Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sloop() slh->facet().


An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt aka CID-51c19bf3d5cf.


In the Linux kernel 5.5.0 and newer the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series starting with v5.4.7 as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1 5.5.14 and 5.4.29. (issue is aka ZDI-CAN-10780)


Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .fla file in Animate.


HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message which may be exploited to cause the process reboot.


HUAWEI nova 4 versions earlier than 10.0.0.165(C01E34R2P4) and SydneyM-AL00 versions earlier than 10.0.0.165(C00E66R1P5) have an out-of-bounds read and write vulnerability. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected products. Due to insufficient validation of packet which may be exploited to cause the information leakage or arbitrary code execution.


Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.


There is an out-of-bounds read vulnerability in some versions of NIP6800 Secospace USG6600 and USG9500. The software reads data past the end of the intended buffer when parsing DHCP messages including crafted parameter. Successful exploit could cause certain service abnormal.


Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.


Taurus-AL00A version 10.0.0.1(C00E1R1P1) has an out-of-bounds read vulnerability in XFRM module. An authenticated local attacker may perform a specific operation to exploit this vulnerability. Due to insufficient validation of the parameters which may be exploited to cause information leak.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6 Security Update 2020-004 Mojave Security Update 2020-004 High Sierra. A local user may be able to cause unexpected system termination or read kernel memory.


Adobe FrameMaker version 2019.0.6 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious FrameMaker file.


Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability which could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .fla file in Animate.


Adobe Premiere Pro versions 14.2 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.7 Security Update 2020-005 High Sierra Security Update 2020-005 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution.


A memory buffer error vulnerability exists in a component interface of Huawei Smartphone. Local attackers may exploit this vulnerability by carefully constructing attack scenarios to cause out-of-bounds read.


An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it aka CID-2e90ca68b0d2.


Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an out-of-bounds read and write vulnerability. Some functions do not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device.


Adobe Premiere Rush versions 1.5.12 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution .


There is a few bytes out-of-bounds read vulnerability in some Huawei products. The software reads data past the end of the intended buffer when parsing certain message an authenticated attacker could exploit this vulnerability by sending crafted messages to the device. Successful exploit may cause service abnormal in specific scenario.Affected product versions include:AR120-S versions V200R007C00SPC900 V200R007C00SPCa00


A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of pseudo-normalized correlation R'(0) that could result in disclosure of information.


An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check for proper '\\0' termination of the resource record name string leading to an out-of-bounds read and potentially causing information leak or Denial-or-Service.


Acrobat Reader DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c.


An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompress_name() in pico_dns_common.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet causing out-of-bounds reads that lead to Denial-of-Service.


The code that processes DNS responses in uIP through 1.0 as used in Contiki and Contiki-NG does not check whether the number of responses specified in the DNS packet header corresponds to the response data available in the DNS packet leading to an out-of-bounds read and Denial-of-Service in resolv.c.


An

issue

was

discovered

in

picoTCP

and

picoTCP-NG

through

The

code

that

processes

DNS

responses

in

pico_mdns_handle_data_as_answers_generic()

in

does

not

check

whether

the

number

of

answers/responses

specified

in

a

DNS

packet

header

corresponds

to

the

response

data

available

in

the

packet

leading

to

an

out-of-bounds

read

invalid

pointer

dereference

and

Denial-of-Service.


Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing crafted PDF files. This could result in a read past the end of an allocated memory structure potentially resulting in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.


Adobe After Effects version 17.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted .aepx file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit.


An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets which leads to an out-of-bounds read when assembling received packets into a data segment eventually causing Denial-of-Service or an information leak.


A vulnerability in an Trend Micro Apex One Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an attacker to manipulate it to cause an out-of-bounds read that crashes multiple processes in the product. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times attempting to pass invalid colormap data to the event logger. The patch replaces the hardcoded 256 value with a call to MagickMin() to ensure the proper value is used. This could impact application availability when a specially crafted input file is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.


The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.


An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a domain name compression pointer is pointing within the bounds of the packet (e.g. forward compression pointer jumps are allowed) which leads to an Out-of-bounds Read and a Denial-of-Service as a consequence.


TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `\dc:format=\\\image/dng\\\` within `profile` due to improper string handling when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.


An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the application due to an out-of-bounds read vulnerability on the LAquis SCADA (Versions prior to 4.3.1.870).


An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unauthenticated remote attacker could result in an out-of-bounds read of up to three bytes via network access.


There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.


There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability.


A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality causing an out-of-bounds read. The highest threat from this vulnerability is system availability.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave. A local user may be able to cause unexpected system termination or read kernel memory.


An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.


An issue was discovered in Bftpd 5.3. Under certain circumstances an out-of-bounds read is triggered due to an uninitialized value. The daemon crashes at startup in the hidegroups_init function in dirlist.c.


Delta Industrial Automation CNCSoft ScreenEditor v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user opens a specially crafted malicious input file due to the lack of validation.


An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension headers) doesn't check for a valid length of an extension header and therefore an out-of-bounds read can occur in _fnet_ip6_ext_header_handler_options in fnet_ip6.c leading to Denial-of-Service.


An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 destination options does not check for a valid length of the destination options header. This results in an Out-of-Bounds Read and depending on the memory protection mechanism this may result in Denial-of-Service in pico_ipv6_process_destopt() in pico_ipv6.c.


Advantech WebAccess HMI Designer Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project files which may allow an attacker to read information.


Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files which may allow an attacker to read information.


A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.


LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled.


An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write as demonstrated by ImfTileOffsets.cpp.


In libImaging/SgiRleDecode.c in Pillow through 7.0.0 a number of out-of-bounds reads exist in the parsing of SGI image files a different issue than CVE-2020-5311.


In nDPI through 3.2 Stable an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library.


Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


In FreeRDP after 1.1 and before 2.0.0 a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.


An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.


In FreeRDP after 1.0 and before 2.0.0 there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.


In FreeRDP after 1.0 and before 2.0.0 there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.


In FreeRDP greater than 1.1 and before 2.0.0 there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.


An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp.


An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. There is an Out-of-bounds read in the MLDAP Trustlet. The Samsung ID is SVE-2019-16565 (April 2020).


An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.


libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.


An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier leading to an out-of-bounds read.


libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.


In

FreeRDP

after

and

before

there

is

an

out-of-bounds

read

in

autodetect_recv_bandwidth_measure_results.

A

malicious

server

can

extract

up

to

bytes

of

client

memory

with

a

manipulated

message

by

providing

a

short

input

and

reading

the

measurement

result

data.

This

has

been

patched

in


An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.


ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.


Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfedges_last().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->boundary_entry_objects SEdge_of.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() store_iv().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->center_vertex():.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SM_io_parser.h SM_io_parser<Decorator_>::read_vertex() set_first_out_edge().


The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read aka CID-973c096f6a85.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_vertex().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->next().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_volume() seh->twin().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->twin().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->snext().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_next().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->facet().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->sprev().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfloop().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->source().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfedges_begin().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->boundary_entry_objects SLoop_of.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() store_fc().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->out_sedge().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SM_io_parser.h SM_io_parser<Decorator_>::read_vertex() set_face().


A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_face().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->prev().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_vertex() Halfedge_of.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_begin().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_volume() ch->shell_entry_objects().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->twin().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->svertices_begin().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->sfaces_last().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_facet() fh->incident_volume().


Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->incident_sface().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->svertices_last().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_face() set_halfedge().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->incident_sface().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser<PMDEC>::read_hedge() e->set_prev().


A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read and write if a user applied specific image filters to a specially crafted image and sent the resulting image.


There is an out-of-bounds read vulnerability in Huawei CloudEngine products. The software reads data past the end of the intended buffer when parsing certain PIM message an adjacent attacker could send crafted PIM messages to the device successful exploit could cause out of bounds read when the system does the certain operation.


Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3 all versions between 4.57.0 and 4.80.1 all versions between 4.81.0 and 4.93.1 and versions 4.94.0 4.95.0 4.96.0 4.97.0 4.98.0.


NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds read vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message which may be exploited to cause the device reboot.


Huawei USG6000V with versions V500R001C20SPC300 V500R003C00SPC100 and V500R005C00SPC100 have an out-of-bounds read vulnerability. Due to a logical flaw in a JSON parsing routine a remote unauthenticated attacker could exploit this vulnerability to disrupt service in the affected products.


There is an out-of-bounds read vulnerability in several products. The software reads data past the end of the intended buffer when parsing certain crafted DHCP messages. Successful exploit could cause certain service abnormal. Affected product versions include:NIP6800 versions V500R001C30 V500R001C60SPC500 V500R005C00;S12700 versions V200R008C00;S2700 versions V200R008C00;S5700 versions V200R008C00;S6700 versions V200R008C00;S7700 versions V200R008C00;S9700 versions V200R008C00;Secospace USG6600 versions V500R001C30SPC200 V500R001C30SPC600 V500R001C60SPC500 V500R005C00;USG9500 versions V500R001C30SPC300 V500R001C30SPC600 V500R001C60SPC500 V500R005C00.


Eaton HMiSoft VU3 (HMIVU3 runtime not impacted) Version 3.00.23 and prior however the HMIVU runtimes are not impacted by these issues. A specially crafted input file could trigger an out-of-bounds read when loaded by the affected product.


Delta Industrial Automation DOPSoft Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files which may allow an attacker to read information and/or crash the application.


Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.


In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0 there are multiple out-of-bounds reads via a crafted JP2 file.


In libImaging/PcxDecode.c in Pillow before 7.1.0 an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.


An issue was discovered on Samsung mobile devices with O(8.x) P(9.x) and Q(10.0) software. There is an out-of-bounds read vulnerability in media.audio_policy. The Samsung ID is SVE-2019-16333 (February 2020).


VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (JPEG2000 parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.


VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804 6.7 before ESXi670-202008101-SG 6.5 before ESXi650-202007101-SG) Workstation (15.x) Fusion (11.x before 11.5.6) contain an out-of-bounds read vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.


VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG) Workstation (15.x before 15.5.5) and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in NVMe functionality. A malicious actor with local non-administrative access to a virtual machine with a virtual NVMe controller present may be able to read privileged information contained in physical memory.


VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMR STRETCHDIBITS parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.


VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMF Parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.


In Foxit Reader and PhantomPDF before 10.0.1 and PhantomPDF before 9.7.3 attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur.


In Dovecot before 2.3.11.3 sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.


Manipulating individual parts of a URL object could have caused an out-of-bounds read leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10 Firefox < 78 and Thunderbird < 68.10.0.


Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.


A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20 it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.


An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c.


Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an incoming network packet is directly used as a length field without any bounds check.


Possible

read

out

of

bounds

in

dns

read.

Zephyr

versions

contain

Out-of-bounds

Read

For

more

information

see


sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.


In QEMU 5.0.0 and earlier megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.


gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\\0' value which allows attackers to trigger an out-of-bounds read aka CID-15753588bcd4.


Artifex

Software

Inc.

MuJS

before

allows

context-dependent

attackers

to

obtain

sensitive

information

by

using

the

\opname

in

crafted

JavaScript

file\

approach

related

to

an

\Out-of-Bounds

read\

issue

affecting

the

function

in

the

jsdump.c

component.


tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.


The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry which triggers out-of-bounds read operations.


idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input which triggers an out-of-bounds read a different vulnerability than CVE-2015-8948.


The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file which triggers an out-of-bounds read.


In an ioctl handler in all Qualcomm products with Android for MSM Firefox OS for MSM or QRD Android if a user supplies a value too large then an out-of-bounds read occurs.


MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable which triggers an out-of-bounds read.


An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.


An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.


Unspecified vulnerability in Oracle Java SE 6u113 7u99 and 8u77 allows remote attackers to affect confidentiality integrity and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information via crafted font data which triggers an out-of-bounds read.


The BMP and GIF image decoding engine in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to obtain sensitive information (memory contents) via a crafted (1) BMP or (2) GIF image which causes an out-of-bounds read.


Adobe Photoshop versions Photoshop CC 2019 and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.


The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.


The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.


The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.


The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.


The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.


The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.


The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.


CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.


rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak.


rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() that results in an information leak.


rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak.


A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file which can result in a crash (segmentation fault).


In SWFTools 0.9.2 an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS.


Processing a maliciously crafted font may result in the disclosure of process memory. This issue is fixed in macOS Big Sur 11.4 tvOS 14.6 watchOS 7.5 iOS 14.6 and iPadOS 14.6. An out-of-bounds read was addressed with improved input validation.


Processing a maliciously crafted image may lead to arbitrary code execution. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. An out-of-bounds read was addressed with improved input validation.


Certain

Huawei

products

Module;NGFW

Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace

have

an

out-of-bounds

read

vulnerability.

An

attacker

who

logs

in

to

the

board

may

send

crafted

messages

from

the

internal

network

port

or

tamper

with

inter-process

message

packets

to

exploit

this

vulnerability.

Due

to

insufficient

validation

of

the

message

successful

exploit

may

cause

the

affected

board

to

be

abnormal.


mgetty prior to 1.2.1 is affected by: out-of-bounds read. The impact is: DoS the program may crash if the memory is not mapped. The component is: putwhitespan() in g3/pbm2g3.c. The attack vector is: Local the victim must open a specially crafted file. The fixed version is: 1.2.1.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 13.3 watchOS 6.1.1 macOS Catalina 10.15.2 Security Update 2019-002 Mojave and Security Update 2019-007 High Sierra iOS 13.3 and iPadOS 13.3 iOS 12.4.4 watchOS 5.3.4. Processing malicious video via FaceTime may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15 iOS 13.1 and iPadOS 13.1 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6. Processing a maliciously crafted audio file may disclose restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. Processing a maliciously crafted font file may lead to arbitrary code execution.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A malicious application may be able to disclose kernel memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.


Processing a maliciously crafted audio file may disclose restricted memory. This issue is fixed in Security Update 2021-002 Catalina iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. An out-of-bounds read was addressed with improved input validation.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A local attacker may be able to elevate their privileges.


Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior MELSOFT Navigator all versions and EZSocket all versions allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.0.1 Security Update 2021-007 Catalina iOS 15.1 and iPadOS 15.1 macOS Big Sur 11.6.1. Processing a maliciously crafted USD file may disclose memory contents.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Monterey 12.1 iOS 15.2 and iPadOS 15.2 macOS Big Sur 11.6.2 Security Update 2021-008 Catalina. Processing a maliciously crafted file may disclose user information.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 tvOS 15.1 watchOS 8.1 Security Update 2021-007 Catalina. Processing a maliciously crafted file may disclose user information.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. Processing a maliciously crafted audio file may disclose restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 14.6 Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. Processing a maliciously crafted image may lead to disclosure of user information.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 tvOS 15.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. Processing a maliciously crafted file may disclose user information.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Security Update 2021-004 Catalina Security Update 2021-005 Mojave macOS Big Sur 11.4 watchOS 7.5. Processing a maliciously crafted font may result in the disclosure of process memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. Playing a malicious audio file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 iTunes 12.12.3 for Windows watchOS 8.5 macOS Monterey 12.3. Processing a maliciously crafted image may lead to arbitrary code execution.


In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4 a remote attacker can send a crafted smart-protocol \ng\ packet that lacks a '\\0' byte to trigger an out-of-bounds read that leads to DoS.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 tvOS 14.0 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave watchOS 7.0 iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted font file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8 Safari 13.1.2 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7 Security Update 2020-005 High Sierra Security Update 2020-005 Mojave iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 tvOS 14.0 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave watchOS 7.0 iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted audio file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 watchOS 7.1 tvOS 14.2. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 watchOS 7.1 tvOS 14.2. Processing a maliciously crafted audio file may lead to arbitrary code execution.


Out-of-bounds read vulnerability in GT21 model of GOT2000 series (GT2107-WTBD V01.39.000 and earlier GT2107-WTSD V01.39.000 and earlier GT2104-RTBD V01.39.000 and earlier GT2104-PMBD V01.39.000 and earlier and GT2103-PMBD V01.39.000 and earlier) GS21 model of GOT series (GS2110-WTBD V01.39.000 and earlier GS2107-WTBD V01.39.000 and earlier GS2110-WTBD-N V01.39.000 and earlier and GS2107-WTBD-N V01.39.000 and earlier) and Tension Controller LE7-40GU-L series (LE7-40GU-L Screen package data for CC-Link IEF Basic V1.00 LE7-40GU-L Screen package data for MODBUS/TCP V1.00 and LE7-40GU-L Screen package data for SLMP V1.00) allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted packet. As a result deterioration of communication performance or a denial-of-service (DoS) condition of the TCP communication functions of the products may occur.


Lack of validation on data read from guest memory in IntPeGetDirectory IntPeParseUnwindData IntLogExceptionRecord IntKsymExpandSymbol and IntLixTaskDumpTree may lead to out-of-bounds read or it could cause DoS due to integer-overflor (IntPeGetDirectory) TOCTOU (IntPeParseUnwindData) or insufficient validations.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.3 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 iCloud for Windows 12.0 watchOS 7.2. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 7.2 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 tvOS 14.3. Processing a maliciously crafted audio file may disclose restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave tvOS 14.3 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 watchOS 7.2. A remote attacker may be able to leak memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.3 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 iCloud for Windows 12.0 watchOS 7.2. Processing a maliciously crafted image may lead to heap corruption.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 14.2 and iPadOS 14.2 macOS Catalina 10.15.7 Security Update 2020-005 High Sierra Security Update 2020-005 Mojave. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 6.1.2 iOS 13.3.1 and iPadOS 13.3.1 tvOS 13.3.1 macOS Catalina 10.15.3 Security Update 2020-001 Mojave Security Update 2020-001 High Sierra. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2 iTunes for Windows 12.10.4 iCloud for Windows 11.0 iCloud for Windows 7.17. Processing a maliciously crafted image may lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2018.011.20063 and earlier 2017.011.30102 and earlier and 2015.006.30452 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2018.011.20058 and earlier 2017.011.30099 and earlier and 2015.006.30448 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2018.011.20055 and earlier 2017.011.30096 and earlier and 2015.006.30434 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2020.009.20074 and earlier 2020.001.30002 2017.011.30171 and earlier and 2015.006.30523 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Ming (aka libming) 0.4.8 has an out of bounds write vulnerability in the function strcpyext() in the decompile.c file in libutil.a.


In all Qualcomm products with Android releases from CAF using the Linux kernel in an ISP Camera kernel driver function an incorrect bounds check may potentially lead to an out-of-bounds write.


Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via crafted WebRTC packets.


Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.


Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in Tab Groups in Google Chrome on Linux and ChromeOS prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.


Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.


Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page and a crafted Chrome extension.


Out of bounds write in Tab Groups in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page.


Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.


Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in MSM8909W MSM8996AU QCS605 Qualcomm 215 SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 439 / SD 429 SD 450 SD 625 SD 632 SD 636 SD 665 SD 675 SD 712 / SD 710 / SD 670 SD 730 SD 820 SD 820A SD 835 SD 845 / SD 850 SD 855 SD 8CX SDA660 SDM439 SDM630 SDM660 Snapdragon_High_Med_2016 SXR1130


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-113164693


An

out-of-bound

write

can

be

triggered

by

a

specially-crafted

command

supplied

by

a

userspace

application.

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-123583388.


Out

of

bound

write

in

TZ

while

copying

the

secure

dump

structure

on

HLOS

provided

buffer

as

a

part

of

memory

dump

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in


In ACELP_4t64_fx of c4t64fx.c there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132647222.


** DISPUTED ** Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable a running Unbound installation cannot be remotely or locally exploited.


In the Linux kernel before 5.4.12 drivers/input/input.c has out-of-bounds writes via a crafted keycode table as demonstrated by input_set_keycode aka CID-cb222aed03d7.


An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used.


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. The SEC_FR trustlet has an out of bounds write. The Samsung ID is SVE-2019-15272 (October 2019).


In Cherokee through 1.2.104 remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers as demonstrated by a GET request with many \Host: 127.0.0.1\ headers.


An issue was discovered in Foxit PhantomPDF before 8.3.11. It has an out-of-bounds write when Internet Explorer is used.


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. The BIOSUB Trustlet has an out of bounds write. The Samsung ID is SVE-2019-15261 (October 2019).


An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. It has an out-of-bounds write via incorrect image data.


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos chipsets) software. There is an out-of-bounds write in the ICCC Trustlet. The Samsung ID is SVE-2019-15274 (November 2019).


Adobe Acrobat and Reader versions 2019.010.20069 and earlier 2019.010.20069 and earlier 2017.011.30113 and earlier version and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.010.20100 and earlier 2019.010.20099 and earlier 2017.011.30140 and earlier 2017.011.30138 and earlier 2015.006.30495 and earlier and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2019.010.20098 and earlier 2019.010.20098 and earlier 2017.011.30127 and earlier version and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.010.20100 and earlier 2019.010.20099 and earlier 2017.011.30140 and earlier version 2017.011.30138 and earlier version 2015.006.30495 and earlier and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.012.20035 and earlier 2019.012.20035 and earlier 2017.011.30142 and earlier 2017.011.30143 and earlier 2015.006.30497 and earlier and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB.


In

the

Linux

kernel

before

there

are

multiple

out-of-bounds

write

bugs

that

can

be

caused

by

a

malicious

USB

device

in

the

Linux

kernel

HID

drivers

aka

This

affects

and


cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.


in

read.c

in

Xfig

has

an

out-of-bounds

write.


In QEMU 3.1 scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations.


An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Write and crash during the handling of certain PDF files that embed specifically crafted 3D content because of the improper handling of a logic exception in the IFXASSERT function.


A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System (IGSS) Version 14 and prior which could cause a software crash when data in the mdb database is manipulated.


An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.


An exploitable heap out-of-bounds write vulnerability exists in the TIF-parsing functionality of LEADTOOLS 20. A specially crafted TIF image can cause an offset beyond the bounds of a heap allocation to be written potentially resulting in code execution. An attacker can specially craft a TIF image to trigger this vulnerability.


VMware Workstation (14.x before 14.1.6) and Fusion (10.x before 10.1.6) contain an out-of-bounds write vulnerability in the e1000 virtual network adapter. This issue may allow a guest to execute code on the host.


A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7 0 2018 1113). While parsing Document Summary Property Set stream the getSummaryInformation function is incorrectly checking the correlation between size and the number of properties in PropertySet packets causing an out-of-bounds write that leads to heap corruption and consequent code execution.


A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.


VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in the e1000e virtual network adapter. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition on their own VM.


In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1 a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.


An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to a one-byte out-of-bounds write in the gsym_addr function in x86_64-gen.c. This occurs because tccasm.c mishandles section switches.


formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping.


The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which if overridden can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type causing memory safety vulnerabilities in safe code (e.g. out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.


BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.


GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c.


webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.


musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance related to the math/i386/ directory. In some cases use of this library could introduce out-of-bounds writes that are not present in an application's source code.


An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value which leads to a malloc failure and out-of-bounds write.


The scan() function in mad.c in mpg321 0.3.2 allows remote attackers to trigger an out-of-bounds write via a zero bitrate in an MP3 file.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds write problem causing a SEGV in the function Mat_VarFree() in mat.c.


Adobe Acrobat and Reader versions 2019.021.20056 and earlier 2017.011.30152 and earlier 2017.011.30155 and earlier version 2017.011.30152 and earlier and 2015.006.30505 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled leading to an out-of-bounds write or read.


Adobe Acrobat and Reader versions 2019.012.20035 and earlier 2019.012.20035 and earlier 2017.011.30142 and earlier 2017.011.30143 and earlier 2015.006.30497 and earlier and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.012.20040 and earlier 2017.011.30148 and earlier 2017.011.30148 and earlier 2015.006.30503 and earlier and 2015.006.30503 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) \len==0 cases.\


libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length which triggers an out-of-bounds write.


The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large (1) cbp0 or (2) cbpz chunk in Westwood Studios VQA Video file which triggers an out-of-bounds write.


Photoshop Elements versions 2021 build 19.0 (20210304.m.156367) (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious TTF file.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.


Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).


Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.


CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38099.


Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file.


Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file.


CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38101.


Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.


Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.


IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file.


Adobe Framemaker version 2020.0.1 (and earlier) and 2019.0.8 (and earlier) are affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.


Adobe Illustrator version 25.2.3 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


After Effects version 18.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bounds Write vulnerability within the ImageTool component. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.


An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.


An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.


The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size allowing an attacker to perform out-of-bounds writes within the kernel and therefore arbitrary code execution. This issue was fixed via commit 4b81ccebaeee (\bpf ringbuf: Deny reserve of buffers larger than ringbuf\) (v5.13-rc4) and backported to the stable kernels in v5.12.4 v5.11.21 and v5.10.37. It was introduced via 457f44363a88 (\bpf: Implement BPF ring buffer and verifier support for it\) (v5.8-rc1).


A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata in the KVM API is mapped to an array index which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution.


Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function (verifying input data from a U3D file) leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process.


An out-of-bounds write vulnerability exists when reading a TIF file using Open Design Alliance (ODA) Drawings Explorer before 2022.11. The specific issue exists after loading TIF files. Crafted data in a TIF file can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An out-of-bounds write vulnerability exists when reading a JPG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing JPG files. Crafted data in a JPG (4 extraneous bytes before the marker 0xca) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation for the XFAT sectors count can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


MediaTek microchips as used in NETGEAR devices through 2021-11-11 and other devices mishandle the WPS (Wi-Fi Protected Setup) protocol. (Affected Chipsets MT7603E MT7610 MT7612 MT7613 MT7615 MT7620 MT7622 MT7628 MT7629 MT7915; Affected Software Versions 7.4.0.0; Out-of-bounds write).


Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe After Effects version 18.2.1 (and earlier) is affected by an out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


LibreDWG 0.12.4.4313 through 0.12.4.4367 has an out-of-bounds write in dwg_free_BLOCK_private (called from dwg_free_BLOCK and dwg_free_object).


Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG file.


Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG2000 file.


An issue was discovered in the nix crate before 0.20.2 0.21.x before 0.21.2 and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.


Qt

SVG

in

Qt

through

and

through

has

an

out-of-bounds

write

in

QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend

(called

from

QPainterPath::addPath

and

QPathClipper::intersect).


libjxl

as

used

in

libvips

through

and

other

products

has

an

out-of-bounds

write

in

jxl::ModularFrameDecoder::DecodeGroup

(called

from

jxl::FrameDecoder::ProcessACGroup

and

jxl::ThreadPool::RunCallState<jxl::FrameDecoder::ProcessSections).


A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon tool. Affected Product: Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) and prior


There is an out-of-bounds write vulnerability in some Huawei products. The code of a module have a bad judgment logic. Attackers can exploit this vulnerability by performing multiple abnormal activities to trigger the bad logic and cause out-of-bounds write. This may compromise the normal service of the module.Affected product versions include: NGFW Module versions V500R005C00SPC100 V500R005C00SPC200;Secospace USG6300 versions V500R001C30SPC200 V500R001C30SPC600 V500R001C60SPC500 V500R005C00SPC100 V500R005C00SPC200;Secospace USG6500 versions V500R001C30SPC200 V500R001C30SPC600 V500R001C60SPC500 V500R005C00SPC100 V500R005C00SPC200;Secospace USG6600 versions V500R001C30SPC200 V500R001C30SPC600 V500R001C60SPC500 V500R005C00SPC100 V500R005C00SPC200;USG9500 versions V500R001C60SPC500 V500R005C00SPC100 V500R005C00SPC200.


Multiple out-of-bounds write issues have been identified in the way the application processes project files allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).


A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or execution of arbitrary code due to lack of input validation when a malicious CGF (Configuration Group File) file is imported to IGSS Definition.


Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files allowing an attacker to craft a special project file that may permit arbitrary code execution.


MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash table. This can for example be seen with crafted \mutool draw\ input.


MediaTek

microchips

as

used

in

NETGEAR

devices

through

and

other

devices

mishandle

IEEE

protocols.

(Affected

Chipsets

Affected

Software

Versions

Out-of-bounds

write).


Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c.


Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb).


Adobe Photoshop versions 21.2.10 (and earlier) and 22.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge versions 11.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h in function read_udp_push_config_file. A specially-crafted network packet can lead to code execution.


An improper array index validation vulnerability exists in the JPEG-JFIF Scan header parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to an out-of-bounds write and potential code exectuion. An attacker can provide a malicious file to trigger this vulnerability.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Write vulnerability when parsing a crafted jpeg file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Contiki-NG is an open-source cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately the written header is not checked to be within the available space thereby making it possible to write outside the buffer. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.


Adobe Illustrator version 25.1 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Illustrator version 25.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An

out-of-bounds

write

vulnerability

exists

in

the

functionality

of

the

binary

of

Anker

Eufy

Homebase

in

function

recv_server_device_response_msg_process.

A

specially-crafted

network

packet

can

lead

to

code

execution.


A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.