The hb_buffer_ensure function in hb-buffer.c in HarfBuzz as used in Pango 1.28.3 Firefox and other products does not verify that memory reallocations succeed which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.


A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension() in file.c may lead to execute arbitrary code and denial of service.

denial of service
null pointer dereference
arbitrary code execution


IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted key-mapping properties.


IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


CoreCapture in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


IOAcceleratorFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.


Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file.


Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer dereference and application crash) and possibly execute arbitrary code via format string specifiers in an aim:// URI.


The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value which triggers a NULL pointer dereference or a heap-based buffer over-read (aka \out-of-bounds array access\).

denial of service
null pointer dereference
buffer overread


MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference and application crash) by injecting invalid tokens into a GSSAPI application session.


The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash or NULL pointer dereference) via an HTTP request related to the mbuf_insert function.


The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9 when an LDAP backend is used allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read and daemon crash) via a crafted principal name.


KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) server which causes an assertion failure and results in a NULL pointer dereference. NOTE: this issue was originally reported as a buffer overflow.

denial of service
null pointer dereference
buffer overflow


PHP before 5.3.7 does not properly check the return values of the malloc calloc and realloc library functions which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument related to (1) ext/curl/interface.c (2) ext/date/lib/parse_date.c (3) ext/date/lib/parse_iso_intervals.c (4) ext/date/lib/parse_tz.c (5) ext/date/lib/timelib.c (6) ext/pdo_odbc/pdo_odbc.c (7) ext/reflection/php_reflection.c (8) ext/soap/php_sdl.c (9) ext/xmlrpc/libxmlrpc/base64.c (10) TSRM/tsrm_win32.c and (11) the strtotime function.


The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4 and Poppler 0.x as used in GPdf and kdegraphics KPDF does not properly allocate memory which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.

denial of service
null pointer dereference
buffer overflow
arbitrary code execution


Heap-based

buffer

overflow

in

the

image

tile

decoder

in

OpenJPEG

before

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

or

possibly

have

unspecified

other

impact

via

a

crafted

file

because

of

incorrect

and

interaction

a

related

issue

to

NOTE:

this

is

not

a

duplicate

of

because

the

scope

of

was

specifically

defined

in

as

only

\null

pointer

dereferences

division

by

zero

and

anything

that

would

just

fit

as

DoS.\

denial of service
null pointer dereference
buffer overflow
dos


Certain

Huawei

products

Module;NGFW

Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace

have

a

pointer

dereference

vulnerability.

The

system

dereferences

a

pointer

that

it

expects

to

be

valid

but

is

NULL.

A

local

attacker

could

exploit

this

vulnerability

by

sending

crafted

parameters.

A

successful

exploit

could

cause

a

denial

of

service

and

the

process

reboot.

denial of service
null pointer dereference
dos


A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated remote attacker to trigger a reload of an affected device resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on an internal data structure. An attacker could exploit this vulnerability by sending a sequence of malicious SIP messages to an affected device. An exploit could allow the attacker to cause a NULL pointer dereference resulting in a crash of the iosd process. This triggers a reload of the device.


A vulnerability in the Ident protocol handler of Cisco IOS and IOS XE Software could allow an unauthenticated remote attacker to cause an affected device to reload. The vulnerability exists because the affected software incorrectly handles memory structures leading to a NULL pointer dereference. An attacker could exploit this vulnerability by opening a TCP connection to specific ports and sending traffic over that connection. A successful exploit could allow the attacker to cause the affected device to reload resulting in a denial of service (DoS) condition.


A vulnerability was found in Linux kernel's versions up to 3.10 implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).


** DISPUTED ** The IsHandleEntrySecure function in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 SP2 does not properly validate the tagPROCESSINFO pW32Job field which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted NtUserValidateHandleSecure call for an owned object. NOTE: the vendor reportedly disputes the significance of this report stating that \it appears to be a local DOS ... we don't consider it a security vulnerability.\


CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).


A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS allows an attacker to send a specific packet causing the packet forwarding engine (PFE) to crash and restart resulting in a Denial of Service (DoS). By continuously sending these specific packets an attacker can repeatedly disable the PFE causing a sustained Denial of Service (DoS). This issue only affects Juniper Networks NFX Series SRX Series platforms when SSL Proxy is configured. This issue affects Juniper Networks Junos OS on NFX Series and SRX Series: 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R3-S1; 19.1 versions prior to 19.1R1-S6 19.1R2-S2 19.1R3; 19.2 versions prior to 19.2R1-S2 19.2R2; 19.3 versions prior to 19.3R2. This issue does not affect Juniper Networks Junos OS versions on NFX Series and SRX Series prior to 18.3R1.


A NULL Pointer Dereference vulnerability in the Captive Portal Content Delivery (CPCD) services daemon (cpcd) of Juniper Networks Junos OS on MX Series with MS-PIC MS-SPC3 MS-MIC or MS-MPC allows an attacker to send malformed HTTP packets to the device thereby causing a Denial of Service (DoS) crashing the Multiservices PIC Management Daemon (mspmand) process thereby denying users the ability to login while concurrently impacting other mspmand services and traffic through the device. Continued receipt and processing of these malformed packets will create a sustained Denial of Service (DoS) condition. While the Services PIC is restarting all PIC services will be bypassed until the Services PIC completes its boot process. An attacker sending these malformed HTTP packets to the device who is not part of the Captive Portal experience is not able to exploit this issue. This issue is not applicable to MX RE-based CPCD platforms. This issue affects: Juniper Networks Junos OS on MX Series 17.3 version 17.3R1 and later versions prior to 17.4 versions 17.4R2-S9 17.4R3-S2; 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S3; 18.3 versions prior to 18.3R3-S1; 18.4 versions prior to 18.4R3; 19.1 versions prior to 19.1R2-S2 19.1R3; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R3. This issue does not affect: Juniper Networks Junos OS versions prior to 17.3R1.


A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated remote attacker to trigger a crash of the dhcpd process resulting in a denial of service (DoS) condition. This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a NULL pointer dereference resulting in a crash of the dhcpd process. While the dhcpd process is restarting which may take up to approximately two minutes DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period. Note: Only the dhcpd process crashes and eventually restarts automatically. The router does not reload.


An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Test component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).


An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::WriteFields located in Ap4StszAtom.cpp. It allows an attacker to cause a denial of service (DOS).


In Libsixel prior to and including v1.10.3 a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.


A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.


An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference.


The Netlogon RPC Service in Microsoft Windows Server 2003 SP2 and Server 2008 Gold SP2 and R2 when the domain controller role is enabled allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via a crafted RPC packet aka \Netlogon RPC Null dereference DOS Vulnerability.\


Foxit PDF Reader v11.2.1.53537 was discovered to contain a NULL pointer dereference via the component FoxitPDFReader.exe. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PHP file.


Codesys Profinet in version V4.2.0.0 is prone to null pointer dereference that allows a denial of service (DoS) attack of an unauthenticated user via SNMP.


A null pointer dereference was addressed with improved validation. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Big Sur 11.6.5 Security Update 2022-003 Catalina watchOS 8.5 macOS Monterey 12.3. An attacker in a privileged position may be able to perform a denial of service attack.


ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms in mbox.c during certain mail parsing functions of the ClamAV software. An unauthenticated remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email which may result in a DoS condition.


A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packets. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to force a NULL pointer dereference and cause a DoS condition. This vulnerability affects the following if configured to use Cisco Fabric Services: Firepower 4100 Series Next-Generation Firewalls Firepower 9300 Security Appliance MDS 9000 Series Multilayer Switches Nexus 2000 Series Fabric Extenders Nexus 3000 Series Switches Nexus 3500 Platform Switches Nexus 5500 Platform Switches Nexus 5600 Platform Switches Nexus 6000 Series Switches Nexus 7000 Series Switches Nexus 7700 Series Switches Nexus 9000 Series Switches in standalone NX-OS mode Nexus 9500 R-Series Line Cards and Fabric Modules UCS 6100 Series Fabric Interconnects UCS 6200 Series Fabric Interconnects UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvd69966 CSCve02435 CSCve04859 CSCve41590 CSCve41593 CSCve41601.


An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_DescriptorListWriter::Action component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).


An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_Stz2Atom::GetSampleSize component located in /Core/Ap4Stz2Atom.cpp. It allows an attacker to cause a denial of service (DOS).


An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference leading to a denial of service (DOS).


An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference leading to a denial of service (DOS).


An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference leading to a denial of service (DOS).


An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference leading to a denial of service (DOS).


In Epson iProjection v2.30 the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. (0x9C402402 has only a NULL pointer dereference.) This affects \\Device\\EMPMPAUIO and \\DosDevices\\EMPMPAU.


For the NVIDIA Quadro NVS and GeForce products NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.

denial of service
null pointer dereference
escalated privilege


NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges


NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.


All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.


All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.


All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to a denial of service or potential escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference occurs which may lead to denial of service or possible escalation of privileges.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference may lead to denial of service or possible escalation of privileges.


Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_HID_MULTITOUCH is enabled allow physically proximate attackers to cause a denial of service (heap memory corruption or NULL pointer dereference and OOPS) via a crafted device.

denial of service
null pointer dereference
memory corruption


EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service.


(1) TMEMC_SAVE_GET_CLIENT_WEIGHT (2) TMEMC_SAVE_GET_CLIENT_CAP (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0 4.1 and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.


Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).


Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet an authenticated remote attacker can cause a Denial of Service.


Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).


Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).


Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).


The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file.

denial of service
null pointer dereference
memory corruption
arbitrary code execution


FreeType before 2.4.9 as used in Mozilla Firefox Mobile before 10.0.4 and other products allows remote attackers to cause a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType font.


The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference and memory corruption) via a crafted app.


libmedia in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-08-01 has certain incorrect declarations which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference or memory corruption) via a crafted media file aka internal bug 28166152.


The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read NULL pointer dereference and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID related to an \insufficient length check\ during identity comparison.

denial of service
null pointer dereference
out of bound read


MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\\0' character which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\\0' character related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.


Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and thread crash) via a state manipulation attack.

denial of service
null pointer dereference
race condition


Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.


Race condition in the smb_send_rqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors involving a reconnection event.


Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux kernel before 2.6.32.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via unknown vectors related to the put_tty_queue and __f_setown functions. NOTE: the vulnerability was addressed in a different way in 2.6.32.9.


Race condition in the IP module in the kernel in Sun OpenSolaris snv_106 through snv_124 allows remote attackers to cause a denial of service (NULL pointer dereference and panic) via unspecified vectors related to the (1) tcp_do_getsockname or (2) tcp_do_getpeername function.


Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.


The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.


Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the Linux kernel before 2.6.39.3 when Kernel SamePage Merging (KSM) is enabled allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted application.


Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.


Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (crash) or gain privileges via vectors related to kqueues which triggers a use after free leading to a NULL pointer dereference or memory corruption.

denial of service
null pointer dereference
race condition
memory corruption


In Exiv2 0.27.99.0 there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service.


unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.


Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.


Gaim 1.2.0 allows remote attackers to cause a denial of service (application crash) via a malformed file transfer request to a Jabber user which leads to an out-of-bounds read.


Skia as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


libvpx as used in Google Chrome before 8.0.552.215 and possibly other products allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebM video. NOTE: this vulnerability exists because of a regression.


PDFium as used in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Blink as used in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Skia as used in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Skia as used in Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Skia as used in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


libalpm as used in pacman 5.0.1 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted signature file.


Skia as used in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


libxslt as used in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Skia as used in Google Chrome before 18.0.1025.151 does not properly perform clipping which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


libxml2 as used in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers to cause a denial of service (crash) via a crafted PE icon that triggers an out-of-bounds read related to improper rounding during scaling.


Off-by-one error in the GIF decoder in Google Chrome before 21.0.1180.57 on Mac OS X and Linux and before 21.0.1180.60 on Windows and Chrome Frame allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.


Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted coordinates.


Google Chrome before 11.0.696.57 does not properly handle SVG documents which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 11.0.696.57 does not properly handle PDF documents with multipart encoding which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.


Google Chrome before 13.0.782.107 does not properly handle Skia paths which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 13.0.782.107 does not properly perform text iteration which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 14.0.835.163 does not properly handle Tibetan characters which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 14.0.835.163 does not properly handle video which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 14.0.835.163 does not properly handle Khmer characters which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 14.0.835.163 does not properly process MP3 files which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 14.0.835.163 does not properly handle triangle arrays which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 14.0.835.163 does not properly handle media buffers which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 14.0.835.163 does not properly handle boxes which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 17.0.963.46 does not properly decode audio data which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 17.0.963.46 does not properly perform path clipping which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 17.0.963.46 does not properly handle PDF FAX images which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 19.0.1084.46 does not properly draw dash paths which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 19.0.1084.46 does not properly handle Tibetan text which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 19.0.1084.46 does not properly draw hairlines which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 19.0.1084.46 does not properly handle glyphs which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


In QEMU 4.1.0 an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process resulting in a denial of service.


An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver version 26.20.13025.10004. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest affecting VMware host.


An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver version 26.20.13001.50005. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest affecting VMware host.


An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver version 26.20.13003.1007. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest affecting VMware host.


In FreeBSD 12.0-STABLE before r350637 12.0-RELEASE before 12.0-RELEASE-p9 11.3-STABLE before r350638 11.3-RELEASE before 11.3-RELEASE-p2 and 11.2-RELEASE before 11.2-RELEASE-p13 the bsnmp library is not properly validating the submitted length from a type-length-value encoding. A remote user could cause an out-of-bounds read or trigger a crash of the software such as bsnmpd resulting in a denial of service.


GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation Signed/Unsigned Comparison Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497 elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.


SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189.


coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (out-of-bounds read and application crash) by crafting an XWD image file a different vulnerability than CVE-2019-11008 and CVE-2019-11009.


In LibTomCrypt through 1.18.2 the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.


libarchive

version

commit

onwards

(release

onwards)

contains

a

Out-of-bounds

Read

vulnerability

in

decompression

that

can

result

in

a

crash

(denial

of

service).

This

attack

appears

to

be

exploitable

via

the

victim

opening

a

specially

crafted

file.


gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1 as used in PHP before 5.5.36 5.6.x before 5.6.22 and 7.x before 7.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.


The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.


The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map.


The SVG implementation in Blink as used in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging the use of tree order rather than transitive dependency order for layout.


net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.


The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7 as used in Google Chrome before 31.0.1650.63 allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index.


The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY (2) DELETE or (3) MOVE request against a revision root.


The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap as demonstrated by a large nodeset value to numatune.


The URL loader in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


PostgreSQL 9.2.x before 9.2.3 9.1.x before 9.1.8 9.0.x before 9.0.12 8.4.x before 8.4.16 and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command which triggers an array index error and an out-of-bounds read.


Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving glyphs.


The RasterImage::DrawFrameTo function in Mozilla Firefox before 19.0 Thunderbird before 17.0.3 and SeaMonkey before 2.16 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) via a crafted GIF image.


Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to printing.


The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read crash and restart) via a crafted SSSD packet.


Skia as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a \user gesture check for dangerous file downloads.\


The DoResolveRelativeHost function in url/url_canon_relative.cc in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service (out-of-bounds read) via a relative URL containing a hostname as demonstrated by a protocol-relative URL beginning with a //www.google.com/ substring.


core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink as used in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted JPEG2000 image.


Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable which triggers an out-of-bounds read.


Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the handling of text.


GNU ZRTPCPP before 3.2.0 allows remote attackers to obtain sensitive information (uninitialized heap memory) or cause a denial of service (out-of-bounds read) via a crafted packet as demonstrated by a truncated Ping packet that is not properly handled by the getEpHash function.


parser.c in libxml2 before 2.9.0 as used in Google Chrome before 28.0.1500.71 and other products allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly related to the lack of certain checks for the XML_PARSER_EOF state.


The

ReverbConvolverStage::ReverbConvolverStage

function

in

in

the

Web

Audio

implementation

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

via

vectors

related

to

the

impulseResponse

array.


The Window.prototype object implementation in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi contains an out-of-bounds read vulnerability that could lead to a denial of service. Affected product versions include: eCNS280_TD V100R005C10; eSE620X vESS V100R001C10SPC200 V100R001C20SPC200 V200R001C00SPC300.


Huawei idap module has a Out-of-bounds Read vulnerability.Successful exploitation of this vulnerability may cause Denial of Service.


read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.


fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.


Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata which is a less frequently used Exiv2 operation than reading the metadata. For example to trigger the bug in the Exiv2 command-line application you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.


Exiv2 is a C++ library and a command-line utility to read write delete and modify Exif IPTC XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata which is a less frequently used Exiv2 operation than reading the metadata. For example to trigger the bug in the Exiv2 command-line application you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4. Please see our security policy for information about Exiv2 security.


Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata which is a less frequently used Exiv2 operation than reading the metadata. For example to trigger the bug in the Exiv2 command-line application you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.4.


The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.


Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5.


Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.


Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata which is a less frequently used Exiv2 operation than reading the metadata. For example to trigger the bug in the Exiv2 command-line application you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.5.


An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device. Out-of-bounds reads performed by aes_remove_padding() can crash the running process depending on the memory layout. This could be used by an attacker to cause a client-side denial of service. The yubihsm-shell project is included in the YubiHSM 2 SDK product.


An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted executable can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability. An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. An IOCTL_B03 request with specific invalid data causes a similar issue in the device driver WRCore_x64. An attacker can issue an ioctl to trigger this vulnerability.


WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.


An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. A specially-crafted executable can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability. An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4. The GetProcessCommandLine IOCTL request could cause an out-of-bounds read in the device driver WRCore_x64. An attacker can issue an ioctl to trigger this vulnerability.


libvorbis 1.1.2 and possibly other versions before 1.2.0 allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type which triggers an out-of-bounds read in the vorbis_info_clear function in info.c and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.


Blizzard Entertainment StarCraft Brood War 1.15.1 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed map which triggers an out-of-bounds read during a minimap preview.


Certain chunk handlers in libpng before 1.0.29 and 1.2.x before 1.2.21 allow remote attackers to cause a denial of service (crash) via crafted (1) pCAL (png_handle_pCAL) (2) sCAL (png_handle_sCAL) (3) tEXt (png_push_read_tEXt) (4) iTXt (png_handle_iTXt) and (5) ztXT (png_handle_ztXt) chunking in PNG images which trigger out-of-bounds read operations.


The kernel in Microsoft Windows 2000 SP4 XP SP2 and Server 2003 when ICMP Router Discovery Protocol (RDP) is enabled allows remote attackers to cause a denial of service via fragmented router advertisement ICMP packets that trigger an out-of-bounds read aka \Windows Kernel TCP/IP/ICMP Vulnerability.\


LGSERVER.EXE in BrightStor ARCserve Backup for Laptops & Desktops r11.1 allows remote attackers to cause a denial of service (daemon crash) via a value of 0xFFFFFFFF at a certain point in an authentication negotiation packet which results in an out-of-bounds read.


The NTLM_UnPack_Type3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service (application crash) via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port (143/tcp) which results in an out-of-bounds read.


Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.


The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.


CoolType.dll in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and 10.x through 10.1.13 and 11.x through 11.0.10 on OS X allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.


The dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a packet containing only a CVS_LOGIN signature.


The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.


The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.


oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.


The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.


FreeType before 2.5.4 does not check for the end of the data during certain parsing actions which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font related to type42/t42parse.c and type1/t1load.c.


DCM decode in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).


The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.


PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).


LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool (2) compresscontig function in tiff2bw.c in the tiff2bw tool (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool (6) NeXTDecode function in tif_next.c in the tiffmedian tool or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.


The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.


The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.


Deadwood before 2.3.09 3.x before 3.2.05 and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09 allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood related to a logic error.


Deadwood before 2.3.09 3.x before 3.2.05 and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09 allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood related to missing input validation.


net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance.


The chrome_pdf::CopyImage function in pdf/draw_utils.cc in the PDFium component in Google Chrome before 38.0.2125.101 does not properly validate image-data dimensions which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via unknown vectors.


The Instance::HandleInputEvent function in pdf/instance.cc in the PDFium component in Google Chrome before 38.0.2125.101 interprets a certain -1 value as an index instead of a no-visible-page error code which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The donote function in readelf.c in file through 5.20 as used in the Fileinfo component in PHP 5.4.34 does not ensure that sufficient note headers are present which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.


The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9 when a disk has been hot-plugged or removed from the live image allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query which triggers an out-of-bounds read.


The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.


mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a crafted size in an unspecified IOCTL call which triggers an out-of-bounds read. NOTE: some of these details are obtained from third party information.


The base64DecodeInternal function in wtf/text/Base64.cpp in Blink as used in Google Chrome before 34.0.1847.116 does not properly handle string data composed exclusively of whitespace characters which allows remote attackers to cause a denial of service (out-of-bounds read) via a window.atob method call.


The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0 Firefox ESR 24.x before 24.4 Thunderbird before 24.4 and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory cause a denial of service (out-of-bounds read and application crash) or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.


The InMemoryUrlProtocol::Read function in media/filters/in_memory_url_protocol.cc in Google Chrome before 35.0.1916.114 relies on an insufficiently large integer data type which allows remote attackers to cause a denial of service (out-of-bounds read) via vectors that trigger use of a large buffer.


The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0 Firefox ESR 31.x before 31.1 and Thunderbird 31.x before 31.1 does not properly create audio timelines which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted API calls.


The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0 Firefox ESR 24.x before 24.4 Thunderbird before 24.4 and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted WAV file.


The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted packet.


The rt_setgate function in the kernel in Apple iOS before 8 and Apple TV before 7 allows local users to gain privileges or cause a denial of service (out-of-bounds read and device crash) via a crafted call.


The process_browse_data function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted packet data.


IOServer before Beta2112.exe allows remote attackers to cause a denial of service (out-of-bounds read and master entry consumption) via a null DNP3 header.


The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.


The RenderTable::simplifiedNormalFlowLayout function in core/rendering/RenderTable.cpp in Blink as used in Google Chrome before 40.0.2214.91 skips captions during table layout in certain situations which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors related to the Fonts implementation.


The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome before 40.0.2214.91 uses an incorrect data type for a certain length value which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted X11 data.


kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application.


The sycc422_to_rgb function in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium as used in Google Chrome before 40.0.2214.91 does not properly handle odd values of image width which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.


GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of \0xffff\ to the iconv function when converting (1) IBM933 (2) IBM935 (3) IBM937 (4) IBM939 or (5) IBM1364 encoded data to UTF-8.


The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file.


The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a TIFF file with an invalid combination of SamplesPerPixel and Photometric values.


Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption out-of-bounds read and application crash) via JavaScript code that appends long strings to the content of a P element and performs certain other string concatenation and substring operations related to the DoubleWideCharMappedString class in USP10.dll and the gfxWindowsFontGroup::GetUnderlineOffset function in xul.dll a different vulnerability than CVE-2009-1571.


The reply_sesssetup_and_X_spnego function in sesssetup.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to trigger an out-of-bounds read and cause a denial of service (process crash) via a \\xff\\xff security blob length in a Session Setup AndX request.


The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit as used in Google Chrome before 8.0.552.224 Chrome OS before 8.0.552.343 webkitgtk before 1.2.6 and other products does not properly parse Cascading Style Sheets (CSS) token sequences which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font related to \Type Confusion.\


A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)


A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)


The JBIG2 decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier Poppler before 0.10.6 and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.


Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds read.


oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.


The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (aka \array overrun\).


Digital Reality game engine as used in Haegemonia 1.0 through 1.0.7 and Desert Rats vs. Afrika Korps 1.0 allows remote attackers to cause a denial of service (crash) via a chat message with a large message size which triggers an out-of-bounds read.


sipclient.cpp in KPhone 4.0.1 and earlier allows remote attackers to cause a denial of service (crash) via a STUN response packet with a large attrLen value that causes an out-of-bounds read.


Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service (segmentation fault) by sending a Basic Authentication request without a password which causes Monit to decrement a null pointer and perform an out-of-bounds read.


The SNMP dissector in Ethereal 0.8.15 through 0.10.4 allows remote attackers to cause a denial of service (process crash) via a (1) malformed or (2) missing community string which causes an out-of-bounds read.


The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.


Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion which causes an out-of-bounds read as demonstrated by the Striker ISAKMP Protocol Test Suite.


The SSL/TLS handshaking code in OpenSSL 0.9.7a 0.9.7b and 0.9.7c when using Kerberos ciphersuites does not properly check the length of Kerberos tickets during a handshake which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.


isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs which triggers an out-of-bounds read error as demonstrated by the Striker ISAKMP Protocol Test Suite.


TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's which causes an out-of-bounds read as demonstrated by the Striker ISAKMP Protocol Test Suite.


An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the \Intel Graphics Driver\ component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (out-of-bounds read and system crash).


QEMU (aka Quick Emulator) when built with the VGA display emulator support allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.


psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.


The WriteOnePNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file because the program's actual control flow was inconsistent with its indentation. This resulted in a logging statement executing outside of a loop and consequently using an invalid array index corresponding to the loop's exit condition.


The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \Menus\ component. It allows attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted app.


An exploitable denial-of-service vulnerability exists in the traversal of lists functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause an out-of-bounds read resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability.


An exploitable denial-of-service vulnerability exists in the lookup entry functionality of KeyTrees in Natus Xltek NeuroWorks 8. A specially crafted network packet can cause an out-of-bounds read resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \FontParser\ component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted font file.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \CoreText\ component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted font file.


An exploitable denial-of-service vulnerability exists in the unserialization of lists functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause an out-of-bounds read resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability.


An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create2` opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker can create/send malicious a smart contract to trigger this vulnerability.


The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted BPG file related to improper interaction with hls_pcm_sample in hevc.c in libavcodec in FFmpeg and put_pcm_var in hevcdsp_template.c in libavcodec in FFmpeg.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the \libxml2\ component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted XML file.


The TCP stack in the Linux kernel through 4.10.6 mishandles the SCM_TIMESTAMPING_OPT_STATS feature which allows local users to obtain sensitive information from the kernel's internal socket data structures or cause a denial of service (out-of-bounds read) via crafted system calls related to net/core/skbuff.c and net/socket.c.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the \libxml2\ component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted XML file.


hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.


The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DEX file.


The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.


The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.


libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.


The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g. the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.


The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted filter.


VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Workstation this issue in conjunction with other bugs may allow a guest to leak information from host or may allow for a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this issue in conjunction with other bugs may allow a View desktop to leak information from host or may allow for a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.


VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client.


VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.


VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in TrueType Font (TTF) parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.


VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.


The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers to cause a denial of service (out-of-bounds read) because of incorrect buffer padding for non-Haar wavelets related to libavcodec/vc2enc.c and libavcodec/vc2enc_dwt.c.


In Libav through 11.11 and 12.x through 12.1 the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.


The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device related to the USB_DT_INTERFACE_ASSOCIATION descriptor.


The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 does not prevent negative pointers which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.


The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


The \get_pipe()\ function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8 4.9.71 and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.


The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device related to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c.


The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.


tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file related to transposing width and height values.


Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.


Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%) without a closing bracket ().


The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.


Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8.


libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.


The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file.


The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file related to ff_ps_apply.


The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.


cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call.


The multi-part body parser in PJSIP as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 Certified Asterisk 13.13 before 13.13-cert4 and other products allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.


libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.


The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '' character.


The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PostScript document.


The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.


SAP BusinessObjects BI Platform 4.1 BusinessObjects Edge 4.0 and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a crafted GIOP packet aka SAP Security Note 2001108.


libxml2 2.9.2 does not properly stop parsing invalid input which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c as demonstrated by non-terminated entities.


The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted LZW stream in a GIF file.


The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors a different vulnerability than CVE-2015-7019.


The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors a different vulnerability than CVE-2015-7020.


The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data a different vulnerability than CVE-2015-7941.


libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (2) bmp_decode_rle function.


The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.


gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) by using a CANVAS element to trigger 2D rendering.


Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4 when used for AP mode MLME/SME functionality allows remote attackers to cause a denial of service (crash) via a crafted frame which triggers an out-of-bounds read.


meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.


The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.


The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.


Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android Adobe AIR SDK before 16.0.0.272 and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.


The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg 1.0.0 before 1.0.0s 1.0.1 before 1.0.1n and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data as demonstrated by an attack against a server that supports client authentication with a custom verification callback.


The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data.


gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.


The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name as demonstrated by \http://:80\ and \:80.\


The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.


The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload as demonstrated by a length of zero a different vulnerability than CVE-2015-3906.


The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.


The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \\0 termination which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet a different vulnerability than CVE-2015-3815.


The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.


The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6 Netweaver Application Server ABAP Netweaver Application Server Java Netweaver RFC SDK GUI RFC SDK SAPCAR archive tool and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors related to look-ups of non-simple codes aka SAP Security Note 2124806 2121661 2127995 and 2125316.


The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).


The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file (2) a large Number Of Symbols value in the 1st Linker Member of a COFF Archive Library file (3) a large Resource Table Count value in the LE Header of a Linear Executable file or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file.


Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.


The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\\0' character in a long realm field within a TGS request.


epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression.


The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference as demonstrated by \((?+1)(\\1))/\.


The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length (2) offset or (3) base pointer checksum value.


wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.


The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.


The

function

in

in

the

ZigBee

ZCL

dissector

in

Wireshark

before

and

before

does

not

validate

the

Total

Profile

Number

field

which

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read

and

application

crash)

via

a

crafted

packet.


The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.


The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\\0' characters exist as expected which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.


The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationships between record lengths and record header lengths which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.


The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not reject unknown TLV types which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


The ascend_seek function in wiretap/ascendtext.c in the Ascend file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not ensure the presence of a '\\0' character at the end of a date string which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image.


The AirPDcapDecryptWPABroadcastKey function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not verify the WPA broadcast key length which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


The

JPEGLSCodec::DecodeExtent

function

in

MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx

in

Grassroots

DICOM

(aka

GDCM)

before

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

or

cause

a

denial

of

service

(application

crash)

via

an

embedded

JPEG-LS

image

with

dimensions

larger

than

the

selected

region

in

a

two-dimensional

or

three-dimensional

DICOM

image

file

which

triggers

an

out-of-bounds

read.


coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.


tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image.


The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern which triggers an out-of-bounds read.


The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values which triggers an out-of-bounds read.


The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28 as derived from the Cube engine allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read as demonstrated using SV_EXT tag data in the Cube engine which is not properly handled by getint.


The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested which might allow local users to cause a denial of service (crash) by causing an out-of-bounds read.


The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.


file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.


The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.


VP8 Codec SDK (libvpx) before 1.0.0 \Duclair\ allows remote attackers to cause a denial of service (application crash) via (1) unspecified \corrupt input\ or (2) by \starting decoding from a P-frame \ which triggers an out-of-bounds read related to \the clamping of motion vectors in SPLITMV blocks\.


The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file which triggers an out-of-bounds read.