TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

is

vulnerable

to

a

heap

buffer

overflow.

The

fails

to

validate

that

the

pooling

sequence

arguments

have

enough

elements

as

required

by

the

tensor

shape.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: Prior to 5130_EI_7.10.R3507P02. HPE has made the following software update to resolve the vulnerability in HPE FlexNetwork 5130 EL Switch Series version 5130_EL_7.10.R3507P02.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

heap

buffer

overflow

in

`QuantizedResizeBilinear`

by

passing

in

invalid

thresholds

for

the

quantization.

This

is

because

the

assumes

that

the

arguments

are

always

valid

scalars

and

tries

to

access

the

numeric

value

directly.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

is

vulnerable

to

a

heap

buffer

overflow.

If

the

tensors

are

empty

the

same

implementation

can

trigger

undefined

behavior

by

dereferencing

pointers.

The

fails

to

validate

that

`scale`

`offset`

`mean`

and

`variance`

(the

last

two

only

when

required)

all

have

the

same

number

of

elements

as

the

number

of

channels

of

`x`.

This

results

in

heap

out

of

bounds

reads

when

the

buffers

backing

these

tensors

are

indexed

past

their

boundary.

If

the

tensors

are

empty

the

validation

mentioned

in

the

above

paragraph

would

also

trigger

and

prevent

the

undefined

behavior.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

is

vulnerable

to

a

heap

buffer

overflow.

The

does

not

check

that

the

initialization

of

completes

successfully.

Since

the

uses

to

validate

conditions

the

first

assertion

that

fails

interrupts

the

initialization

of

`params`

making

it

contain

invalid

data.

In

turn

this

might

cause

a

heap

buffer

overflow

depending

on

default

initialized

values.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

If

the

`splits`

argument

of

`RaggedBincount`

does

not

specify

a

valid

then

an

attacker

can

trigger

a

heap

buffer

overflow.

This

will

cause

a

read

from

outside

the

bounds

of

the

`splits`

tensor

buffer

in

the

implementation

of

the

`RaggedBincount`

Before

the

`for`

loop

is

set

to

The

attacker

sets

to

be

hence

the

`while`

loop

does

not

execute

and

remains

This

then

results

in

writing

to

bin)`

which

is

before

the

heap

allocated

buffer

for

the

output

tensor.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

and

TensorFlow

as

these

are

also

affected.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

heap

buffer

overflow

in

by

manipulating

input

values

so

that

float

rounding

results

in

off-by-one

error

in

accessing

image

elements.

This

is

because

the

computes

two

integers

(representing

the

upper

and

lower

bounds

for

interpolation)

by

ceiling

and

flooring

a

floating

point

value.

For

some

values

of

`in`

`interpolation->upperi`

might

be

smaller

than

`interpolation->loweri`.

This

is

an

issue

if

`interpolation->upperi`

is

capped

at

as

it

means

that

`interpolation->loweri`

points

outside

of

the

image.

Then

in

the

interpolation

this

would

result

in

heap

buffer

overflow.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Exiv2 is a command-line utility and C++ library for reading writing deleting and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata which is a less frequently used Exiv2 operation than reading the metadata. For example to trigger the bug in the Exiv2 command-line application you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

heap

buffer

overflow

in

Eigen

implementation

of

The

calls

`ValidateInputTensors`

for

input

validation

but

fails

to

validate

that

the

two

tensors

are

not

empty.

Furthermore

since

macro

only

stops

execution

of

current

function

after

setting

`ctx->status()`

to

a

non-OK

value

callers

of

helper

functions

that

use

must

check

value

of

`ctx->status()`

before

continuing.

This

doesn't

happen

in

this

op's

hence

the

validation

that

is

present

is

also

not

effective.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

heap

buffer

overflow

in

`QuantizedMul`

by

passing

in

invalid

thresholds

for

the

quantization.

This

is

because

the

assumes

that

the

arguments

are

always

valid

scalars

and

tries

to

access

the

numeric

value

directly.

However

if

any

of

these

tensors

is

empty

then

`.flat<T>()`

is

an

empty

buffer

and

accessing

the

element

at

position

results

in

overflow.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

heap

buffer

overflow

by

passing

crafted

inputs

to

This

is

because

the

fails

to

consider

corner

cases

where

input

would

be

split

in

such

a

way

that

the

generated

tokens

should

only

contain

padding

elements.

If

input

is

such

that

is

then

for

(when

left

padding

is

present)

the

marked

line

would

result

in

reading

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

Missing

validation

between

arguments

to

operations

can

result

in

heap

buffer

overflows.

This

is

because

the

assumes

that

the

`input`

and

tensors

have

the

same

shape

as

they

are

accessed

in

parallel.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

is

vulnerable

to

a

heap

buffer

overflow.

The

assumes

that

the

and

`grad`

tensors

have

similar

first

and

last

dimensions

but

does

not

check

that

this

assumption

is

validated.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


The

RNDIS

USB

device

class

includes

a

buffer

overflow

vulnerability.

Zephyr

versions

contain

Heap-based

Buffer

Overflow

For

more

information

see


_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.


A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.


A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable.


Buffer

overflow

in

Zephyr

USB

DFU

DNLOAD.

Zephyr

versions

contain

Heap-based

Buffer

Overflow

For

more

information

see


In ytnef 1.9.3 the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a heap buffer overflow which can be triggered via a crafted file.


Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow which allows privilege escalation to root via \sudoedit -s\ and a command-line argument that ends with a single backslash character.


Buffer

overflow

in

usb

device

class.

Zephyr

versions

contain

Heap-based

Buffer

Overflow

For

more

information

see


** UNSUPPORTED WHEN ASSIGNED ** D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.


In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time on entry the \out\ parameter can be NULL and on exit the \outlen\ parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again but this time passing a non-NULL value for the \out\ parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).


Buffer Overflow while processing IOCTL for getting peripheral endpoint information there is no proper validation for input maximum endpoint pair and its size in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music


Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Possible buffer overflow due to improper handling of negative data length while processing write request in VR service in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Wearables


Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Possible stack buffer overflow due to lack of check on the maximum number of post NAN discovery attributes while processing a NAN Match event in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to or through the device. This issue affects: Juniper Networks Junos OS on SRX Series: 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9; 17.4R3 and later versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S1; 18.3 versions prior to 18.3R2-S3 18.3R3; 18.4 versions prior to 18.4R2-S3 18.4R3; 19.1 versions prior to 19.1R1-S4 19.1R2; 19.2 versions prior to 19.2R1-S1 19.2R2. An indicator of compromise can be the following text in the UTM log: RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT:


WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to remotely execute code.


WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow which may allow an attacker to remotely execute code.


On Xilinx Zynq-7000 SoC devices physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use an attacker can modify the boot header stored on an SD card so that a secure image appears to be unencrypted and they will be able to modify the full range of register initialization values. Normally these registers will be restricted when booting securely. Of importance to this attack are two registers that control the SD card's transfer type and transfer size. These registers could be modified a way that causes a buffer overflow in the ROM.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.


An issue was discovered in Reprise RLM 14.2. By using an admin account an attacker can write a payload to /goform/edit_opt which will then be triggered when running the diagnostics (via /goform/diagnostics_doit) resulting in a buffer overflow.


An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input an attacker can cause a call to $Extract to force an signed integer holding the size of a buffer to take on a large negative number which is then used as the length of a memcpy call that occurs on the stack causing a buffer overflow.


TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash router httpd services via /userRpm/PingIframeRpm.htm request which contains redundant & in parameter.


ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authenticated local area network attacker can launch arbitrary code execution to control the system or disrupt service.


A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0) JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to stack based buffer overflow while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14903)


An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input an attacker can cause a call to $Extract to force an signed integer holding the size of a buffer to take on a large negative number which is then used as the length of a memcpy call that occurs on the stack causing a buffer overflow.


A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0) JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to stack based buffer overflow while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14845)


ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().


Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter.


GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.


An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12. Crafted data in a BMP file can trigger a write operation past the end of an allocated buffer or lead to a heap-based buffer overflow. An attacker can leverage this vulnerability to execute code in the context of the current process.


The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that for some buffer sizes a buffer overflow happens on a call to olm_session_describe. Furthermore safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.


Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.


XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.


Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.


Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in miniaudio.h


D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the global variables in the .bss section causing the process crashes or changes.


Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h.


Couchbase Server 6.5.x 6.6.x through 6.6.2 and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.


Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.


Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity Snapdragon Mobile


Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header.


tsMuxer

was

discovered

to

contain

a

heap-based

buffer

overflow

via

the

function

HevcSpsUnit::short_term_ref_pic_set(int)

in

hevc.cpp.


Couchbase Server 6.5.x 6.6.0 through 6.6.2 and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.


tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h.


An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response messages. This could result in arbitrary code execution.


MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd0c689be0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).


AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs) because of a heap-based buffer overflow.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

and

before


NETGEAR D7000 devices before 1.0.1.82 are affected by a stack-based buffer overflow by an unauthenticated attacker.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

and

before


NETGEAR R8000 devices before 1.0.4.62 are affected by a buffer overflow by an authenticated user.


UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can for example use a large amount of indentation.


libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c).


Asus

and

are

affected

by

a

buffer

overflow

in


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack making it unlikely that the flow of control can be subverted.


tsMuxer git-2678966 was discovered to contain a heap-based buffer overflow via the function HevcUnit::updateBits in hevc.cpp.


** DISPUTED ** Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from answer_auth and FuzzAuth). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 \do not represent real vulnerabilities to the best of our knowledge.\


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Accu-Time Systems MAXIMUS 1.0 telnet service suffers from a remote buffer overflow which causes the telnet service to crash


Open Asset Import Library (aka assimp) 5.1.0 and 5.1.1 has a heap-based buffer overflow in _m3d_safestr (called from m3d_load and Assimp::M3DWrapper::M3DWrapper).


** DISPUTED ** Dnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called from FuzzResizePacket and fuzz_rfc1035.c) because of the lack of a proper bounds check upon pseudo header re-insertion. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 \do not represent real vulnerabilities to the best of our knowledge.\ However a contributor states that a security patch (mentioned in 016162.html) is needed.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).


** DISPUTED ** Dnsmasq 2.86 has a heap-based buffer overflow in check_bad_address (called from check_for_bogus_wildcard and FuzzCheckForBogusWildcard). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 \do not represent real vulnerabilities to the best of our knowledge.\


MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd6e029ee0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (8 bytes) in __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c).


** DISPUTED ** Dnsmasq 2.86 has a heap-based buffer overflow in answer_request (called from FuzzAnswerTheRequest and fuzz_rfc1035.c). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 \do not represent real vulnerabilities to the best of our knowledge.\


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


** DISPUTED ** Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from hash_questions and fuzz_util.c). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 \do not represent real vulnerabilities to the best of our knowledge.\


NETGEAR R7000 devices before 1.0.9.42 are affected by a buffer overflow by an authenticated user.


Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data outside of the allocated buffer. The attacker has control over a part of the address that data is written to control over the written data and (to some extent) control over the amount of data that is written.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount of data to write. This allows an attacker to overwrite up to 250 bytes outside of the allocated buffer with arbitrary data.


An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence over the data written to the stack making it unlikely that the flow of control can be subverted.


GDAL

through

has

a

heap-based

buffer

overflow

in

PCIDSK::CPCIDSKFile::ReadFromFile

(called

from

PCIDSK::CPCIDSKSegment::ReadFromFile

and

PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes outside the boundaries of the buffer.


OpenEXR

before

has

a

heap-based

buffer

overflow

in

(called

from

IlmThread_3_1::NullThreadPoolProvider::addTask

and

IlmThread_3_1::ThreadPool::addGlobalTask).

NOTE:

may

be

inapplicable.


An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacker to write a large amount of arbitrary data outside the boundaries of a buffer.


** DISPUTED ** Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 \do not represent real vulnerabilities to the best of our knowledge.\


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

and

before


** DISPUTED ** Dnsmasq 2.86 has a heap-based buffer overflow in dhcp_reply (called from dhcp_packet and FuzzDhcp). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 \do not represent real vulnerabilities to the best of our knowledge.\


The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from the CDN server which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior CC32XX SDK v4.30.00.06 and prior CC13X0 SDK versions prior to v4.10.03 CC13X2 and CC26XX SDK versions prior to v4.40.00 CC3200 SDK v1.5.0 and prior CC3100 SDK v1.3.0 and prior).


An issue was discovered on Samsung mobile devices with O(8.x) P(9.0) and Q(10.0) (Broadcom Bluetooth chipsets) software. The Bluetooth UART driver has a buffer overflow. The Samsung ID is SVE-2020-18731 (January 2021).


On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4 and all versions of 12.1.x and 11.6.x big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed allowing an attacker to craft a special project file that may permit arbitrary code execution.


Multiple stack-based buffer overflow issues have been identified in the way the application processes project files allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).


There is a Heap-based Buffer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass.


A heap-based buffer overflow issue has been identified in the way the application processes project files allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).


Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user.


There is a buffer overflow vulnerability in Mate 30 10.1.0.126(C00E125R5P3). A module does not verify the some input when dealing with messages. Attackers can exploit this vulnerability by sending malicious input through specific module. This could cause buffer overflow compromising normal service.


Mate 30 10.0.0.203(C00E201R7P2) have a buffer overflow vulnerability. After obtaining the root permission an attacker can exploit the vulnerability to cause buffer overflow.


Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.


A flaw was found in GNU Binutils 2.35.1 where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability.


Sharp NEC Displays ((UN462A R1.300 and prior to it UN462VA R1.300 and prior to it UN492S R1.300 and prior to it UN492VS R1.300 and prior to it UN552A R1.300 and prior to it UN552S R1.300 and prior to it UN552VS R1.300 and prior to it UN552 R1.300 and prior to it UN552V R1.300 and prior to it UX552S R1.300 and prior to it UX552 R1.300 and prior to it V864Q R2.000 and prior to it C861Q R2.000 and prior to it P754Q R2.000 and prior to it V754Q R2.000 and prior to it C751Q R2.000 and prior to it V984Q R2.000 and prior to it C981Q R2.000 and prior to it P654Q R2.000 and prior to it V654Q R2.000 and prior to it C651Q R2.000 and prior to it V554Q R2.000 and prior to it P404 R3.200 and prior to it P484 R3.200 and prior to it P554 R3.200 and prior to it V404 R3.200 and prior to it V484 R3.200 and prior to it V554 R3.200 and prior to it V404-T R3.200 and prior to it V484-T R3.200 and prior to it V554-T R3.200 and prior to it C501 R2.000 and prior to it C551 R2.000 and prior to it C431 R2.000 and prior to it) allows an attacker a buffer overflow and to execute remote code by sending long parameters that contains specific characters in http request.


IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper parameter an authorized administrator could overflow a buffer and cause the server to crash. IBM X-Force ID: 197792.


A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality integrity and availability.


Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with an administrator privilege to execute an arbitrary OS command via unspecified vectors.


A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance. This vulnerability affected SMA 200 210 400 410 and 500v appliances.


IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow caused by improper bounds checking. A local attacker could overflow a buffer and cause the application to crash. IBM X-Force ID: 198934


A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200 210 400 410 and 500v appliances.


There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed but the buffer would remain the same as it is a static buffer. A remote unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability data integrity and confidentiality.


IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 194599.


A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200 210 400 410 and 500v appliances firmware 10.2.0.8-37sv 10.2.1.1-19sv 10.2.1.2-24sv and earlier versions.


A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.2 8.6.0.8 8.5.0.12 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.


There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to malicious application processes occupy system resources.


A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.


There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to device cannot be used properly.


A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. In the tcpTxThread function the received data is copied to a stack buffer. An off-by-3 condition can occur resulting in a stack-based buffer overflow.


There is a Heap-based buffer overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may rewrite the memory of adjacent objects.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

In

affected

versions

the

implementation

for

`tf.raw_ops.ExperimentalDatasetToTFRecord`

and

can

trigger

heap

buffer

overflow

and

segmentation

fault.

The

assumes

that

all

records

in

the

dataset

are

of

string

type.

However

there

is

no

check

for

that

and

the

example

given

above

uses

numeric

types.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


There is a Heap-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause root permission which can be escalated.


A vulnerability has been identified in Simcenter Femap V2020.2 (All versions) Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14683 ZDI-CAN-15283 ZDI-CAN-15303 ZDI-CAN-15593)


ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however it is shipped by some Linux distributions.


A vulnerability has been identified in Simcenter Femap V2020.2 (All versions) Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14646 ZDI-CAN-14679 ZDI-CAN-15084 ZDI-CAN-15304)


A vulnerability has been identified in Simcenter Femap V2020.2 (All versions) Simcenter Femap V2021.1 (All versions). Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15085 ZDI-CAN-15289 ZDI-CAN-15602)


Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.


A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overflow vulnerability while parsing specially crafted BDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15061)


Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf.


Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system.


Adobe Bridge version 11.1 (and earlier) is affected by a Buffer Overflow vulnerability due to insecure handling of a malicious Bridge file potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.


QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.


Adobe Photoshop versions 21.2.10 (and earlier) and 22.4.3 (and earlier) are affected by a heap-based buffer overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.


Grok

through

has

a

heap-based

buffer

overflow

in

grk::FileFormatDecompress::apply_palette_clr

(called

from

grk::FileFormatDecompress::applyColour).


XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a specially-crafted .cpp file.


iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.


matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry) related to use of HDF5 1.12.0.


Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability. A local low privileged attacker may potentially exploit this vulnerability leading to an application crash.


An issue was discovered in SKALE sgxwallet 1.58.3. sgx_disp_ippsAES_GCMEncrypt allows an out-of-bounds write resulting in a segfault and compromised enclave. This issue describes a buffer overflow which was resolved prior to v1.77.0 and not reproducible in latest sgxwallet v1.77.0


KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE.


Adobe Bridge version 11.1 (and earlier) is affected by a heap-based buffer overflow vulnerability when parsing a crafted .SGI file. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello.


An issue was discovered in ACRN before 2.5. dmar_free_irte in hypervisor/arch/x86/vtd.c allows an irte_alloc_bitmap buffer overflow.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities. Placeholder


Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.


A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted network packet can lead to a heap buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.


Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted javascript file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs' Xmill 0.7. Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to strcpy copying the path provided by the user into a staticly sized buffer without any length checks resulting in a stack-buffer overflow. An attacker can provide malicious input to trigger this vulnerability.


Contiki-NG is an open-source cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After establishing a TCP socket using the tcp-socket library it is possible for the remote end to send a packet with a data offset that is unvalidated. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.


Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially crafted font file. Successful exploitation could lead to arbitrary code execution. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A heap-based buffer overflow vulnerability exists in the readDatHeadVec functionality of AnyCubic Chitubox AnyCubic Plugin 1.0.0. A specially-crafted GF file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. In the default case of DecodeTreeBlock a label is created via CurPath::AddLabel in order to track the label for later reference. An attacker can provide a malicious file to trigger this vulnerability.


A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. Within `DecodeTreeBlock` which is called during the decompression of an XMI file a UINT32 is loaded from the file and used as trusted input as the length of a buffer. An attacker can provide a malicious file to trigger this vulnerability.


Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to memcpy copying the path provided by the user into a staticly sized buffer without any length checks resulting in a stack-buffer overflow.


Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities. Placeholder


Adobe Animate version 21.0.3 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Contiki-NG is an open-source cross-platform operating system for internet of things devices. In versions prior to 4.5 buffer overflow can be triggered by an input packet when using either of Contiki-NG's two RPL implementations in source-routing mode. The problem has been patched in Contiki-NG 4.5. Users can apply the patch for this vulnerability out-of-band as a workaround.


A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker to issue a specially crafted iotcl which could lead to code execution on affected devices. An attacker must first obtain the ability to execute low-privileged code on the target device in order to exploit this vulnerability.


Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Integer Truncation Privilege Escalation vulnerability which could allow a local attacker to trigger a buffer overflow and escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


ok-file-formats through 2021-04-29 has a heap-based buffer overflow in the ok_csv_circular_buffer_read function in ok_csv.c.


Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker to issue a specially crafted iotcl to escalate privileges on affected devices. An attacker must first obtain the ability to execute low-privileged code on the target device in order to exploit this vulnerability.


XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.


A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver where the user calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or escalate privileges on the system. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31 if not installed in Strictly Local Management mode have a buffer overflow vulnerability in the remote GetDumpFile command that could allow a user to attempt various attacks. In non-secure mode the user is unauthenticated


A buffer overflow CWE-121 in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2 may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.


Adobe InDesign versions 16.4 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41 Kernel 5.1 before 05.16.41 Kernel 5.2 before 05.26.41 Kernel 5.3 before 05.35.41 and Kernel 5.4 before 05.42.20. A stack-based buffer overflow leads toarbitrary code execution in UEFI DisplayTypeDxe DXE driver.


A stack-based buffer overflow vulnerability in Trend Micro Apex One Apex One as a Service and Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.


in

in

the

Linux

kernel

through

allows

a

heap-based

buffer

overflow

by

an

attacker

who

can

write

a

string

to

the

AMD

GPU

display

drivers

debug

filesystem.

There

are

no

checks

on

size

within

when

it

uses

the

size

of

to

copy

a

userspace

buffer

into

a

heap

buffer.


A local buffer overflow vulnerability exists in the latest version of Miniftpd in ftpproto.c through the tmp variable where a crafted payload can be sent to the affected function.


Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31 if not installed in Strictly Local Management mode have a buffer overflow vulnerability in the remote firmware download feature that could allow remote unauthenticated users to perform various attacks. In non-secure mode the user is unauthenticated.


An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image or read up to 1024 bytes of non-consecutive heap data without control over the read location.


Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library.


A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.


A possible heap buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution.


A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution.


A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.


A possible heap-based buffer overflow vulnerability in DSP kernel driver prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.


A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.


An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.


An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow.


A possible buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary code execution.


A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.


A possible buffer overflow vulnerability in maetd_dec_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.


Assuming system privilege is gained possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release 1 allows privilege escalation to Root by hijacking loaded library.


An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.


A possible buffer overflow vulnerability in maetd_cpy_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.


A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution.


A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.


Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.


Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing host data in the HTTP request process.


Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.


D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack and has no limit on the size.


Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.


Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow since supplying an output buffer smaller than 128 characters may overflow the output buffer regardless of the 'maxlen' argument supplied


ARM

astcenc

is

vulnerable

to

Buffer

Overflow.

When

the

compression

function

of

the

astc-encoder

project

with

-cl

option

was

used

a

stack-buffer-overflow

occurred

in

function

in

function

compress_symbolic_block_for_partition_2planes()

in

\/Source/astcenc_compress_symbolic.cpp\.


An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A buffer overflow existed in the vaultServer component. This was exploitable by a remote unauthenticated attacker.


Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.


CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.


The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of PortID TLV by sending a crafted lldp packet to the device integer underflow would occur and the negative number will be passed to memcpy() later which may cause buffer overflow or invalid memory access.


SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.


In NTFS-3G versions < 2021.8.22 when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.


SAP 3D Visual Enterprise Viewer version - 9 allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and causes the application to crash and becoming temporarily unavailable until the user restarts the application.


Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow which may allow an attacker to remotely execute code.


SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.


The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of ChassisID TLV by sending a crafted lldp packet to the device integer underflow would occur and the negative number will be passed to memcpy() later which may cause buffer overflow or invalid memory access.


In NTFS-3G versions < 2021.8.22 when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.


ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME RDATA or RDLENGTH (for A or AAAA).


OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len.


TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer overflow. This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1 TensorFlow 2.5.2 and TensorFlow 2.4.4 as these are also affected and still in supported range.


tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data OACK and other options.


ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value leading to a buffer overflow. The attacker can send a PFCP Session Establishment Request with \internet\ as the PDI Network Instance. The first character is interpreted as a length value to be used in a memcpy call. The destination buffer is only 100 bytes long on the stack. Then 'i' gets interpreted as 105 bytes to copy from the source buffer to the destination buffer.


Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.


TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory via a heap buffer overflow. This occurs because the ranks of the `input` `input_h` and `input_c` parameters are not validated but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1 TensorFlow 2.5.2 and TensorFlow 2.4.4 as these are also affected and still in supported range.


NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length value is trusted during a backup.cgi file upload. The attacker must add a \\n before the Content-Length header.


Telegram Android <7.1.0 (2090) Telegram iOS <7.1 and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.


RIOT-OS

before

commit

contains

a

buffer

overflow

which

could

allow

attackers

to

obtain

sensitive

information.


User controlled parameters related to SMTP notifications are not correctly validated. This can lead to a buffer overflow resulting in crashes and data leakage.


An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files leading to a heap-based buffer overflow.


Telegram Android <7.1.0 (2090) Telegram iOS <7.1 and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.


In mjs_json.c in Cesanta MongooseOS mJS 1.26 a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse which can potentially lead to redirection of control flow.


An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request due to an incorrect signed integer comparison. This vulnerability requires the attacker to send a malformed HTTP packet with a negative Content-Length which bypasses the size checks and results in a large heap overflow in the wbs_multidata buffer copy.


RIOT-OS

before

commit

contains

a

buffer

overflow

that

could

allow

attackers

to

obtain

sensitive

information.


Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB.


An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request due to lack of size validation. This vulnerability requires the attacker to send a crafted HTTP POST request with a URI longer than 50 bytes. This leads to a heap overflow in wbs_post() via an strcpy() call.


Telegram

Android

Telegram

iOS

and

Telegram

macOS

are

affected

by

a

Heap

Buffer

Overflow

in

the

VGradientCache::generateGradientColorTable

function

of

their

custom

fork

of

the

rlottie

library.

A

remote

attacker

might

be

able

to

overwrite

heap

memory

out-of-bounds

on

a

victim

device

via

a

malicious

animated

sticker.


** UNSUPPORTED WHEN ASSIGNED ** D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49 affecting the CUR file parsing functionality (BITMAPINFOHEADER Structure 'BitCount' file format field) that will end up corrupting the Structure Exception Handler (SEH). Attackers could exploit this issue to achieve code execution when a user opens or views a malformed/specially crafted CUR file.


Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content by means of specifically crafted command line arguments.


A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1 17.x before 17.9.2 and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch.


ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an application that includes the Zint Barcode Generator library code.


A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow a different vulnerability than CVE-2021-27396. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13290)


RIOT-OS

contains

a

buffer

overflow

vulnerability

in

through

the

function.


The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a v8.2.3 and v8.2.0_CBN4 and v7.4.2h uses unsafe string function to process user input. Authenticated attackers can abuse this vulnerability to exploit stack-based buffer overflows allowing execution of arbitrary code as the root user account.


SerenityOS

Unspecified

is

affected

by:

Buffer

Overflow.

The

impact

is:

obtain

sensitive

information

(context-dependent).

The

component

is:

function.

The

attack

vector

is:

Parsing

RSA

Key


eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation resulting in a heap-based buffer overflow.


Delta Industrial Automation COMMGR Versions 1.12 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute remote code.


The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040 0x80102044 0x80102050 or 0x80102054 IOCTL request.


Datakit Software libraries CatiaV5_3dRead CatiaV6_3dRead Step3dRead Ug3dReadPsr Jt3dReadPsr modules in KeyShot Versions v10.1 and prior lack proper validation of user-supplied data when parsing STP files. This could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.


RIOT-OS

contains

a

buffer

overflow

vulnerability

in


An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route a very long text entry for the\'s_ip\ and \s_mac\ fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.


The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage using Internet Explorer where the exploit could be triggered.


A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow a different vulnerability than CVE-2021-27398. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13279)


A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13) Solid Edge SE2020 (All versions < SE2020MP14) Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13040)


An issue was discovered in prog.cgi on D-Link DIR-878 1.30B08 devices. Because strcat is misused there is a stack-based buffer overflow that does not require authentication.


Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip


A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..


CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.


CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.


Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.


Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


Possible buffer overflow due to Improper validation of received CF-ACK and CF-Poll data frames in Snapdragon Auto Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music


Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


In Alpine Linux apk-tools before 2.12.5 the tarball parser allows a buffer overflow and crash.


Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables


Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function.


A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


Adobe Photoshop versions 21.2.11 (and earlier) and 22.5 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted SVG file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a buffer overflow during FIDO2 signature validation in webauthn registration.


There is a Heap-based buffer overflow vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity.


libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867.


There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones. Successful exploitation of this vulnerability may affect function stability.


Buffer overflow in StarOffice StarScheduler web server allows remote attackers to gain root access via a long GET command.


Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable.


Buffer overflow in MMDF server allows remote attackers to gain privileges via a long MAIL FROM command to the SMTP daemon.


Buffer overflow in krb425_conv_principal function in Kerberos 5 allows remote attackers to gain root privileges.


Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site aka the \Server-Side Image Map Components\ vulnerability.


Buffer overflows in lpspooler in the fileset PrinterMgmt.LP-SPOOL of HP-UX 11.0 and earlier allows local users to gain privileges.


Buffer overflow in ICQ 99b 1.1.1.1 client allows remote attackers to execute commands via a malformed URL within an ICQ message.


Buffer overflow in mailx mail command (aka Mail) on Linux systems allows local users to gain privileges via a long -c (carbon copy) parameter.


Buffer overflow in Lynx 2.x allows remote attackers to crash Lynx and possibly execute commands via a long URL in a malicious web page.


Buffer overflow in xconq and cconq game programs on Red Hat Linux allows local users to gain additional privileges via long DISPLAY environmental variable.


The Delegate application proxy has several buffer overflows which allow a remote attacker to execute commands.


Buffer overflow in lpstat in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long -n option.


Buffer overflow in qpopper 3.0 beta versions allows local users to gain privileges via a long LIST command.


Buffer overflow in oidldapd in Oracle 8.1.6 allow local users to gain privileges via a long \connect\ command line parameter.


Buffer overflow in IRIX libgl.so library allows local users to gain root privileges via a long HOME variable to programs such as (1) gmemusage and (2) gr_osview.


Buffer overflows in Tiny FTPd 0.52 beta3 FTP server allows users to execute commands via the STOR RNTO MKD XMKD RMD XRMD APPE SIZE and RNFR commands.


Buffer overflow in Oracle 8.1.5 applications such as names namesctl onrsd osslogin tnslsnr tnsping trcasst and trcroute possibly allow local users to gain privileges via a long ORACLE_HOME environmental variable.


Buffer overflow in calserver in SCO OpenServer allows remote attackers to gain root access via a long message.


Buffer overflow in CamShot WebCam HTTP server allows remote attackers to execute commands via a long GET request.


Buffer overflow in Xsun X server in Solaris 7 allows local users to gain root privileges via a long -dev parameter.


Buffer overflow in dvtermtype in Tridia Double Vision 3.07.00 allows local users to gain root privileges via a long terminal type argument.


Buffer overflow in krshd in Kerberos 5 allows remote attackers to gain root privileges.


Buffer overflow in krb_rd_req function in Kerberos 4 and 5 allows remote attackers to gain root privileges.


Buffer overflow in ZBServer Pro 1.50 allows remote attackers to execute commands via a long GET request.


Buffer overflow in Winamp client allows remote attackers to execute commands via a long entry in a .pls file.


Buffer overflow in ufsrestore in Solaris 8 and earlier allows local users to gain root privileges via a long pathname.


Buffer overflow in dmplay in IRIX 6.2 and 6.3 allows local users to gain root privileges via a long command line option.


Buffer overflow in vchkpw/vpopmail POP authentication package allows remote attackers to gain root privileges via a long username or password.


Buffer overflows in brouted in FreeBSD and possibly other OSes allows local users to gain root privileges via long command line arguments.


Buffer overflow in fld program in Kanji on Console (KON) package on Linux may allow local users to gain root privileges via an input file containing long CHARSET_REGISTRY or CHARSET_ENCODING settings.


Buffer overflow in UnixWare ppptalk command allows local users to gain privileges via a long prompt argument.


Buffer overflow in w3-msql CGI program in miniSQL package allows remote attackers to execute commands.


Buffer overflow in bdf program in HP-UX 11.00 may allow local users to gain root privileges via a long -t option.


Buffer overflow in ircII 4.4 IRC client allows remote attackers to execute commands via the DCC chat capability.


Buffer overflow in xconq and cconq game programs on Red Hat Linux allows local users to gain additional privileges via long USER environmental variable.


Buffer overflow in listmanager earlier than 2.105.1 allows local users to gain additional privileges.


Buffer overflows in Linux cdwtools 093 and earlier allows local users to gain root privileges.


Buffer overflow in LCDproc allows remote attackers to gain root privileges via the screen_add command.


Buffer overflow in KDE kdesud on Linux allows local uses to gain privileges via a long DISPLAY environmental variable.


Buffer overflow in ksu in Kerberos 5 allows local users to gain root privileges.


Buffer overflow in xlockmore xlock program version 4.16 and earlier allows local users to read sensitive data from memory via a long -mode option.


Buffer overflow in UnixWare i2odialogd daemon allows remote attackers to gain root access via a long username/password authorization string.


Buffer overflow in healthd for FreeBSD allows local users to gain root privileges.


Buffer overflow in mhshow in the Linux nmh package allows remote attackers to execute commands via malformed MIME headers in an email message.


Buffer overflow in gr_osview in IRIX 6.2 and 6.3 allows local users to gain privileges via a long -D option.


Buffer overflow in UnixWare rtpm program allows local users to gain privileges via a long environmental variable.


Buffer overflows in pgxconfig in the Raptor GFX configuration tool allow local users to gain privileges via command line options.


Buffer overflow in kon program in Kanji on Console (KON) package on Linux may allow local users to gain root privileges via a long -StartupMessage parameter.


Buffer overflow in SCO scohelp program allows remote attackers to execute commands.


Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands.


Buffer overflow in portmir for AIX 4.3.0 allows local users to corrupt lock files and gain root privileges via the echo_error routine.


Buffer overflow in ypbind 3.3 possibly allows an attacker to gain root privileges.


Buffer overflow in piobe command in IBM AIX 4.3.x allows local users to gain privileges via long environmental variables.


Buffer overflow in catopen() function in FreeBSD 5.0 and earlier and possibly other OSes allows local users to gain root privileges via a long environmental variable.


Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier and possibly other Linux operating systems allows an attacker to gain root privileges when ypserv is built without a vsyslog() function.


Buffer overflow in cmctl program in Oracle 8.1.5 Connection Manager Control allows local users to gain privileges via a long command line argument.


Buffer overflow in cu program in HP-UX 11.0 may allow local users to gain privileges via a long -l command line argument.


Buffer overflow in pam_localuser PAM module in Red Hat Linux 7.x and 6.x allows attackers to gain privileges.


Buffer overflow in fileplace in bos.perf.tools in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.


Buffer overflow in crontab in IBM AIX 5.2 allows local users to gain privileges via long command line arguments.


The Trend Micro AntiVirus scan engine before 8.550-1001 as used in Trend Micro PC-Cillin Internet Security 2007 and Tmxpflt.sys 8.320.1004 and 8.500.0.1002 has weak permissions (Everyone:Write) for the \\\\.\\Tmfilter device which allows local users to send arbitrary content to the device via the IOCTL functionality. NOTE: this can be leveraged for privilege escalation by exploiting a buffer overflow in the handler for IOCTL 0xa0284403.


Buffer overflow in mkpath in bos.rte.methods in IBM AIX 5.2 and 5.3 allows local users to gain privileges via a long ODM name.


Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown impact via a long (1) URL (2) backImage or (3) titleImage property value; (4) a long first argument to the advancedOpen method; a long argument to the (5) isDVDPath or (6) rawParse method; or (7) a .smpl file with a long path attribute in an item element in a PlayList.


Buffer overflow in fcstat in devices.common.IBM.fc.rte in IBM AIX 5.2 and 5.3 allows local users to gain privileges via a long input parameter.


Buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 has unknown impact and remote attack vectors aka ZD-00000034. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes but duplicates with other CVEs are difficult to determine.


Buffer overflow in ibstat in devices.common.IBM.ib.rte in IBM AIX 5.3 allows local users to gain privileges via unspecified vectors.


Buffer overflow in uucp in bos.net.uucp in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.


The chunk_split function in string.c in PHP 5.2.3 does not properly calculate the needed buffer size due to precision loss when performing integer arithmetic with floating point numbers which has unknown attack vectors and impact possibly resulting in a heap-based buffer overflow. NOTE: this is due to an incomplete fix for CVE-2007-2872.


The nvcoaft51 driver in Norman Virus Control (NVC) 5.82 uses weak permissions (unrestricted write access) for the NvcOa device which allows local users to gain privileges by (1) triggering a buffer overflow in a kernel pool via a string argument to ioctl 0xBF67201C; or by (2) sending a crafted KEVENT structure through ioctl 0xBF672028 to overwrite arbitrary memory locations.


Buffer overflow in cli32 in Areca CLI 1.72.250 and earlier might allow local users to gain privileges via a long argument. NOTE: this program is not setuid by default but there are some usage scenarios in which an administrator might make it setuid.


Multiple buffer overflows in EarthAgent.exe in Trend Micro ServerProtect 5.58 for Windows before Security Patch 4 allow remote attackers to have an unknown impact via certain RPC function calls to (1) RPCFN_EVENTBACK_DoHotFix or (2) CMD_CHANGE_AGENT_REGISTER_INFO.


Buffer overflow in lpd in bos.rte.printers in AIX 5.2 and 5.3 allows local users with printq group privileges to gain root privileges.


The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2 as used by the Kerberos administration daemon (kadmind) and other applications that use krb5 does not correctly check the buffer length in some environments and architectures which might allow remote attackers to conduct a buffer overflow attack.


Multiple unspecified vulnerabilities in (1) Net6Helper.DLL (aka Net6Launcher Class) 4.5.2 and earlier (2) npCtxCAO.dll (aka Citrix Endpoint Analysis Client) in a Firefox plugin directory and (3) a second npCtxCAO.dll (aka CCAOControl Object) before 4.5.0.0 in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 have unknown impact and attack vectors possibly related to buffer overflows. NOTE: vector 3 might overlap CVE-2007-3679.


Buffer overflow in xlplm in plm.server.rte in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.


Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a when configured as a Primary or Backup Domain controller allows remote attackers to have an unknown impact via crafted GETDC mailslot requests related to handling of GETDC logon server requests.


** DISPUTED ** Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name (interface name) in the ifr_name field. NOTE: the vendor disputes this issue stating that the application requires root access so privilege boundaries are not crossed.


Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+ and 10.1.0.5 unknown impact and remote attack vectors related to (1) Import (DB01) and (2) Advanced Queuing (DB25). NOTE: as of 20071108 Oracle has not disputed reliable researcher claims that DB25 is for a buffer overflow in the DBLINK_INFO procedure in the DBMS_AQADM_SYS package.


Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0 as shipped in Microsoft Windows XP SP2 XP Professional x64 and x64 SP2 Server 2003 SP1 and SP2 and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL as originally discovered in the wild.


Multiple stack-based buffer overflows in Command EXEC in Cisco IOS allow local users to gain privileges via unspecified vectors aka (1) PSIRT-0474975756 and (2) PSIRT-0388256465. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Buffer overflow in libsrtp in Ingate Firewall before 4.6.0 and SIParator before 4.6.0 has unknown impact and attack vectors. NOTE: it is not clear whether this issue crosses privilege boundaries.


Buffer overflow in tftp in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to gain privileges via unspecified vectors.


The ipalloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD does not properly allocate memory which makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value related to \integer rounding and overflow\ errors.


Unspecified vulnerability in the Oracle Text component in Oracle Database 9.0.1.5+ and 9.2.0.5 has unknown impact and attack vectors aka DB12. NOTE: as of 20070424 Oracle has not disputed reliable claims that this involves a buffer overflow in the ctxsrv server daemon.


CA Anti-Virus for the Enterprise r8 and Threat Manager r8 before 20070510 use weak permissions (NULL security descriptor) for the Task Service shared file mapping which allows local users to modify this mapping and gain privileges by triggering a stack-based buffer overflow in InoCore.dll before 8.0.448.0.


Buffer overflow in Ghost Service Manager as used in Symantec Norton Ghost Norton Save & Recovery LiveState Recovery and BackupExec System Recovery before 20070426 allows local users to gain privileges via a long string.


Unspecified vulnerability in the Advanced Replication component in Oracle Database 9.0.1.5+ 9.2.0.7 and 10.1.0.5 has unknown impact and attack vectors aka DB10. NOTE: as of 20070424 Oracle has not disputed claims that these are buffer overflows in kkzi.o for the SYS.DBMS_SNAP_INTERNAL package using the (1) SNAP_OWNER or (2) SNAP_NAME parameters.


Buffer overflow in tcl/win/tclWinReg.c in Tcl (Tcl/Tk) before 8.5a6 allows local users to gain privileges via long registry key paths.


Unspecified vulnerability in the Upgrade/Downgrade component of Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors aka DB13. NOTE: as of 20070424 Oracle has not disputed reliable claims that this is a buffer overflow involving the \mig utility.\


Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.2 have unknown impact and remote authenticated attack vectors related to (1) Change Data Capture (CDC) aka DB08 and (2) Oracle Instant Client aka DB11. NOTE: as of 20070424 oracle has not disputed reliable claims that these issues are buffer overflows using a long CHANGE_TABLE_NAME parameter to the DBMS_CDC_IPUBLISH.CHGTAB_CACHE procedure (DB08) and Oracle Instant Client genezi utility (DB11).