Format string vulnerability in clamav-milter for Clam AntiVirus 0.60 through 0.60p and other versions before 0.65 allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the email address argument of a \MAIL FROM\ command.


X Fontserver for Truetype fonts (xfstt) 1.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a (1) FS_QueryXExtents8 or (2) FS_QueryXBitmaps8 packet and possibly other types of packets with a large num_ranges value which causes an out-of-bounds array access.

denial of service
arbitrary code execution


Unknown vulnerability in an ISAPI plugin for ISS Server Sensor 7.0 XPU 20.16 20.18 and possibly other versions before 20.19 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code in Internet Information Server (IIS) via a certain URL through SSL.


Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.


Multiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs as demonstrated using the NISSC test suite.


ImageMagick 5.4.3.x and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a \%x\ filename possibly triggering a format string vulnerability.


Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands.


The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003 and possibly Windows NT and Server 2000 does not properly validate the length of certain packets which allows attackers to cause a denial of service and possibly execute arbitrary code.


Multiple \buffer management errors\ in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c (2) buffer_free in buffer.c or (3) a separate function in channels.c a different vulnerability than CVE-2003-0693.


Format string vulnerability in gpgkeys_hkp (experimental HKP interface) for the GnuPG (gpg) client 1.2.3 and earlier and 1.3.3 and earlier allows remote attackers or a malicious keyserver to cause a denial of service (crash) and possibly execute arbitrary code during key retrieval.


Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM (2) GIOP Gryphon (3) OSPF (4) PPTP (5) Quake (6) Quake2 (7) Quake3 (8) Rsync (9) SMB (10) SMPP and (11) TSP dissectors which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.


Format string vulnerability in (1) Bahamut IRCd 1.4.35 and earlier and other IRC daemons based on Bahamut including (2) digatech 1.2.1 (3) methane 0.1.1 (4) AndromedeIRCd 1.2.3-Release and (5) ircd-RU when running in debug mode allows remote attackers to cause a denial of service and possibly execute arbitrary code via a request containing format strings.


EPIC IRC Client (EPIC4) pre2.002 pre2.003 and possibly later versions allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via a CTCP request from a large nickname which causes an incorrect length calculation.


handleAccept in rinetd before 0.62 does not properly resize the connection list when it becomes full and sets an array index incorrectly which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large number of connections.


Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv (2) socket_recvfrom and possibly other functions.


mpg123 0.59r allows remote attackers to cause a denial of service and possibly execute arbitrary code via an MP3 file with a zero bitrate which creates a negative frame size.


Format string vulnerabilities in the logging routines for MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in Kerberos principal names.


The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000 nsiislog.dll allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request.


Signed integer vulnerability in libnasl in Nessus before 2.0.6 allows local users with plugin upload privileges to cause a denial of service (core dump) and possibly execute arbitrary code by causing a negative argument to be provided to the insstr function as used in a NASL script.


Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings as demonstrated using XML objects to mod_dav and possibly other vectors.


Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via (1) a packet with a negative size value which is treated as a large positive number during memory allocation or (2) a negative size value in a package file.


The Session Initiation Protocol (SIP) implementation in Mediatrix Telecom VoIP Access Devices and Gateways running SIPv2.4 and SIPv4.3 firmware allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


shar on HP-UX B.11.00 B.11.04 and B.11.11 creates temporary files with predictable names in /tmp which allows local users to cause a denial of service and possibly execute arbitrary code via a symlink attack.


The Session Initiation Protocol (SIP) implementation in Columbia SIP User Agent (sipc) 1.74 and other versions before sipc 2.0 build 2003-02-21 allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


The Session Initiation Protocol (SIP) implementation in Alcatel OmniPCX Enterprise 5.0 Lx allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


SonicWALL firmware before 6.4.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted Internet Key Exchange (IKE) response packets possibly including (1) a large Security Parameter Index (SPI) field (2) a large number of payloads or (3) a long payload.


The Session Initiation Protocol (SIP) implementation in Nortel Networks Succession Communication Server 2000 when using SIP-T allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


The Session Initiation Protocol (SIP) implementation in multiple dynamicsoft products including y and certain demo products for AppEngine allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


The Session Initiation Protocol (SIP) implementation in multiple Cisco products including IP Phone models 7940 and 7960 IOS versions in the 12.2 train and Secure PIX 5.2.9 to 6.2.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


The Session Initiation Protocol (SIP) implementation in IPTel SIP Express Router 0.8.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


The Session Initiation Protocol (SIP) implementation in Ingate Firewall and Ingate SIParator before 3.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages as demonstrated by the OUSPG PROTOS c07-sip test suite.


** DISPUTED ** Format string bug in the open_altfile function in filename.c for GNU less 382 381 and 358 might allow local users to cause a denial of service or possibly execute arbitrary code via format strings in the LESSOPEN environment variable. NOTE: since less is not setuid or setgid then this is not a vulnerability unless there are plausible scenarios under which privilege boundaries could be crossed.


The U.S. Robotics USR808054 wireless access point allows remote attackers to cause a denial of service (device crash) and possibly execute arbitrary code via an HTTP GET request with a long version string.


Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier when authenticating via auth_pam allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.


Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8 and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.


Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in (1) title or (2) baseurl fields.


pnxr3260.dll in the RealOne 2.0 build 6.0.11.868 browser plugin as used in Internet Explorer allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embed tag.


Multiple vulnerabilities in the H.323 protocol implementation for Nortel Networks Business Communications Manager (BCM) Succession 1000 IP Trunk and IP Peer Networking and 802.11 Wireless IP Gateway allow remote attackers to cause a denial of service and possibly execute arbitrary code as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.


Multiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.


Multiple vulnerabilities in the H.323 protocol implementation for Cisco IOS 11.3T through 12.2T allow remote attackers to cause a denial of service and possibly execute arbitrary code as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.


The Negotiate Security Software Provider (SSP) interface in Windows 2000 Windows XP and Windows Server 2003 allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.


Integer signedness errors in XFree86 4.1.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code when using the GLX extension and Direct Rendering Infrastructure (DRI).


arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5 when nested virtualisation is used does not properly traverse guest pagetable entries to resolve a guest virtual address which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking and host OS crash) aka an \MMU potential stack buffer overrun.\


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \Audio\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted QuickTime file.


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \CoreText\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted font file.


The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto ip_proto and thoff are initialized which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.


Microsoft Windows 10 Gold 1511 and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2 and Windows Server 2016 do not properly handle certain requests in SMBv2 and SMBv3 packets which allows remote attackers to execute arbitrary code via a crafted SMBv2 or SMBv3 packet to the Server service aka \SMBv2/SMBv3 Null Dereference Denial of Service Vulnerability.\


Reporter.exe in Acunetix 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed PRE file related to a \User Mode Write AV starting at reporter!madTraceProcess.\


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \AppleRAID\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \SQLite\ component. A use-after-free vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SQL statement.


An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access and application crash) via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the \Kernel\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.


DP300 V500R002C00 TE60 with software V100R001C01 V100R001C10 V100R003C00 V500R002C00 and V600R006C00 TP3106 with software V100R001C06 and V100R002C00 ViewPoint 9030 with software V100R011C02 V100R011C03 eCNS210_TD with software V100R004C10 eSpace 7950 with software V200R003C00 and V200R003C30 eSpace IAD with software V300R001C07SPCa00 and V300R002C01SPCb00 eSpace U1981 with software V100R001C20 V100R001C30 V200R003C00 V200R003C20 and V200R003C30 have an input validation vulnerability.A remote attacker may exploit this vulnerability by crafting a malformed packet and sending it to the device. A successful exploit could allow the attacker to cause a denial of service or execute arbitrary code.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \Kernel\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the \CoreAnimation\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption and application crash) via crafted data.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \Bluetooth\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the \Bluetooth\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.


Winamp

Build

might

allow

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.flv

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

in_mp3!DeleteAudioDecoder+0x000000000000762f.\


IrfanView

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

a

\User

Mode

Write

AV

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x000000000000a529.\


XnView

Classic

for

Windows

Version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.rle

file

related

to

a

\Read

Access

Violation

on

Control

Flow

starting

at


Winamp

Build

might

allow

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.flv

file

related

to

\Data

from

Faulting

Address

may

be

used

as

a

return

value

starting

at

f263!GetWinamp5SystemComponent+0x0000000000001951.\


Winamp

Build

might

allow

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.flv

file

related

to

\Error

Code

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d.\


IrfanView

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.rle

file

related

to

a

\User

Mode

Write

AV

starting

at

FORMATS!GetPlugInInfo+0x0000000000007d96.\


An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows \Write overflow in data2vp_wimax()\ - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.


An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows \Write overflow in rad_coalesce()\ - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.


XnView

Classic

for

Windows

Version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.rle

file

related

to

a

\Data

Execution

Prevention

Violation

starting

at

Unknown

Symbol

called

from

ntdll_77df0000!LdrxCallInitRoutine+0x0000000000000016.\


XnView

Classic

for

Windows

Version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.rle

file

related

to

a

\Data

Execution

Prevention

Violation

starting

at

Unknown

Symbol

called

from

KERNELBASE!CompareStringW+0x0000000000000082.\


Winamp

Build

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.flv

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

in_flv!winampGetInModule2+0x00000000000009a8.\


XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file related to a \Data Execution Prevention Violation starting at Unknown Symbol @ 0x000000000c1b541c called from xnview+0x00000000003826ec.\


IrfanView

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.rle

file

related

to

a

\User

Mode

Write

AV

starting

at

ntdll_77df0000!RtlpWaitOnCriticalSection+0x0000000000000121.\


IrfanView

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.rle

file

related

to

a

\User

Mode

Write

AV

starting

at

FORMATS!GetPlugInInfo+0x0000000000007d80.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

STDUJBIG2File!DllUnregisterServer+0x00000000000076d3.\


STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file related to a \Read Access Violation on Control Flow starting at Unknown Symbol @ 0x0000000003aa7cef called from Unknown Symbol @ 0x0000000004aa024d.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

an

\Illegal

Instruction

Violation

starting

at

Unknown

Symbol

called

from

STDUXPSFile!DllUnregisterServer+0x000000000002566a.\


Foxit

Reader

and

earlier

and

Foxit

PhantomPDF

and

earlier

when

running

in

single

instance

mode

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

an

\Illegal

Instruction

Violation

starting

at

Unknown

Symbol

called

from

STDUXPSFile!DllUnregisterServer+0x000000000002e77b.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

an

\Illegal

Instruction

Violation

starting

at

Unknown

Symbol

called

from

STDUXPSFile!DllUnregisterServer+0x000000000002566c.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

an

\Illegal

Instruction

Violation

starting

at

Unknown

Symbol

called

from

STDUXPSFile!DllUnregisterServer+0x0000000000025706.\


Artifex

MuPDF

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

a

\User

Mode

Write

AV

near

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d\

on

Windows.

This

occurs

because

in

fitz/unzip.c

does

not

check

whether

size

fields

in

a

ZIP

entry

are

negative

numbers.


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

an

\Illegal

Instruction

Violation

starting

at

Unknown

Symbol

called

from

STDUXPSFile!DllUnregisterServer+0x0000000000025638.\


STDU

Viewer

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

an

\Illegal

Instruction

Violation

starting

at

Unknown

Symbol

called

from

STDUXPSFile!DllUnregisterServer+0x0000000000025630.\


Artifex

GSView

Beta

on

Windows

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.xps

file

related

to

a

\Read

Access

Violation

on

Block

Data

Move

starting

at

mupdfnet64!mIncrementalSaveFile+0x0000000000193359.\


The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \Quick Look\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted Office document.


Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes.


XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \Data Execution Prevention Violation near NULL starting at Unknown Symbol @ 0x0000000000000000 called from CADImage+0x0000000000286a79.\


IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file related to a \Read Access Violation on Block Data Move starting at PDF!xmlListWalk+0x00000000000158cb.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

a

\User

Mode

Write

AV

near

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000001b3f3.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

a

\User

Mode

Write

AV

near

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000001ce82.\


IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file related to a \Read Access Violation on Block Data Move starting at PDF!xmlListWalk+0x000000000001515b.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

a

\User

Mode

Write

AV

near

starting

at

BabaCAD4Image!ShowPlugInOptions+0x0000000000013968.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

a

\User

Mode

Write

AV

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000001ecaa.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

PDF!xmlParserInputRead+0x0000000000048d0c.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000004d75b.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

PDF!xmlParserInputRead+0x000000000009174a.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to \Data from Faulting Address controls Code Flow starting at CADIMAGE+0x000000000033228e.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000004d7c4.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000001eca0.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000004d6b0.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

PDF!xmlGetGlobalState+0x00000000000668d6.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

PDF!xmlParserInputRead+0x00000000000e7326.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

PDF!xmlGetGlobalState+0x0000000000063ca6.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to a \Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000700b00260112 called from CADIMAGE+0x00000000003d35ad.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file related to \Data from Faulting Address controls subsequent Write Address starting at CADIMAGE+0x00000000000042d5.\


IrfanView

with

plugin

version

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.dwg

file

related

to

a

\User

Mode

Write

AV

near

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000001f31b.\


The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.


The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.


The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer which allows remote attackers to execute arbitrary code read arbitrary files or cause a denial of service via a crafted serialized Java object.


The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.


IrfanView

version

might

allow

attackers

to

cause

a

denial

of

service

or

execute

arbitrary

code

via

a

crafted

file

related

to

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at

ntdll_77df0000!LdrpResCompareResourceNames+0x0000000000000150.\


IrfanView

version

with

FPX

Plugin

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

a

\User

Mode

Write

AV

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x0000000000000f53.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

a

\Read

Access

Violation

on

Block

Data

Move

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x000000000000b84f.\


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

execute

arbitrary

code

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!LdrpCompareResourceNames_U+0x0000000000000062.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x000000000000c998.\


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

execute

arbitrary

code

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

KERNELBASE!EnumResourceTypesInternal+0x0000000000000589.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x000000000000c995.\


In

SWFTools

on

Windows

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

near

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x00000000000014e7.\


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

execute

arbitrary

code

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!LdrpResGetMappingSize+0x00000000000003cc.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

a

\Read

Access

Violation

on

Control

Flow

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x000000000000c99a.\


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

execute

arbitrary

code

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

KERNELBASE!QueryOptionalDelayLoadedAPI+0x0000000000000c42.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

subsequent

Write

Address

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x000000000000a525.\


IrfanView

version

with

FPX

Plugin

allows

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

.fpx

file

related

to

a

\Read

Access

Violation

on

Control

Flow

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x00000000000014eb.\


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

execute

arbitrary

code

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!LdrpResCompareResourceNames+0x0000000000000087.\


In

SWFTools

on

Windows

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

via

a

crafted

file

related

to

a

\User

Mode

Write

AV

starting

at


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

execute

arbitrary

code

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!LdrpResSearchResourceInsideDirectory+0x000000000000029e.\


SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader aka SAP Security Note 2399804.


The session deserializer in PHP before 5.4.45 5.5.x before 5.5.29 and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.


The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors related to midi_manager.cc midi_manager_alsa.cc and midi_manager_mac.cc a different vulnerability than CVE-2015-8664.


The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.


Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 when a Java plugin is enabled allow remote attackers to cause a denial of service (incorrect garbage collection and application crash) or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper.


The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using an NSAccessibilityIndexAttribute value to reference a row index.


The fts3_tokenizer function in SQLite as used in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.


The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648 2.1 before 2.1.8 and 2.2 before 2.2.4 as distributed in Apple OS X before 10.11.4 and other products mishandles tainting which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.


Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service (unhandled runtime exception and application crash) via a crafted Indusoft Project file.


Juniper ScreenOS before 6.3.0r21 when ssh-pka is configured and enabled allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted SSH negotiation.


The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of service (segmentation fault and process crash) and execute arbitrary code via a crafted JPG.


The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1 as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products improperly restricts access to an unspecified data structure which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data related to a \use-after-poison\ issue.


The

BFD

daemon

in

Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(bfdd

crash

and

restart)

or

execute

arbitrary

code

via

a

crafted

BFD

packet.


The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.


ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses which allows remote attackers to execute arbitrary code cause a denial of service (application crash) or possibly obtain sensitive information via a crafted Ghost image.


VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file which triggers the freeing of arbitrary pointers.


HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to execute arbitrary code or cause a denial of service via unspecified vectors.


The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.


The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook ElitePad Elite ProBook Spectre ZBook and mt41 Thin Client devices allows remote attackers to modify data or cause a denial of service or execute arbitrary code via unspecified vectors.


Samba 3.x and 4.x before 4.2.11 4.3.x before 4.3.8 and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer which allows remote attackers to perform protocol-downgrade attacks cause a denial of service (application crash or CPU consumption) or possibly execute arbitrary code on a client system via unspecified vectors.


The mcopy function in softmagic.c in file 5.x as used in the Fileinfo component in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 does not properly restrict a certain offset value which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a \Python script text executable\ rule.


PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type related to \type confusion\ issues in (1) ext/soap/php_encoding.c (2) ext/soap/php_http.c and (3) ext/soap/soap.c a different issue than CVE-2015-4600.


The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0 when the Debugger API is enabled allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site.


The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type related to a \type confusion\ issue.


The mget function in softmagic.c in file 5.x as used in the Fileinfo component in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 does not properly maintain a certain pointer relationship which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a \Python script text executable\ rule.


Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protection mechanism and consequently write to arbitrary files cause a denial of service (host reboot or reset to factory defaults) or execute arbitrary code via vectors related to saving files during analysis.


The SoapClient implementation in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type related to \type confusion\ issues in the (1) SoapClient::__getLastRequest (2) SoapClient::__getLastResponse (3) SoapClient::__getLastRequestHeaders (4) SoapClient::__getLastResponseHeaders (5) SoapClient::__getCookies and (6) SoapClient::__setCookie methods.


Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.


The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type related to a \type confusion\ issue.


drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.


IBM Domino 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 allows remote attackers to execute arbitrary code or cause a denial of service (integer truncation and application crash) via a crafted GIF image aka SPR KLYH9T7NT9.


AppNav in Cisco IOS XE 3.8 through 3.10 before 3.10.3S 3.11 before 3.11.3S 3.12 before 3.12.1S 3.13 before 3.13.0S 3.14 before 3.14.0S and 3.15 before 3.15.0S allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via a crafted TCP packet aka Bug ID CSCuo53622.


The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.


The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37 5.5.x before 5.5.21 and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.


The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.


chrony before 1.31.1 does not initialize the last \next\ pointer when saving unacknowledged replies to command requests which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.


The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document which triggers an out-of-bounds write.


The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.


The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted website.


The scalar-function implementation in IBM DB2 9.7 through FP10 9.8 through FP5 10.1 before FP5 and 10.5 through FP5 on Linux UNIX and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.


The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.


The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.


The NVIDIA graphics driver in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds write) via a crafted app.


The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.


The Floppy Disk Controller (FDC) in QEMU as used in Xen 4.5.x and earlier and KVM allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND or other unspecified commands aka VENOM.


The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.


strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.


The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7 7.x before 7.1.7 and 8.x before 8.0.7 as used in Apple iOS before 8.4 and other products does not properly restrict access to SQL functions which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.


The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 when the Apache HTTP Server 2.4.x is used allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a \deconfigured interpreter.\


FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a workbook.


Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.


(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013 (b) 0x8086200B (c) 0x8086200F or (d) 0x80862007 IOCTL call.


FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook related to a \premature EOF.\


The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.


drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.


F5 BIG-IP APM 11.4.1 before 11.4.1 HF9 11.5.x before 11.5.3 and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile aka an \Out-of-bounds memory vulnerability.\


Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28 2.0.46 and other versions before 2.0.59 and 2.2 when RewriteEngine is enabled allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.


Format string vulnerability in CA Integrated Threat Management (ITM) eTrust Antivirus (eAV) and eTrust PestPatrol (ePP) r8 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a scan job with format strings in the description field.


Multiple array index errors in the (1) recv_rules (2) recv_select_unit (3) recv_options and (4) recv_unit_data functions in multiplay.cpp in UFO2000 svn 1057 allow remote attackers to execute arbitrary code and cause a denial of service (opponent crash) via certain packet data that specifies an out-of-bounds index.


Unspecified vulnerability in ImageIO in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image that triggers a memory allocation failure that is not properly handled.


Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers errors related to \setfield/getfield methods in cleanup functions.\


Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings as demonstrated via format string specifiers in a .bmp filename. NOTE: the original exploit was demonstrated through a command line argument but there are other mechanisms for input that are automatically processed by Dia such as a crafted .dia file.


CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths and possibly other vectors as demonstrated by the ProtoVer LDAP test suite.


The scripting engine in Internet Explorer allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript which consumes the stack as demonstrated by resetting the \location\ variable within the loop.


Format string vulnerability in PunkBuster 1.180 and earlier as used by Soldier of Fortune II and possibly other games allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in invalid cvar values which are not properly handled when the server kicks the player and records the reason.


urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 (aka 7.0.5296.0) allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to \file://\ followed by a large number of \-\ (dash of hyphen) characters.


Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules PAM-MySQL is not evaluated first and there are no requisite modules before PAM-MySQL.


The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown attack vectors related to garbage collection.


Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions and GraphicsMagick allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name a variant of CVE-2005-0397 and as demonstrated using the convert program.


SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a chunk length that is inconsistent with the actual length of provided parameters.


Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2 and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML. NOTE: due to the lack of sufficient public details from the vendor as of 20060413 it is unclear how CVE-2006-1529 CVE-2006-1530 CVE-2006-1531 and CVE-2006-1723 are different.


Format string vulnerability in the Job Engine service (bengine.exe) in the Media Server in Veritas Backup Exec 10d (10.1) for Windows Servers rev. 5629 Backup Exec 10.0 for Windows Servers rev. 5520 Backup Exec 10.0 for Windows Servers rev. 5484 and Backup Exec 9.1 for Windows Servers rev. 4691 when the job log mode is Full Detailed (aka Full Details) allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted filename on a machine that is backed up by Backup Exec.


Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.


The Internet Key Exchange implementation in Funkwerk X2300 7.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


Format string vulnerability in the NSRunAlertPanel function in eBay Skype for Mac 1.5.*.79 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed Skype URL as originally reported to involve a null dereference.


The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3 2.7 SP1 2.8 and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.


gbcms_php_files/up_loader.php GreenBeast CMS 1.3 does not require authentication to upload files which allows remote attackers to cause a denial of service (disk consumption) and execute arbitrary code by uploading arbitrary files such as executing PHP code via an uploaded PHP file.


The fpathconf syscall function in bsd/kern/kern_descrip.c in the Darwin kernel (XNU) 8.8.1 in Apple Mac OS X allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code via a file descriptor with an unrecognized file type.


Unspecified vulnerability in Toshiba Bluetooth wireless device driver 3.x and 4 through 4.00.35 as used in multiple products allows physically proximate attackers to cause a denial of service (crash) corrupt memory and possibly execute arbitrary code via crafted Bluetooth packets.


Multiple format string vulnerabilities in elogd.c in ELOG 2.6.2 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) an entry with an attachment whose name contains format string specifiers (el_submit function) and possibly other vectors in the (2) receive_config (3) show_rss_feed (4) show_elog_list (5) show_logbook_node and (6) server_loop functions.


Array index error in the make_table function in unlzh.c in the LZH decompression component in gzip 1.3.5 when running on certain platforms allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GZIP archive that triggers an out-of-bounds write aka a \stack modification vulnerability.\


Multiple unspecified vulnerabilities in Firefox before 1.5.0.7 Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5 allow remote attackers to cause a denial of service (crash) corrupt memory and possibly execute arbitrary code via unspecified vectors some of which involve JavaScript and possibly large images or plugin data.


Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file followed by redirecting the browser to another page which leads to a concurrency failure that causes structures to be freed incorrectly as demonstrated by (1) ffoxdie and (2) ffoxdie3. NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie. Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability. NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected.


The Terminal Services COM object (tsuserex.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by instantiating it as an ActiveX object in Internet Explorer 6.0 SP1 on Microsoft Windows 2003 EE SP1 CN.


Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using (1) zabbix_log or (2) zabbix_syslog.


Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument string to the LoadFile method in an AcroPDF ActiveX control.


The RPC library in Kerberos 5 1.4 through 1.4.4 and 1.5 through 1.5.1 as used in Kerberos administration daemon (kadmind) and other products that use this library calls an uninitialized function pointer in freed memory which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument string to the (1) src (2) setPageMode (3) setLayoutMode and (4) setNamedDest methods in an AcroPDF ActiveX control a different set of vectors than CVE-2006-6027.


Format string vulnerability in Marathon Aleph One before 0.17.1 and 2006-12-17 might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in the TopLevelLogger::logMessageV function in Misc/Logging.cpp. NOTE: some details were obtained from third party information.


Multiple format string vulnerabilities in NeoEngine 0.8.2 and earlier and CVS 3422 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) Console::Render in neoengine/console.cpp and (2) TextArea::Render in neowtk/textarea.cpp.


Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password.


Lotus Domino R5 before R5.0.7a allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via miscellaneous packets with semi-valid BER encodings as demonstrated by the PROTOS LDAPv3 test suite.


Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings for certain BER object types as demonstrated by the PROTOS LDAPv3 test suite.


iPlanet Directory Server 4.1.4 and earlier (LDAP) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid BER length of length fields as demonstrated by the PROTOS LDAPv3 test suite.


Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings of BER OBJECT-IDENTIFIER values as demonstrated by the PROTOS LDAPv3 test suite.


IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings for the L field of a BER encoding as demonstrated by the PROTOS LDAPv3 test suite.


lpsystem in OpenUnix 8.0.0 allows local users to cause a denial of service and possibly execute arbitrary code via a long command line argument.


Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed BER encodings as demonstrated by the PROTOS LDAPv3 test suite.


Cerberus FTP 1.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) username (2) password or (3) PASV command.


Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content as exploited in the wild in August 2012 with SWF content in a Word document.


Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x 0.5.2.x and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW multithread-safe exception handling which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted Bitcoin protocol messages.


The VMX process in VMware ESXi 3.5 through 4.1 and ESX 3.5 through 4.1 does not properly handle RPC commands which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving data pointers.


The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers.


The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request.


The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.6 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file related to the chroma_format_idc value.


Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors.


The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file related to a large multiplier. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.


The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.5 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Shorten file related to an \invalid free\.


Integer underflow in Apple iOS before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (device crash) via a crafted catalog file in an HFS disk image.


Use-after-free

vulnerability

in

Mozilla

Firefox

before

Thunderbird

before

and

SeaMonkey

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

or

possibly

execute

arbitrary

code

via

vectors

that

trigger

failure

of

an

nsXBLDocumentInfo::ReadPrototypeBindings

function

call

related

to

the

cycle

collector's

access

to

a

hash

table

containing

a

stale

XBL

binding.


libsecurity in Apple Mac OS X before 10.7.4 accesses uninitialized memory locations during the processing of X.509 certificates which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted certificate.


The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header which is not properly handled in a numeric range comparison.


RPM before 4.9.1.3 does not properly validate region tags which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad (2) rpmReadSignature or (3) headerVerify function.


Use-after-free vulnerability in Mozilla Firefox 4.x through 10.0 Firefox ESR 10.x before 10.0.3 Thunderbird 5.0 through 10.0 Thunderbird ESR 10.x before 10.0.3 and SeaMonkey before 2.8 on 32-bit Windows 7 platforms allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving use of the file-open dialog in a child window related to the IUnknown_QueryService function in the Windows shlwapi.dll library.


The adpcm_decode_frame function in adpcm.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.6 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an ADPCM file with the number of channels not equal to two.


Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.


The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11; and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.5 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (infinite loop and crash) and possibly execute arbitrary code via a large component count in an Atrac 3 file.


Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary code via a crafted request.


The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.


The Cascading Style Sheets (CSS) implementation in Mozilla Firefox 4.x through 10.0 Firefox ESR 10.x before 10.0.3 Thunderbird 5.0 through 10.0 Thunderbird ESR 10.x before 10.0.3 and SeaMonkey before 2.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via dynamic modification of a keyframe followed by access to the cssText of the keyframe.


Google Chrome before 21.0.1180.57 on Linux does not properly handle tabs which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.


WellinTech KingHistorian 3.0 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer write) via a crafted packet to TCP port 5678.


Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.


VMware ESXi 3.5 through 5.0 and ESX 3.5 through 4.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via NFS traffic.


VMware Workstation 8.x before 8.0.3 VMware Player 4.x before 4.0.3 VMware Fusion 4.x before 4.1.2 VMware ESXi 3.5 through 5.0 and VMware ESX 3.5 through 4.1 do not properly register SCSI devices which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.


The server in CA ARCserve Backup r12.5 r15 and r16 on Windows does not properly process RPC requests which allows remote attackers to execute arbitrary code or cause a denial of service via a crafted request.


Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.


VMware Workstation 8.x before 8.0.3 VMware Player 4.x before 4.0.3 VMware Fusion 4.x through 4.1.2 VMware ESXi 3.5 through 5.0 and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.


The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators which allows remote attackers to cause a denial of service (crash) obtain sensitive information from memory or execute arbitrary code via a crafted Java applet.


The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5 2.12 and probably other versions does not \properly restrict the use of\ the alloca function when allocating the SPECS array which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers a different vulnerability than CVE-2012-3404 and CVE-2012-3405.


Mozilla Firefox before 16.0 Thunderbird before 16.0 and SeaMonkey before 2.13 do not properly perform a cast of an unspecified variable during use of the instanceof operator on a JavaScript object which allows remote attackers to execute arbitrary code or cause a denial of service (assertion failure) via a crafted web site.


The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page which causes an uninitialized memory location to be read.


The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5 and in CoreMedia in iOS before 6 accesses uninitialized memory locations which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.


Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed SVG image.


Opera before 12.12 does not properly allocate memory for GIF images which allows remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a malformed image.


Multiple unspecified vulnerabilities in Adobe Reader through 10.1.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document related to \sixteen more crashes affecting Windows OS X or both systems.\


Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3 when the context menu is shown allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by accessing an iframe when it is being updated.


fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.


Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c (2) channel_request function in channels.c (3) ssh_userauth_pubkey function in auth.c (4) sftp_parse_attr_3 function in sftp.c and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


diagchar_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via an application that uses crafted arguments in a local diagchar_ioctl call.


The decomposer engine in Symantec Endpoint Protection (SEP) 11.0 Symantec Endpoint Protection Small Business Edition 12.0 Symantec AntiVirus Corporate Edition (SAVCE) 10.x and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of CAB archives which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file.


The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls which allows attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a crafted binary.


Google Chrome before 23.0.1271.97 does not properly handle history navigation which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.


Mozilla Firefox before 17.0 Thunderbird before 17.0 and SeaMonkey before 2.14 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving the setting of Cascading Style Sheets (CSS) properties in conjunction with SVG text.


Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a proxy name as demonstrated using the http_proxy environment variable or a PAC file.


The L2CAP signaling channel implementation and SDP server implementation in OpenSynergy Blue SDK 3.2 through 6.0 allow remote unauthenticated attackers to execute arbitrary code or cause a denial of service via malicious L2CAP configuration requests in conjunction with crafted SDP communication over maliciously configured L2CAP channels. The attacker must have connectivity over the Bluetooth physical layer and must be able to send raw L2CAP frames. This is related to L2Cap_HandleConfigReq in core/stack/l2cap/l2cap_sm.c and SdpServHandleServiceSearchAttribReq in core/stack/sdp/sdpserv.c.


Privilege escalation in Intel Baseboard Management Controller (BMC) firmware before version 1.43.91f76955 may allow an unprivileged user to potentially execute arbitrary code or perform denial of service over the network.


Denial of service vulnerability in Platform Sample/ Silicon Reference firmware for 8th Generation Intel Core Processor 7th Generation Intel Core Processor may allow privileged user to potentially execute arbitrary code via local access.


ARM mbed TLS before 1.3.22 before 2.1.10 and before 2.7.0 when the truncated HMAC extension and CBC are used allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.


VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.


Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.


Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly execute arbitrary code via a long TFTP error packet a different vulnerability than CVE-2008-2161.


In MuPDF 1.12.0 and earlier multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code read memory or cause a denial of service via a crafted file.


It was found that the fix for CVE-2018-10927 CVE-2018-10928 CVE-2018-10929 CVE-2018-10930 and CVE-2018-10926 was incomplete. A remote authenticated attacker could use one of these flaws to execute arbitrary code create arbitrary files or cause denial of service on glusterfs server nodes via symlinks to relative paths.


The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.


Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.


Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio Video and Signaling) 5.3 through 6.x before 6.4 the Wire Secure Messenger application before 3.49.918 for Android and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.


An issue was discovered in uIP 1.0 as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c or possibly execute arbitrary code on some target architectures.


A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service or in certain circumstances execute arbitrary code on the Spacewalk server.


Xen when running on a 64-bit hypervisor allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information cause a denial of service (host crash) or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.


The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.


Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie.


The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.


The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \Kernel\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \Bluetooth\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (type confusion) via a crafted app.


The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMware Fusion and Fusion Pro 8.x before 8.5.2 allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (out-of-bounds memory access on the host OS) via unspecified vectors.


The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \IOHIDFamily\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \Kernel\ component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via unspecified vectors.


Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or (2) possibly write to arbitrary files and cause a denial of service by uploading an HTML file.


The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to move and delete files with the permissions of DiskFileItem and if running on a Java VM before 1.3.1 execute arbitrary code via a crafted serialized Java object.


statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.


Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of service or execute arbitrary code via a crafted packet.


The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator) when built with ESP/NCR53C9x controller emulation support allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.


Huawei NE40E and CX600 devices with software before V800R007SPH017; PTN 6900-2-M8 devices with software before V800R007SPH019; NE5000E devices with software before V800R006SPH018; and CloudEngine devices 12800 with software before V100R003SPH010 and V100R005 before V100R005SPH006 allow remote attackers with control plane access to cause a denial of service or execute arbitrary code via a crafted packet.


SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an IMPORT statement aka SAP Security Note 2233136.


Huawei S12700 switches with software before V200R008C00SPC500 and S5700 switches with software before V200R005SPH010 when the debug switch is enabled allows remote attackers to cause a denial of service or execute arbitrary code via crafted DNS packets.


lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.


The overflow protection in Expat is removed by compilers with certain optimization settings which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.


The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.


An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the \ImageIO\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted SGI file.


An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the \ImageIO\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) via a crafted PDF file.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the \Kernel\ component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service (MIG code mishandling and system crash) via unspecified vectors.


arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state which allows guest OS users to obtain direct APIC MSR access on the host OS and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS via x2APIC mode.


Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37 5.6.x before 5.6.23 and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.


The bzread function in ext/bz2/bz2.c in PHP before 5.5.38 5.6.x before 5.6.24 and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.


spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.


php_zip.c in the zip extension in PHP before 5.5.37 5.6.x before 5.6.23 and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.


Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37 5.6.x before 5.6.23 and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.


The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image related to a \type confusion\ issue.


The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.


Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags as demonstrated by incorrect SVG processing aka ZDI-CAN-3545.


Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file a different vulnerability than CVE-2014-8137.


ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request a related issue to CVE-2015-0899.


Use-after-free vulnerability in hw/ide/ahci.c in QEMU when built with IDE AHCI Emulation support allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.


Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors as exploited in the wild in April 2016.


The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0 Firefox ESR 38.x before 38.8 and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service (generation-count overflow out-of-bounds HashMap write access and application crash) via a crafted web site.


The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01 7.5.x before 7.5.3 HF03 7.5.4 before HF01 and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus Norton Security Norton Internet Security and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted RAR file that is mishandled during decompression.


The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation and system crash) via a malformed PE header file.


The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.


exif.c in Matthias Wandel jhead 2.87 as used in libjhead in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data aka internal bug 28868315.


The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01 7.5.x before 7.5.3 HF03 7.5.4 before HF01 and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus Norton Security Norton Internet Security and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted ZIP archive that is mishandled during decompression.