Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Contiki-NG

is

an

open-source

cross-platform

operating

system

for

internet

of

things

devices.

The

RPL-Classic

and

RPL-Lite

implementations

in

the

Contiki-NG

operating

system

versions

prior

to

do

not

validate

the

address

pointer

in

the

RPL

source

routing

header

This

makes

it

possible

for

an

attacker

to

cause

out-of-bounds

writes

with

packets

injected

into

the

network

stack.

Specifically

the

problem

lies

in

the

function

in

the

two

rpl-ext-header.c

modules

for

RPL-Classic

and

RPL-Lite

respectively.

The

variable

is

calculated

using

an

unvalidated

CMPR

field

value

from

the

source

routing

header.

An

out-of-bounds

write

can

be

triggered

on

line

in

and

line

in

which

contain

the

following

memcpy

call

with

as

destination.

The

problem

has

been

patched

in

Contiki-NG

Users

can

apply

a

patch

out-of-band

as

a

workaround.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Write vulnerability when parsing a crafted jpeg file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An improper array index validation vulnerability exists in the TIF IP_planar_raster_unpack functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Animate version 21.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 21.2.5 (and earlier) and 22.2 (and earlier) are affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.


An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.


Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute code in the context of the current process.


An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.


Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.


Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious GIF file.


The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.


A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a user sent a malicious image.


A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3 WhatsApp Business for Android prior to v2.21.3 WhatsApp for iOS prior to v2.21.32 and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write.


The calling logic for WhatsApp for Android prior to v2.21.23 WhatsApp Business for Android prior to v2.21.23 WhatsApp for iOS prior to v2.21.230 WhatsApp Business for iOS prior to v2.21.230 WhatsApp for KaiOS prior to v2.2143 WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.


An Out-of-Bounds Write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


An Out-of-Bounds Write vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conversion.


Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.


Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process.


An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect memory handling while parsing crafted XML files which leads to an out-of-bounds write of a one byte constant.


The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocation structure. An attacker could leverage this vulnerability to execute code in the context of the current process.


The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.


Datakit Software libraries CatiaV5_3dRead CatiaV6_3dRead Step3dRead Ug3dReadPsr Jt3dReadPsr modules in KeyShot Versions v10.1 and prior lack proper validation of user-supplied data when parsing CATPart files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.7 macOS Big Sur 11.5 watchOS 7.6 tvOS 14.7 Security Update 2021-005 Mojave Security Update 2021-004 Catalina. A malicious application may be able to gain root privileges.


The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the remote end.


An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


Adobe Acrobat Reader DC version 21.007.20095 (and earlier) 21.007.20096 (and earlier) 20.004.30015 (and earlier) and 17.011.30202 (and earlier) is affected by an out-of-bounds write vulnerability when parsing a crafted JPEG2000 file which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0 dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg possibly 2.1 and earlier allows remote attackers to have unspecified impact and vectors which trigger an out-of-bounds write.


ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file allowing a possible out-of-bounds write condition.


Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.


Adobe Character Animator versions 4.4.2 (and earlier) and 22.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.


Adobe Framemaker versions 2029u8 (and earlier) and 2020u4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious font file.


Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious U3D file.


Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.


Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe After Effects versions 22.1.1 (and earlier) and 18.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability.


In libmediadrm there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0 8.1. Android ID: A-67962232.


In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp there is an out-of-bounds write if metadataSize is too small. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-67782345.


In DisplayFtmItem in the bootloader there is an out-of-bounds write due to reading a string without verifying that it's null-terminated. This could lead to a secure boot bypass and a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-68269077.


In Wireshark 2.4.0 and 2.2.0 to 2.2.8 the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation.


In ashmem_ioctl of ashmem.c there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-66954097.


An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle to trigger this vulnerability.


An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle attack to trigger this vulnerability.


In msm_ispif_config_stereo() in Android for MSM Firefox OS for MSM and QRD Android before 2017-06-21 the parameter params->entriesi.vfe_intf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write.


FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.


Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.


LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.


VMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG) Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of-bounds write vulnerability in SVGA device. This issue may allow a guest to execute code on the host.


Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an out-of-bounds write vulnerability. An unauthenticated remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets successful exploitation may impact availability of product service.


Huawei AR120-S V200R005C32; AR1200 V200R005C32; AR1200-S V200R005C32; AR150 V200R005C32; AR150-S V200R005C32; AR160 V200R005C32; AR200 V200R005C32; AR200-S V200R005C32; AR2200-S V200R005C32; AR3200 V200R005C32; V200R007C00; AR510 V200R005C32; NetEngine16EX V200R005C32; SRG1300 V200R005C32; SRG2300 V200R005C32; SRG3300 V200R005C32 have an out-of-bounds write vulnerability. When a user executes a query command after the device received an abnormal OSPF message the software writes data past the end of the intended buffer due to the insufficient verification of the input data. An unauthenticated remote attacker could exploit this vulnerability by sending abnormal OSPF messages to the device. A successful exploit could cause the system to crash.


An Out-of-bounds Write issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor Version 2.00.23.00 or prior. Specially crafted .dpb files may cause the system to write outside the intended buffer area.


An out-of-bounds write in \ClearKeyDecryptor\ while decrypting some Clearkey-encrypted media content. The \ClearKeyDecryptor\ code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox this vulnerability allows for the writing of arbitrary data within memory resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


Palo Alto Networks Terminal Services Agent before 7.0.7 allows local users to gain privileges via vectors that trigger an out-of-bounds write operation.


Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check and the fact that parport_ptr integer is static a 'secure boot' kernel command line adversary (can happen due to bootloader vulns e.g. Google Nexus 6's CVE-2016-10277 where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code by appending many (>LP_NO) 'lp=none' arguments to the command line.


Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c.


UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.


Adobe Acrobat and Reader versions 2019.008.20081 and earlier 2019.008.20080 and earlier 2019.008.20081 and earlier 2017.011.30106 and earlier version 2017.011.30105 and earlier version 2015.006.30457 and earlier and 2015.006.30456 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.


LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.


LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.


In WinRAR versions prior to and including 5.60 There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.


In WinRAR versions prior to and including 5.60 there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.


In GPAC 0.7.1 and earlier gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.


LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.


In GPAC 0.7.1 and earlier gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.


In CopyToOMX of OMXNodeInstance.cpp there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android ID: A-77486542.


Stegdetect through 2018-05-26 has an out-of-bounds write in f5_compress in the f5.c file.


In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8 the CAB block input buffer is one byte too small for the maximal Quantum block leading to an out-of-bounds write.


The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.


makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write leading to an assertion failure or possibly unspecified other impact.


An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.


LibTIFF

and

(with

JBIG

enabled)

decodes

arbitrarily-sized

JBIG

into

a

buffer

ignoring

the

buffer

size

which

leads

to

a

JBIGDecode

out-of-bounds

write.


An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution.


An exploitable uninitialized variable vulnerability exists in the RTF-parsing functionality of Atlantis Word Processor 3.2.6 version. A specially crafted RTF file can leverage an uninitialized stack address resulting in an out-of-bounds write which in turn could lead to code execution.


An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution.


An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


An exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution. A different vulnerability than CVE-2018-3858.


A specially crafted TIFF image processed via the application can lead to an out-of-bounds write overwriting


An exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0. A specially crafted PCX image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution. A different vulnerability than CVE-2018-3871.


An exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution. A different vulnerability than CVE-2018-3860.


An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5.0.0.28. A specially crafted CAL image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a CAL image to trigger this vulnerability and gain code execution.


A specially crafted TIFF image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution.


An exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain the ability to execute code. A different vulnerability than CVE-2018-3859.


A specially crafted PCX image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution.


An exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0. A specially crafted PCX image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution. A different vulnerability than CVE-2018-3870.


An exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain the ability to execute code. A different vulnerability than CVE-2018-3857.


WebKitGTK+ 2.20.3 has an off-by-one error with a resultant out-of-bounds write in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.


Adobe Acrobat and Reader 2018.011.20040 and earlier 2017.011.30080 and earlier and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


When the Mozilla Updater opens a MAR format file which contains a very long item filename an out-of-bounds write can be triggered leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. This vulnerability affects Firefox < 62 Firefox ESR < 60.2 and Thunderbird < 60.2.1.


An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call leading to insufficient memory allocation.


An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call leading to insufficient memory allocation.


An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call leading to insufficient memory allocation.


An issue was discovered in libgig 4.1.0. There is an out-of-bounds write in the function DLS::Info::SaveString in DLS.cpp.


An issue was discovered in libgig 4.1.0. There is an out-of-bounds write in the function DLS::Info::UpdateChunks in DLS.cpp.


An issue was discovered in libgig 4.1.0. There is an out-of-bounds write in pData0 access in the function store32 in helper.h.


An issue was discovered in libgig 4.1.0. There is an out-of-bounds write in pData0 access in the function store16 in helper.h.


Adobe Acrobat and Reader versions 2018.009.20050 and earlier 2017.011.30070 and earlier and 2015.006.30394 and earlier have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


Adobe Acrobat and Reader versions 2018.009.20050 and earlier 2017.011.30070 and earlier 2015.006.30394 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


An exploitable out-of-bounds write vulnerability exists in the PNG implementation of Atlantis Word Processor version 3.2.7.2. This can allow an attacker to corrupt memory which can result in code execution under the context of the application. An attacker must convince a victim to open a specially crafted document in order to trigger this vulnerability.


Adobe Acrobat and Reader versions 2018.011.20038 and earlier 2017.011.30079 and earlier and 2015.006.30417 and earlier have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


Adobe Acrobat and Reader versions 2019.008.20081 and earlier 2019.008.20080 and earlier 2019.008.20081 and earlier 2017.011.30106 and earlier version 2017.011.30105 and earlier version 2015.006.30457 and earlier and 2015.006.30456 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


An Out-of-Bounds write privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within processing of IOCTL 0x222814 by the tmnciesc.sys driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


VMware Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds write vulnerability in the e1000 device. This issue may allow a guest to execute code on the host.


track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.


FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x956e.


decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.


FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0xbe9c4.


flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.


An issue was discovered in the stack crate before 0.3.1 for Rust. ArrayVec has an out-of-bounds write via element insertion.


FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x96cf.


RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.


HTSlib 1.10 through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).


libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.


Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.


Unicorn Engine 1.0.2 has an out-of-bounds write in helper_wfe_arm.


Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Premiere Rush versions 1.5.12 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Premiere Pro versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Bridge versions 10.0 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.


In PDFResurrect 0.12 through 0.19 get_type in pdf.c has an out-of-bounds write via a crafted PDF document.


Adobe Acrobat and Reader versions 2020.006.20042 and earlier 2017.011.30166 and earlier 2017.011.30166 and earlier and 2015.006.30518 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Audition versions 13.0.6 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets which may be exploited to cause the process reboot. Affected product versions include: IPS Module versions V500R005C00 V500R005C10; NGFW Module versions V500R005C00 V500R005C10; Secospace USG6300 versions V500R001C30 V500R001C60 V500R005C00 V500R005C10; Secospace USG6500 versions V500R001C30 V500R001C60 V500R005C00 V500R005C10; Secospace USG6600 versions V500R001C30 V500R001C60 V500R005C00 V500R005C10; USG9500 versions V500R001C30 V500R001C60 V500R005C00 V500R005C10


Acrobat Pro DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit in that the victim must open a malicious document.


Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds write vulnerability when handling crafted PDF files. This could result in a write past the end of an allocated memory structure potentially resulting in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.


In WriteOnePNGImage() of the PNG coder at coders/png.c an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.


A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1. Processing a maliciously crafted font file may lead to arbitrary code execution.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1. Processing a maliciously crafted image may lead to arbitrary code execution.


TPEditor (v1.98 and prior) is vulnerable to two out-of-bounds write instances in the way it processes project files allowing an attacker to craft a special project file that may permit arbitrary code execution.


There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality integrity or application availability.


An issue was discovered in Foxit Reader and PhantomPDF before 10.1. In a certain Shading calculation the number of outputs is unequal to the number of color components in a color space. This causes an out-of-bounds write.


A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause an out-of-bounds write. An attacker can trigger this vulnerability by providing a victim with a malicious DICOM file.


GoPro gpmf-parser through 1.5 has a stack out-of-bounds write vulnerability in GPMF_ExpandComplexTYPE(). Parsing malicious input can result in a crash or potentially arbitrary code execution.


A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340 Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data a crash or code execution when uploading a specially crafted file on the controller over FTP.


LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.


libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.


libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.


Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.


Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function while setuid root copies the current working directory pathname into a buffer that is too small (on some common platforms).


An out-of-bounds write vulnerability exists in the Admesh stl_fix_normal_directions() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted AMF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted obj file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because \-F ''\ is mishandled by parse_fix_phrase.


A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17 WhatsApp Business for Android prior to v2.20.7 WhatsApp for iPhone prior to v2.20.20 and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices.


xbuf_format_converter used as part of exif_read_data was appending a terminating null character to the generated string but was not using its standard append char function. As a result if the buffer was full it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3 all versions between 4.57.0 and 4.80.1 all versions between 4.81.0 and 4.93.1 and versions 4.94.0 4.95.0 4.96.0 4.97.0 4.98.0.


NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds write vulnerability. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets which may be exploited to cause the process reboot.


An issue was discovered on Samsung mobile devices with O(8.x) P(9.0) and Q(10.0) (S.LSI chipsets) software. There is a heap out-of-bounds write in the tsmux driver. The Samsung ID is SVE-2019-16295 (February 2020).


Adobe Acrobat and Reader versions 2020.006.20034 and earlier 2017.011.30158 and earlier 2017.011.30158 and earlier 2015.006.30510 and earlier and 2015.006.30510 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .


VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804 6.7 before ESXi670-202008101-SG 6.5 before ESXi650-202007101-SG) Workstation (15.x) Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap.


An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.


An issue was discovered in Foxit Studio Photo before 3.6.6.922. It has an out-of-bounds write via a crafted TIFF file.


tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103 aka \cpStripToTile heap-buffer-overflow.\


tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098 aka \t2p_process_jpeg_strip heap-buffer-overflow.\


tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093 MSVR 35096 and MSVR 35097.


tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094 aka \PixarLog horizontalDifference heap-buffer-overflow.\


X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data.


The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.


The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields which trigger out-of-bounds write operations.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9607 MDM9615 MDM9635M MDM9640 SD 210/SD 212/SD 205 SD 400 SD 600 SD 615/16/SD 415 SD 617 SD 650/52 SD 800 SD 810 and SD 820 an arbitrary length value from an incoming message to QMI Proxy can lead to an out-of-bounds write in the stack variable message.


An issue was discovered in Delta Electronics WPLSoft Versions prior to V2.42.11 ISPSoft Versions prior to 3.02.11 and PMSoft Versions prior to 2.10.10. Multiple instances of out-of-bounds write conditions may allow malicious files to be read and executed by the affected software.


An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution. An attacker can provide a malicious image to trigger this vulnerability.


The decode_mb function in libavcodec/error_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block index which triggers an out-of-bounds write.


In nfa_hci_handle_admin_gate_rsp of nfa_hci_act.cc there is a possible out of bound write due to missing bounds checks. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-124524315


In rw_t3t_act_handle_sro_rsp of rw_t3t.cc there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-120497583


In SetScanResponseData of ble_advertiser_hci_interface.cc there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-121145627.


In rw_t3t_act_handle_check_rsp of rw_t3t.cc there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-120503926


In CryptoPlugin::decrypt of CryptoPlugin.cpp there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-137370777

out of bound write
escalated privilege
buffer overflow


make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type.


An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow a privileged user to potentially enable denial of service via local access.


Possible out of bounds read due to incorrect validation of incoming buffer length in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c tainted variable cnt is too large that makes pointer sptr read beyond heap bound.


An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code.


Possible out of bounds write due to improper validation of number of GPIOs configured in an internal parameters array in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1 Firefox ESR < 52.7.2 and Thunderbird < 52.7.


An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.


An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.


An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.


An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.


An

out

of

bounds

read

on

the

function

allows

an

attack

to

extend

the

result

size

that

is

used

by

memcpy()

to

read

memory

from

within

the

enclave

heap.

We

recommend

upgrading

past

commit


An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.


An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.


An out of bounds write vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privileges or denial of service.

out of bound write
denial of service
escalated privilege


An out of bounds write and read vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.


An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.

out of bound read
information disclosure
denial of service


A out of bounds read was discovered in H5VM_memcpyvv in H5VM.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.


An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure related to mishandling of the NAN and INFINITY floating-point values.

out of bound read
information disclosure
dos


An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure related to mishandling of the NAN and INFINITY floating-point values.


In Apache PDFBox a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.


In all Qualcomm products with Android releases from CAF using the Linux kernel the use of an out-of-range pointer offset is potentially possible in rollback protection.


Slab-out-of-bounds access can occur if the context pointer is invalid due to lack of null check on pointer before accessing it in Snapdragon Compute Snapdragon Consumer IOT Snapdragon Mobile in APQ8053 SC8180X SDX55 SM8150


An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted djvu file which may lead to crash and segmentation fault. This flaw affects DjVuLibre versions prior to 3.5.28.


An out-of-bounds access in GffLine::GffLine in gff.cpp in GCLib 0.12.7 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted GFF file.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.7 macOS Big Sur 11.5. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.3. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.5 macOS Monterey 12.3 Security Update 2022-003 Catalina. An application may be able to gain elevated privileges.


An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.


An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


An out-of-bounds vulnerability in LeviStudioU Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project files.


An out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files. An attacker could potentially use this flaw to crash the advzip utility by tricking it into processing crafted ZIP files.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to code execution.


An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the SGI RLE decompression functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.


Multiple out-of-bounds write issues were addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.

out of bound write
arbitrary code execution


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1 iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.2 and iPadOS 15.2. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4. An application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3. An attacker in a privileged network position may be able to execute arbitrary code.

arbitrary code execution
out of bound read


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6 Security Update 2021-005 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.5 and iPadOS 14.5 macOS Big Sur 11.3. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.2 and iPadOS 15.2. A malicious application may be able to execute arbitrary code with kernel privileges.

arbitrary code execution
out of bound read
dos


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.0 tvOS 14.0 iOS 14.0 and iPadOS 14.0. An application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that


An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.


An out-of-bounds read of a global buffer in the draw_line function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.


An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory.


An out-of-bounds read in JPXStream::readTilePart in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file as demonstrated by pdftohtml.


An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via crafted SNMP packets to snmp_ber_decode_string_len_buffer in os/net/app-layer/snmp/snmp-ber.c.


An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4 iOS 14.6 and iPadOS 14.6 watchOS 7.5 tvOS 14.6. Processing a maliciously crafted font file may lead to arbitrary code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. Processing a maliciously crafted file may lead to arbitrary code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4. An application may be able to gain elevated privileges.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. Processing a maliciously crafted font file may lead to arbitrary code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.0 and iPadOS 14.0. An application may be able to cause unexpected system termination or write kernel memory.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in watchOS 7.0 tvOS 14.0 iOS 14.0 and iPadOS 14.0 macOS Big Sur 11.0.1. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.2 and iPadOS 14.2 macOS Big Sur 11.0.1. Processing a maliciously crafted PDF may lead to arbitrary code execution.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. Processing a maliciously crafted font file may lead to arbitrary code execution.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. Processing a maliciously crafted audio file may lead to arbitrary code execution.


An out-of-bounds write vulnerability exists in the JPG Handle_JPEG420 functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the JPG format SOF marker processing of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the parse_raster_data functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 watchOS 5.1.3. A malicious application may be able to elevate privileges.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2 watchOS 5.1.3. A malicious application may be able to read restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 iTunes 12.9.3 for Windows. A malicious application may be able to elevate privileges.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.3. An application may be able to read restricted memory.


An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior which may crash the system.


An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.


An

out-of-bounds

read

in

MediaInfoLib::File__Tags_Helper::Synched_Test

in

in

MediaInfoLib

in

MediaArea

MediaInfo

leads

to

a

crash.


An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0 4.9.5 and 4.4.9. Sensitive information may be disclosed via the ACEviewservice accessible by default on the LAN.


An out-of-bounds read was addressed with improved input validation.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1. A local user may be able to cause unexpected system termination or read kernel memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to read restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. An application may be able to read restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may lead to arbitrary code execution with user privileges.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. Processing a maliciously crafted font may result in the disclosure of process memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4 macOS Mojave 10.14.6 tvOS 12.4 watchOS 5.3. A remote attacker may be able to leak memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 5.3. A remote attacker may be able to leak memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1. A malicious application may be able to read restricted memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1 AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to leak memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1. Processing a maliciously crafted movie file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave. Processing a maliciously crafted font may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution.


Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6. A local user may be able to read kernel memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 14.7 macOS Big Sur 11.5. Processing a maliciously crafted file may disclose user information.


An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.


An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.


An out-of-bounds read issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \Kernel\ component. It allows local users to bypass intended memory-read restrictions.


An out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insufficient code value check so that a maliciously crafted file could cause the application to crash or possibly allows code execution.


An

out-of-bounds

read

flaw

exists

in

in

in

libarchive

when

extracting

a

specially

crafted

iso

file

related

to

archive_read_format_iso9660_read_header.


An out-of-bounds read in WebGL with a maliciously crafted \ImageInfo\ object during WebGL operations. This vulnerability affects Firefox < 54 Firefox ESR < 52.2 and Thunderbird < 52.2.


An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54 Firefox ESR < 52.2 and Thunderbird < 52.2.


An out-of-bounds read occurs when applying style rules to pseudo-elements such as ::first-line using cached style data. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux Windows and Mac and 57.0.2987.132 for Android allowed a remote attacker to obtain heap memory contents via a crafted HTML page.


An out-of-bounds read (CWE-125) vulnerability exists in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed.


An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to iOS 12.1 macOS Mojave 10.14.1 tvOS 12.1 watchOS 5.1.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1 tvOS 11.4.1 watchOS 4.3.2.


An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12.1.


An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.2.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue affected versions prior to macOS High Sierra 10.13.6.


An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to macOS Mojave 10.14.


An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1 macOS High Sierra 10.13.6 tvOS 11.4.1 watchOS 4.3.2.


An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to cause unexpected system termination or read kernel memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to determine kernel memory layout.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system termination or read kernel memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A remote attacker may be able to leak sensitive user information.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to break out of its sandbox.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to determine kernel memory layout.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to read restricted memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3 watchOS 6.1.2. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to leak memory.


An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information such as the ASLR offsets of the program aka GHSL-2020-081.


An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information such as the ASLR offsets of the program aka GHSL-2020-082.


An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information such as the ASLR offsets of the program aka GHSL-2020-083.


An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2 in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or potentially disclose some data from the heap.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2 macOS Catalina 10.15.1 tvOS 13.2 watchOS 6.1. A remote attacker may be able to leak memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.5 and iPadOS 14.5. A local user may be able to read kernel memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8 tvOS 15 watchOS 8 iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2 macOS Monterey 12.1 Safari 15.2 iOS 15.2 and iPadOS 15.2 watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 15 watchOS 8 iOS 15 and iPadOS 15. Processing a maliciously crafted font may result in the disclosure of process memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. A malicious application may be able to disclose kernel memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 15 and iPadOS 15. Processing a maliciously crafted USD file may disclose memory contents.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. Processing a maliciously crafted audio file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.0 tvOS 14.0 iOS 14.0 and iPadOS 14.0. A malicious application may be able to read restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5. A remote attacker may be able to leak memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.0 tvOS 14.0 iOS 14.0 and iPadOS 14.0. An application may be able to read restricted memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5. A remote attacker may be able to cause arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. Processing a maliciously crafted audio file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. A malicious application may be able to determine kernel memory layout.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. Processing a maliciously crafted audio file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. Processing a maliciously crafted audio file may lead to arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted font may result in the disclosure of process memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. An application may be able to gain elevated privileges.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. Processing a maliciously crafted image may lead to arbitrary code execution.


An out-of-bounds write vulnerability exists in the TIFF YCbCr image parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.

out of bound write
remote code execution


An out-of-bounds write (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. A size used by memmove is read from the input file. This is fixed in 6.9d.


There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024 3-prime RSA1536 and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However for an attack the target would have to re-use the DH512 private key which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).


Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.

denial of service
integer overflow
buffer overread


Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.

denial of service
integer overflow
buffer overflow
arbitrary code execution


Integer

overflow

vulnerability

in

payable

function

of

a

smart

contract

implementation

for

an

Ethereum

token

as

demonstrated

by

the

smart

contract

implemented

at

address

an

implementation

for

MillionCoin

(MON).


Integer overflow vulnerability in function Jsi_ObjSetLength in jsish before 3.0.6 allows remote attackers to execute arbitrary code.

integer overflow
arbitrary code execution


Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8 allows remote attackers to execute arbitrary code.


Buffer overflows in the (1) outpack or (2) buf variables of ping in iputils before 20001010 as distributed on Red Hat Linux 6.2 through 7J and other operating systems may allow local users to gain privileges.


Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier based on the Sharity package allows local users to gain root privileges via long (1) -U (2) -D (3) -P (4) -S (5) -N or (6) -u parameters.


Buffer overflows in the Cisco VPN 5000 Client before 5.2.7 for Linux and VPN 5000 Client before 5.2.8 for Solaris allow local users to gain root privileges via (1) close_tunnel and (2) open_tunnel.


Buffer overflows in the finger and whois demonstration scripts in Sambar Server 4.3 allow remote attackers to execute arbitrary commands via a long hostname.

buffer overflow
arbitrary command execution


Buffer overflows in the DHCP server for NetWare 6.0 SP1 allow remote attackers to cause a denial of service (reboot) via long DHCP requests.


Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27 and Apache 2.x before 2.0.43 allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.

denial of service
buffer overflow
arbitrary code execution


Buffer overflows in the (1) TZ and (2) SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code.


unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with \..\ (dot dot) sequences in a filename.


MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to \style import.\


An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.3 Security Update 2020-001 Mojave Security Update 2020-001 High Sierra. A malicious application may be able to overwrite arbitrary files.


The affected product is vulnerable to misconfigured binaries allowing users on the target PC with SYSTEM level privileges access to overwrite the binary and modify files to gain privilege escalation.

overwrite binary file
privilege escalation


In all Qualcomm products with Android releases from CAF using the Linux kernel kernel memory can potentially be overwritten if an invalid master is sent from userspace.


Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.


An issue was found in Git before v2.24.1 v2.23.1 v2.22.2 v2.21.1 v2.20.2 v2.19.3 v2.18.2 v2.17.3 v2.16.6 v2.15.4 and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.


The affected product is vulnerable to a parameter injection via passphrase which enables the attacker to supply uncontrolled input.


In all Android releases from CAF using the Linux kernel a vulnerability exists in the parsing of an SCM call.


In all Android releases from CAF using the Linux kernel a vulnerability exists in the parsing of a DRM provisioning command.

parsing provisioning command vulnerability


Detcon Sitewatch Gateway all versions without cellular Passwords are presented in plaintext in a file that is accessible without authentication.


In Joomla! before 3.9.14 a missing access check in framework files could lead to a path disclosure.


A path handling issue was addressed with improved validation. This issue is fixed in Xcode 12.4. A malicious application may be able to access arbitrary files on the host device while running an app that uses on-demand resources with Xcode.


A path handling issue was addressed with improved validation. This issue is fixed in Security Update 2021-008 Catalina macOS Big Sur 11.6.2. Processing a maliciously crafted URL may cause unexpected JavaScript execution from a file on disk.


A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.0.1. A remote attacker may be able to modify the file system.


A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files.


A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 watchOS 6.2.8. A malicious mail server may overwrite arbitrary mail files.


A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. A malicious application may be able to overwrite arbitrary files.


A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. A local attacker may be able to elevate their privileges.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletevideofile function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletesolvideofile function.


A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.


A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remote server.


A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders.


A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server.


A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.


Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.


Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter.


A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.


Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter.


Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301.


Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full pathname in the msg parameter.


Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx.


Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub_401A90 CreateFileW function.


Absolute path traversal vulnerability in the web interface in Cisco Finesse allows remote attackers to read directory contents via a direct request to a directory URL aka Bug ID CSCug16772.


A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code such as programs or libraries.


A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows version 19.5 through 20.x before 20.0.219.0 allows an attacker to read any file on the host file system via an HTTP request.


A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot leading to code execution.


A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token


A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.


An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitrary files of unspecified number of users.


Absolute path traversal vulnerability in index.php in Webspell 4.01.02 allows remote attackers to include and execute arbitrary local files via a full pathname in the site parameter. NOTE: some of these details are obtained from third party information.


Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files and possibly execute local PHP scripts via the nmf parameter.


Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method.


Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first argument to the StartProcess method.


Absolute path traversal vulnerability in a certain ActiveX control in CryptoX.dll 2.0 and earlier in the Ultra Crypto Component allows remote attackers to write to arbitrary files via a full pathname in the argument to the SaveToFile method.


Absolute path traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to read arbitrary files via an absolute path in the dir parameter a different vulnerability than CVE-2007-5491.


Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag a related issue to CVE-2007-5461.


Absolute path traversal vulnerability in download.php in Jeebles Directory 2.9.60 allows remote attackers to read arbitrary files via a full pathname in the query string. NOTE: some of these details are obtained from third party information.


Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows remote attackers to create or overwrite arbitrary files via a full pathname in the XmlFilePath argument to the SaveSenderToXml method.


Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter.


Absolute path traversal vulnerability in a certain ActiveX control in hpqvwocx.dll 2.1.0.556 in Hewlett-Packard (HP) Digital Imaging allows remote attackers to create or overwrite arbitrary files via the second argument to the SaveToFile method.


Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directories and read arbitrary files via an absolute pathname in the nfolder parameter.


Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files via a \\\\\\\\ (four backslashes) in the fileName parameter to getRdsLogFile.


Absolute path traversal vulnerability in the Real-Time Monitoring Tool (RTMT) API in Cisco Unified Communications Manager (CUCM) allows remote authenticated users to read arbitrary files via a full pathname in an API command aka Bug ID CSCur49414.


Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.


Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file parameter to FileManager.aspx.


Absolute path traversal vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to read arbitrary files via unspecified vectors.


Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.


Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme.


Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in the viewdir parameter.


Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23 3.10.x before 3.10.13 3.12.x before 3.12.10 and 3.14.x before 3.14.3 allows remote attackers to read arbitrary files via unspecified vectors.


Absolute

path

traversal

vulnerability

in

in

ImpressCMS

before

allows

remote

attackers

to

delete

arbitrary

files

via

a

full

pathname

in

the

parameter

in

a

cancel

action.


Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.


Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.


Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter.


Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php.


Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to read arbitrary files via an encoded \/\ (slash) in the file parameter.


Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.


Absolute path traversal vulnerability in pixaria.image.php in Pixaria Gallery 2.0.0 through 2.3.5 allows remote attackers to read arbitrary files via a base64-encoded file parameter.


Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to read arbitrary files via a base64-encoded absolute path in the filename parameter.


Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading \//\ (double slash) in the filename.


Absolute path traversal vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to read arbitrary files via an absolute pathname in the next_file parameter.


Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows as used in multiple products allows remote attackers to read arbitrary files via a \\\/\ in a pathname argument as demonstrated by \download \\/server.cfg\.


A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform (administrator) credentials.


A path traversal vulnerability exists in simple-file-manager before 2017-04-26 affecting index.php (the sole \Simple PHP File Manager\ component).