccAtom.cpp has a heap-based buffer over-read.


An issue has been discovered in Bento4 1.5.1-624. AP4_Mp4AudioDsiParser::ReadBits in Codecs/Ap4Mp4AudioInfo.cpp has a heap-based buffer over-read.


An issue has been discovered in Bento4 1.5.1-624. AP4_BytesToUInt16BE in Core/Ap4Utils.h has a heap-based buffer over-read after a call from the AP4_Stz2Atom class.


An issue has been discovered in Bento4 1.5.1-624. AP4_MemoryByteStream::WritePartial in Core/Ap4ByteStream.cpp has a buffer over-read.


In Libav 12.3 there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that allows an attacker to cause denial-of-service via a crafted avi file.


In Libav 12.3 there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file.


In Libav 12.3 there is a heap-based buffer over-read in vc1_decode_p_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file.


In LibSass 3.5.5 a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.


In LibSass 3.5.5 a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.


In LibSass 3.5.5 a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import() a similar issue to CVE-2018-11693.


OpenSource Moddable v10.5.0 was discovered to contain buffer over-read in the fxDebugThrow function at /moddable/xs/sources/xsDebug.c.


In nDPI through 3.2 the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.


In nDPI through 3.2 the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c as demonstrated by a payload packet length that is too short.


In nDPI through 3.2 the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.


In nDPI through 3.2 the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.


ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.


ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.


ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.


ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.


ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.


ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function.


ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c.


SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.


SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.


A

stack-based

buffer

over-read

in

the

PdfEncryptMD5Base::ComputeEncryptionKey()

function

in

PdfEncrypt.cpp

in

PoDoFo

could

be

leveraged

by

remote

attackers

to

cause

a

denial-of-service

via

a

crafted

pdf

file.


A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.


stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.


stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.


stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.


stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.


When SWFTools 0.9.2 processes a crafted file in ttftool it can lead to a heap-based buffer over-read in the readBlock() function in lib/ttf.c.


njs through 0.3.1 used in NGINX has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.


In Wireshark 2.6.0 to 2.6.1 2.4.0 to 2.4.7 and 2.2.0 to 2.2.15 the ISMP dissector could crash. This was addressed in epan/dissectors/packet-ismp.c by validating the IPX address length to avoid a buffer over-read.


In Wireshark 2.6.0 to 2.6.1 2.4.0 to 2.4.7 and 2.2.0 to 2.2.15 dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.


In Wireshark 2.6.0 2.4.0 to 2.4.6 and 2.2.0 to 2.2.14 the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\\0' character.


The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13 Thunderbird before 3.0.11 and 3.1.x before 3.1.7 and SeaMonkey before 2.0.11 on Windows does not properly handle long strings which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.

buffer overread
arbitrary code execution


scanf.c in PHP 5.1.4 and earlier and 4.4.3 and earlier allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping which increments an index past the end of an array and triggers a buffer over-read.


Live555 through 1.08 mishandles huge requests for the same MP3 stream leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.


Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01) ICONICS GENESIS64 versions 10.97 and prior and ICONICS Hyper Historian versions 10.97 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64 or MC Works64 and execute commands against the database from GENESIS64 or MC Works64.


LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.


Extreme EXOS 15.7 16.x 21.x and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.


In LibTIFF 4.0.9 a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file as demonstrated by tiff2ps.


In

OpenCV

a

heap-based

buffer

overflow

happens

in

in

when

parsing

a

crafted

image

file.


In libsndfile before 1.0.28 an error in the \flac_buffer_copy()\ function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.


In libsndfile before 1.0.28 an error in the \header_read()\ function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.


In libslirp 4.1.0 as used in QEMU 4.2.0 tcp_subr.c misuses snprintf return values leading to a buffer overflow in later code.


grub2-bhyve as used in FreeBSD bhyve before revision 525916 2020-02-12 mishandles font loading by a guest through a grub2.cfg file leading to a buffer overflow.


In sam2p 0.49.3 the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.


In CCN-lite 2 the Parser of NDNTLV does not verify whether a certain component's length field matches the actual component length which has a resultant buffer overflow and out-of-bounds memory accesses.


In Live555 0.95 there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove.


In MiniShare 1.4.1 there is a stack-based buffer overflow via an HTTP CONNECT request which allows an attacker to achieve arbitrary code execution a similar issue to CVE-2018-19862 and CVE-2018-19861. NOTE: this product is discontinued.


In ImageMagick 7.0.6-10 there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.


In ncurses 6.0 there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.


In mruby 2.1.0 there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.


xterm through Patch 370 when Sixel support is enabled allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:496:29.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_rawpbm function in input-pnm.c:391:13.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-tga.c:528:7.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:337:25.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:497:29.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:355:25.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:370:25.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:353:25.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_ascii function in input-pnm.c:303:12.


libautotrace.a in AutoTrace 0.31.1 has a stack-based buffer overflow in the pnmscanner_gettoken function in input-pnm.c:458:12.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the rle_fread function in input-tga.c:252:15.


Parsing a maliciously crafted project file may cause a heap-based buffer overflow which may allow an attacker to perform arbitrary code execution. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).


Tenda AC9 v15.03.2.21 was discovered to contain a buffer overflow via the time parameter in the saveparentcontrolinfo function.


Adobe s 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable buffer overflow / underflow vulnerability in the XFA engine. Successful exploitation could lead to arbitrary code execution.


The affected product is vulnerable to a heap-based buffer overflow which may allow an attacker to manipulate memory with controlled values and remotely execute code on the OPC UA Tunneller (versions prior to 6.3.0.8233).


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel a potential buffer over flow could occur while processing the ndp event due to lack of check on the message length.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in WideVine DRM.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in the PlayReady API.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in an IPA driver.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in a WLAN function due to an incorrect message length.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists while loading a firmware image.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in a camera function.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in a QTEE application.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in a cryptographic routine.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel buffer overflow may occur when payload size is extremely large.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing vendor scan request when input argument - length of request IEs is greater than maximum can lead to a buffer overflow.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of length validation check for value received from firmware can lead to buffer overflow in nan response event handler.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of length validation check for value received from firmware can lead to buffer overflow in WMA handler.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Possible buffer overflow in WLAN function due to lack of input validation in values received from firmware.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel there is a possible buffer overflow in debugfs module due to lack of check in size of input before copying into buffer.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel there is a possible buffer overflow in display function due to lack of buffer length validation before copying.


In all Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in a syscall handler.


In all Android releases from CAF using the Linux kernel an integer underflow leading to buffer overflow vulnerability exists in a syscall handler.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in 1x call processing.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in PlayReady DRM.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in a QTEE service.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in the UIMDIAG interface.


In all Qualcomm products with Android releases from CAF using the Linux kernel due to lack of bounds checking on the variable \data_len\ from the function WLANQCMBR_McProcessMsg a buffer overflow may potentially occur in WLANFTM_McProcessMsg.


In all Qualcomm products with Android releases from CAF using the Linux kernel while processing an encrypted authentication management frame a stack buffer overflow may potentially occur.


In all Qualcomm products with Android release from CAF using the Linux kernel while processing fastboot boot command when verified boot feature is disabled with length greater than boot image buffer a buffer overflow can occur.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in HSDPA.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in the processing of certain responses from the USIM.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in an Inter-RAT procedure.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists in a procedure involving a remote UIM client.


In all Qualcomm products with Android releases from CAF using the Linux kernel a string can fail to be null-terminated in SIP leading to a buffer overflow.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists when processing a QMI message.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow vulnerability exists when performing WCDMA radio tuning.


protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.


super 3.11.6 and other versions have a buffer overflow in the syslog utility which allows a local user to gain root access.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800 while verifying provisioning a buffer overflow can occur.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625 SD 400 SD 800 SD 820 and SD 820A lack of input validation in QSEE can cause potential buffer overflow.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8974 lack of length checking in OEMCrypto_DeriveKeysFromSessionKey() could lead to a buffer overflow vulnerability.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615 MDM9625 MDM9635M SD 400 SD 600 and SD 800 a buffer overflow can occur when processing an audio buffer.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12 SD 425 SD 430 SD 450 SD 617 SD 625 SD 650/52 SD 810 SD 820 and SD 820A a buffer overflow can occur in SafeSwitch.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9640 MDM9645 MDM9650 MDM9655 SD 450 SD 625 SD 650/52 SD 810 SD 820 SD 835 while processing the IPv6 pdp address of the pdp context a buffer overflow can occur.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650 MDM9655 SD 835 SD 845 SD 850 while processing the IMS SIP username a buffer overflow can occur.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845 SD 850 a buffer overflow may potentially occur while processing a response from the SIM card.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650 MDM9655 SD 450 SD 625 SD 650/52 SD 835 SD 845 SD 850 in the Wireless Data Service (WDS) module a buffer overflow can occur.


In

android

for

MSM

Firefox

OS

for

MSM

QRD

Android

with

all

Android

releases

from

CAF

using

the

Linux

kernel

when

processing

a

specially

crafted

vendor

command

a

stack-based

buffer

overflow

can

occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel setting the HMAC key by different threads during SHA operations may potentially lead to a buffer overflow.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while calculating CRC for GPT header fields with partition entries greater than 16384 buffer overflow occurs.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while parsing a Measurement Request IE in a Roam Neighbor Action Report a buffer overflow can occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the processing of a downlink supplementary services message a buffer overflow can occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel a buffer overflow can occur while reading firmware logs.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the fastrpc kernel driver a buffer overflow vulnerability from userspace may potentially exist.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel a potential buffer overflow can happen when processing any 802.11 MGMT frames like Auth frame in limProcessAuthFrame.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel improper ch_list array index initialization in function sme_set_plm_request() causes potential buffer overflow.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel potential buffer overflow can happen when processing UTF event in wma_process_utf_event().


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel improper input validation while processing an encrypted authentication management frame in lim_send_auth_mgmt_frame() leads to buffer overflow.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wil_aoa_evt_meas().


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel improper input validation for p2p_noa_info in wma_send_bcn_buf_ll() which is received from firmware leads to potential buffer overflow.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel improper buffer length calculation in wma_roam_scan_filter() leads to buffer overflow.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the kernel driver MDSS a buffer overflow can occur in HDMI CEC parsing if frame size is out of range.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts which can result in buffer overflow of msg cache.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the boot loader a buffer overflow can occur while parsing the splash image.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel when updating custom EDID (hdmi_tx_sysfs_wta_edid) if edid_size which is controlled by userspace is too large a buffer overflow occurs.


sendmail 8.9.3 as included with the MMDF 2.43.3b package in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow in the first argument to the command.


lpusers as included with SCO OpenServer 5.0 through 5.0.6 allows a local attacker to gain additional privileges via a buffer overflow attack in the '-u' command line parameter.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webstartflash function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webupdatecomponent function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetremoteimageinfo function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetservicecfg function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetlicensecfg function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgeneratesslcfg function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so uploadsshkey function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webifc_setadconfig function.


Heap-based buffer overflow in OpenJPEG 1.3 has unspecified impact and remote vectors a different vulnerability than CVE-2013-6045.


Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vectors to (1) lib/openjp3d/opj_jp3d_compress.c (2) bin/jp3d/convert.c or (3) lib/openjp3d/event.c.


Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.


Heap-based buffer overflow in ciscod.exe in the Cisco Security Service in Cisco AnyConnect Secure Mobility Client (aka AnyConnect VPN Client) allows local users to gain privileges via unspecified vectors aka Bug ID CSCud14143.


Stack-based buffer overflow in the scan_load_hosts function in ec_scan.c in Ettercap 0.7.5.1 and earlier might allow local users to gain privileges via a Trojan horse hosts list containing a long line.


Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elements.


Stack-based buffer overflow in the LRPC client in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges by operating an LRPC server that sends a crafted LPC port message aka \LRPC Client Buffer Overrun Vulnerability.\


Stack-based buffer overflow in the openSharedCacheFile function in dyld.cpp in dyld in Apple iOS 5.1.x and 6.x through 6.1.3 makes it easier for attackers to conduct untethering attacks via a long string in the DYLD_SHARED_CACHE_DIR environment variable.


Stack-based buffer overflow in db2aud in the Audit Facility in IBM DB2 and DB2 Connect 9.1 9.5 9.7 9.8 and 10.1 as used in Smart Analytics System 7600 and other products allows local users to gain privileges via unspecified vectors.


Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.


Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12 8.0.0 to 8.1.1 9.0.0 to 9.0.1.


Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06


Heap-based buffer overflow in the FindFiles function in UltraDefrag 1.0.3 allows local users to gain privileges via a file with a long pathname. NOTE: some of these details are obtained from third party information.


Stack-based buffer overflow in the domacro function in ftp in IBM AIX 5.2 and 5.3 allows local users to gain privileges via a long parameter to a macro as demonstrated by executing a macro via the '$' command.


Heap-based buffer overflow in Microsoft Windows allows user-assisted remote attackers to have an unknown impact via a crafted .HLP file.


Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSCRIBE command.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file a different vulnerability than CVE-2014-9819.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted quantum file.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pdb file.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pnm file.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file a different vulnerability than CVE-2014-9825.


Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to have unspecified impact via unknown vectors.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file a different vulnerability than CVE-2014-9823.


Stack-based buffer overflow in Device Type Manager (DTM) 3.1.6 and earlier for Schneider Electric Invensys SRD Control Valve Positioner devices 960 and 991 allows local users to gain privileges via a malformed DLL file.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.


Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file a different vulnerability than CVE-2014-9824.


Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4 as used in pam_cifscreds allows remote attackers to have unspecified impact via unknown vectors.


Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a \badly formed number\ and a \long digit list.\


Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.


Heap-based buffer overflow in the PavTPK.sys kernel mode driver of Panda Security 2014 products before hft131306s24_r1 allows local users to gain privileges via a crafted argument to a 0x222008 IOCTL call.


Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length then triggering the overflow with a mining.notify request.


Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 when an econet address is configured allows local users to gain privileges by providing a large number of iovec structures.


Stack-based buffer overflow in the RichFX component in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 and RealPlayer Enterprise 2.1.2 allows remote attackers to have an unspecified impact via unknown vectors.


Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy.


Stack-based buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.14 and 1.2.0 through 1.2.9 has unknown impact and remote attack vectors. NOTE: this issue exists because of a CVE-2010-2284 regression.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 and RealPlayer Enterprise 2.1.2 allows remote attackers to have an unspecified impact via a crafted QCP file.


Heap-based buffer overflow in IBM DB2 9.1 before FP9 9.5 before FP6 and 9.7 before FP2 allows remote authenticated users to have an unspecified impact via a SELECT statement that has a long column name generated with the REPEAT function.


Heap-based buffer overflow in the NTLM authentication functionality in RealNetworks Helix Server and Helix Mobile Server 11.x 12.x and 13.x allows remote attackers to have an unspecified impact via invalid base64-encoded data.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 and RealPlayer Enterprise 2.1.2 allows remote attackers to have an unspecified impact via a crafted SOUND file.


Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.


Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.


Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.


Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.


Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.


Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.


Heap-based Buffer Overflow in vim/vim prior to 8.2.


Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.


Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.


Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.


Heap-based

Buffer

Overflow

in

GitHub

repository

prior

to

and

including

The

fix

is

established

in

commit

but

does

not

yet

belong

to

an

official

release.


Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software modify memory and possible remote execution


Stack-based Buffer Overflow vulnerability in SiteManager allows logged-in or local user to cause arbitrary code execution. This issue affects: Secomea SiteManager all versions prior to 9.7.


Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.


Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.


Heap-based buffer overflow vulnerability in parser_single_iref function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.


Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.


Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.


Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.


Heap-based buffer overflow in the USB backend in CUPS in Apple Mac OS X 10.5.8 allows local users to gain privileges via unspecified vectors.


Heap-based buffer overflow in the Recovery Mode component in Apple iPhone OS before 3.1 and iPhone OS before 3.1.1 for iPod touch allows local users to bypass the passcode requirement and access arbitrary data via vectors related to \command parsing.\


Heap-based buffer overflow in w in Sun Solaris 8 through 10 and OpenSolaris before snv_124 allows local users to gain privileges via unspecified vectors.


Stack-based buffer overflow in muxatmd in IBM AIX 5.2 5.3 and 6.1 allows local users to gain privileges via a long filename.


Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.


Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecified impact via a crafted Hierarchical File System (HFS) filesystem related to the hfs_readdir function in fs/hfs/dir.c.


Stack-based buffer overflow in the runtime linker ld.so.1 on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable.


Heap-based buffer overflow in main.c of slocate 2.6 and possibly other versions may allow local users to gain privileges via a modified slocate database that causes a negative \pathlen\ value to be used.


Heap-based buffer overflow in the name services daemon (nsd) in SGI IRIX 6.5.x through 6.5.21f and possibly earlier versions allows attackers to gain root privileges via the AUTH_UNIX gid list.


Heap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable.


Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege.


Stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges.


Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.


Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.


Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.


Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.


Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.


Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.


Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.


Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file.


Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified impact via a crafted image.


Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.


Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.


Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted audio file.


Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an application path on the command line.


Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.


Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.


Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.


Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework as used in Samsung S6 Edge allows local users to have unspecified impact via a large data.buf_out.num_planes value in an ioctl call.


Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.


Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.


Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.


Stack-based buffer overflow in IBM V5R4 and IBM i Access for Windows 6.1 and 7.1.


Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4 and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.


Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-1897.


Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-1898.


Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument.


Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.


Heap-based buffer overflow in the Avast virtualization driver (aswSnx.sys) in Avast Internet Security Pro Antivirus Premier and Free Antivirus before 11.1.2253 allows local users to gain privileges via a Unicode file path in an IOCTL request.


Heap-based buffer overflow in QEMU when built with the Q35-chipset-based PC system emulator.


Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.


Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.


Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors.


Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd which is not properly handled when expanding the /dev/fd prefix.


Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.


Stack-based buffer overflow can occur In the WLAN driver if the pmkid_count value is larger than the PMKIDCache size in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges such as escalating to a root shell. IBM X-Force ID: 144439.


Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges such as escalating to a root shell. IBM X-Force ID: 144441.


Stack-based Buffer Overflow vulnerability in libUPnPHndlr.so in Belkin Wemo Insight Smart Plug allows remote attackers to bypass local security protection via a crafted HTTP post packet.


Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.


Stack-based buffer overflow vulnerability in Vigor3900 Vigor2960 and Vigor300B with firmware before 1.5.1.1.


Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target device. This issue affects: Victure PC420 firmware version 1.2.2 and prior versions.


Heap-based buffer overflow in the parseSWF_DEFINEFONT function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to have unspecified impact via a crafted SWF file.


Heap-based buffer overflow in the parseSWF_RGBA function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to have unspecified impact via a crafted SWF file.


Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.


Stack-based buffer overflow in game-music-emu before 0.6.1.


Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries.


Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors.


Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software Inc. MuJS allows attackers to have unspecified impact by leveraging an error when dropping extra arguments to lightweight functions.


Stack-based buffer overflow in nvhost_job.c in the NVIDIA video driver for Android Shield TV before OTA 3.3 Shield Table before OTA 4.4 and Shield Table TK1 before OTA 1.5.


Stack-based

buffer

overflow

in

in


Stack-based buffer overflow in the _TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted tiff.


Heap-based buffer overflow in tif_packbits.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted bmp file.


Heap-based buffer overflow in Cisco Unified Computing System (UCS) Platform Emulator 2.5(2)TS4 3.0(2c)A and 3.0(2c)TS9 allows local users to gain privileges via crafted libclimeta.so filename arguments aka Bug ID CSCux68837.


Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9 6.2.3 before FP5 and 6.3.0 before FP2 on Linux and UNIX allows local users to gain privileges via unspecified vectors.


Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.


Stack-based buffer overflow in the semop system call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments.


Stack-based buffer overflow in the vgasco_printf function in Jan Kybic BitMap Viewer (BMV) 1.2 when compiled with the M_UNIX flag and running setuid allows local users to gain privileges via a long filename in the -b command line option.


Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia JRun 4.0 and earlier allows remote attackers to execute arbitrary via an HTTP GET request with a long .jsp file name.


Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia ColdFusion 6.0 allows remote attackers to execute arbitrary via an HTTP GET request with a long .cfm file name.


Heap-based buffer overflow in the NDS Service in Novell eDirectory before 8.8 SP3 has unknown impact and attack vectors.


Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/.


Stack-based buffer overflow in op before Changeset 563 when xauth support is enabled allows local users to gain privileges via a long XAUTHORITY environment variable.


Stack-based buffer overflow in the FastCGI SAPI (fastcgi.c) in PHP before 5.2.6 has unknown impact and attack vectors.


Stack-based buffer overflow in the reboot program on IBM AIX 5.2 and 5.3 allows local users in the shutdown group to gain privileges.


Stack-based buffer overflow in kl1.sys in Kaspersky Anti-Virus 6.0 and 7.0 and Internet Security 6.0 and 7.0 allows local users to gain privileges via an IOCTL 0x800520e8 call.


Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table.


In BlueZ 5.42 a buffer overflow was observed in \read_n\ function in \tools/hcidump.c\ source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.


In BlueZ 5.42 a buffer overflow was observed in \set_ext_ctrl\ function in \tools/parser/l2cap.c\ source file when processing corrupted dump file.


In BlueZ 5.42 a buffer overflow was observed in \pklg_read_hci\ function in \btsnoop.c\ source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.


David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used a heap-buffer-overflow occurred in function ok_jpg_generate_huffman_table() in \/ok_jpg.c:403\.


David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in \/ok_png.c:494\.


David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used a heap-buffer-overflow occurs in function ok_jpg_convert_YCbCr_to_RGB() in \/ok_jpg.c:513\ .


David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used a heap-buffer-overflow occurs in function ok_png_transform_scanline() in \/ok_png.c:533\.


David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used a heap-buffer-overflow occurred in function ok_png_transform_scanline() in \/ok_png.c:712\.


David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used a heap-buffer-overflow occurred in function ok_png_read_data() in \/ok_png.c\.


Adobe Bridge versions 10.0.1 and earlier version have a stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution.


A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities.


In btif_dm_data_copy of btif_core.cc there is a possible out of bounds write due to a buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-110166268.


A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities. NX-OS versions prior to 8.3(1) are affected.


Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access.


Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.


Possible

buffer

overflow

in

WLAN

handler

due

to

lack

of

validation

of

destination

buffer

size

before

copying

into

it

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in


If

a

bitmap

file

is

loaded

from

any

un-authenticated

source

there

is

a

possibility

that

the

bitmap

can

potentially

cause

stack

buffer

overflow.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

in

Nicobar


While deserializing any key blob during key operations buffer overflow could occur exposing partial key information if any key operations are invoked(Depends on CVE-2018-13907) in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking in MDM9150 MDM9205 MDM9206 MDM9607 MDM9650 MSM8909W MSM8996AU QCS404 QCS605 Qualcomm 215 SD 210/SD 212/SD 205 SD 410/12 SD 425 SD 427 SD 430 SD 435 SD 439 / SD 429 SD 450 SD 625 SD 632 SD 636 SD 650/52 SD 712 / SD 710 / SD 670 SD 820 SD 820A SD 835 SD 845 / SD 850 SD 855 SD 8CX SDA660 SDM439 SDM630 SDM660 Snapdragon_High_Med_2016 SXR1130


Possible

buffer

overflow

in

WLAN

handler

due

to

lack

of

validation

of

destination

buffer

size

before

copying

it

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in


Possible buffer overflow while processing the high level lim process action frame due to improper buffer length validation in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in MDM9150 MDM9650 MSM8996AU QCS405 QCS605 SD 625 SD 636 SD 665 SD 712 / SD 710 / SD 670 SD 730 SD 820 SD 820A SD 835 SD 845 / SD 850 SD 855 SDA660 SDM630 SDM660 SDX20 SDX24 SXR1130


Classic

buffer

overflow

vulnerability

while

playing

the

specific

video

whose

Decode

picture

buffer

size

is

more

than

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Buffer

overflow

can

occur

when

playing

specific

clip

which

is

non-standard

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Device

memory

may

get

corrupted

because

of

buffer

overflow/underflow.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Buffer

overflow

when

the

audio

buffer

size

provided

by

user

is

larger

than

the

maximum

allowable

audio

buffer

size.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


When

handling

the

vendor

command

there

exists

a

potential

buffer

overflow

due

to

lack

of

input

validation

of

data

buffer

received

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Possible

buffer

overflow

can

occur

when

playing

clip

with

incorrect

element

size

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Buffer overflow can occur in display function due to lack of validation of header block size set by user. in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in MDM9206 MDM9607 MDM9650 MSM8909W MSM8996AU SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 450 SD 615/16/SD 415 SD 625 SD 636 SD 650/52 SD 712 / SD 710 / SD 670 SD 820A SD 845 / SD 850 SDM660 SDX20


Buffer

overflow

can

occur

while

processing

non-standard

message

from

user

space.

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in


Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in MDM9206 MDM9607 MDM9650 MDM9655 MSM8996AU QCS404 QCS605 Qualcomm 215 SD 410/12 SD 425 SD 427 SD 430 SD 435 SD 439 / SD 429 SD 450 SD 625 SD 632 SD 636 SD 712 / SD 710 / SD 670 SD 820 SD 820A SD 835 SD 845 / SD 850 SD 8CX SDA660 SDM439 SDM630 SDM660 Snapdragon_High_Med_2016 SXR1130


Buffer

overflow

due

to

improper

validation

of

buffer

size

while

IPA

driver

processing

to

perform

read

operation

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).


objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).


Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message.


The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote unauthenticated attacker to /GponForm/fsetup_Form. An attacker can leverage this vulnerability to potentially execute arbitrary code.


Dell EMC iDRAC6 versions prior to 2.92 iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20 3.21.24.22 3.21.26.22 and 3.23.23.23 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to crash the webserver or execute arbitrary code on the system with privileges of the webserver by sending specially crafted input data to the affected system.


RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x 4.1.x 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsing ECDSA signature. A malicious user with adjacent network access could potentially exploit this vulnerability to cause a crash in the library of the affected system.


Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to \blue screen\ via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading unallocated memory.


Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to \blue screen\ via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.


libcurl

versions

from

to

before

are

vulnerable

to

a

stack-based

buffer

overflow.

The

function

creating

an

outgoing

NTLM

header

(`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`)

generates

the

request

HTTP

header

contents

based

on

previously

received

data.

The

check

that

exists

to

prevent

the

local

buffer

from

getting

overflowed

is

implemented

wrongly

(using

unsigned

math)

and

as

such

it

does

not

prevent

the

overflow

from

happening.

This

output

data

can

grow

larger

than

the

local

buffer

if

very

large

'nt

response'

data

is

extracted

from

a

previous

header

provided

by

the

malicious

or

broken

HTTP

server.

Such

a

'large

value'

needs

to

be

around

bytes

or

more.

The

actual

payload

data

copied

to

the

target

buffer

comes

from

the

response

header.


An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function gf_isom_box_parse_ex() in isomedia/box_funcs.c.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before

NOTE:

this

may

be

a

result

of

an

incomplete

fix

for


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.


An issue was discovered on LG mobile devices with Android OS 7.0 7.1 7.2 8.0 and 8.1 software. LG Advanced Flash (LAF) has a buffer overflow. The LG ID is LVE-SMP-190001 (March 2019).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with P(9.0) (with TEEGRIS) software. There is a buffer overflow in the BIOSUB Trustlet. The Samsung ID is SVE-2019-15264 (October 2019).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11. PartyHost_HandleJoinPartyRequest has a buffer overflow vulnerability and can be exploited by using a crafted joinParty packet. This can be utilized to conduct arbitrary code execution on a victim's machine.


NETGEAR R8500 devices before v1.0.2.128 are affected by a buffer overflow by an unauthenticated attacker.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.


An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_init_frame at fromgif.c.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (Exynos chipsets) software. load_kernel has a buffer overflow via untrusted data. The Samsung ID is SVE-2019-14939 (September 2019).


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in e6y prboom-plus 2.5.1.5. There is a buffer overflow in client and server code responsible for handling received UDP packets as demonstrated by I_SendPacket or I_SendPacketTo in i_network.c.


In the Lustre file system before 2.12.3 the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by a client. The function target_handle_connect() mishandles a certain size value when a client connects to a server because of an integer signedness error.


An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_out_code at fromgif.c.


A heap-based buffer overflow was discovered in image_buffer_resize in fromsixel.c in libsixel before 1.8.4.


An issue was discovered on Samsung mobile devices with P(9.0) (Exynos 9820 chipsets) software. A Buffer overflow occurs when loading the UH Partition during Secure Boot. The Samsung ID is SVE-2019-14412 (August 2019).


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter.


An issue was discovered on LG mobile devices with Android OS 9.0 software. The HAL service has a buffer overflow that leads to arbitrary code execution. The LG ID is LVE-SMP-190013 (September 2019).


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects DGN2200v4 before 1.0.0.110 and DGND2200Bv4 before 1.0.0.109.