Mozilla Firefox before 49.0 Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.


The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality obtain sensitive information from system logs and have unspecified other impact by leveraging failure to use an HTTPS session for downloading configuration files from http://fm.grandstream.com/gs/.


Adobe ColdFusion 10 before Update 19 11 before Update 8 and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.


Lenovo SHAREit before 3.2.0 for Windows and SHAREit before 3.5.48_ww for Android transfer files in cleartext which allows remote attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors.


Apple Software Update before 2.2 on Windows does not use HTTPS which makes it easier for man-in-the-middle attackers to spoof updates by modifying the client-server data stream.


The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.


Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation which allows man-in-the-middle attackers to replace a theme's images and colors by modifying the client-server data stream.


The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Samsung KNOX 1.0.0 uses the shared certificate on Android which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service.


The apt package in Debian jessie before 1.0.9.8.4 in Debian unstable before 1.4~beta2 in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17 in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2 and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.


in

Google

Chrome

before

does

not

use

the

HTTPS

service

on

dl.google.com

to

obtain

the

Software

Removal

Tool

which

allows

remote

attackers

to

spoof

the

(aka

CCT)

file

via

a

man-in-the-middle

attack

on

an

HTTP

session.


The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf 1.0.0 before 1.0.0r 1.0.1 before 1.0.1m and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle a related issue to CVE-2016-0800.


EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1 and IsilonSD Edge OneFS 8.0.x before 8.0.0.1 does not require SMB signing within a DCERPC session over ncacn_np which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream a similar issue to CVE-2016-2115.


The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 do not properly establish an RPC channel which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream aka \Windows SAM and LSAD Downgrade Vulnerability\ or \BADLOCK.\


The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate aka internal bug 26232830.


libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors aka a \bits/bytes confusion bug.\


The smtplib library in CPython (aka Python) before 2.7.12 3.x before 3.4.5 and 3.5.x before 3.5.2 does not return an error when StartTLS fails which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command aka a \StartTLS stripping attack.\


The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors aka a \bits/bytes confusion bug.\


IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors.


in

Samba

before

before

and

before

allows

man-in-the-middle

attackers

to

bypass

a

client-signing

protection

mechanism

and

consequently

spoof

and

servers

via

the

or

flag.


The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.


Samba 3.x and 4.x before 4.2.11 4.3.x before 4.3.8 and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.


OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.


The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11 4.3.x before 4.3.8 and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.


The SMB1 protocol implementation in Samba 4.x before 4.2.11 4.3.x before 4.3.8 and 4.4.x before 4.4.2 does not recognize the \server signing = mandatory\ setting which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.


The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11 4.3.x before 4.3.8 and 4.4.x before 4.4.2 mishandle DCERPC connections which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream aka \BADLOCK.\


Dell SecureWorks app before 2.1 for iOS does not validate SSL certificates which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The (1) proton.reactor.Connector (2) proton.reactor.Container and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.


IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages EmailRelay) fails to check the SSL certificate against the requested hostname. It is subject to a man-in-the-middle attack with an impersonating server observing all the data transmitted to the real server. IBM X-Force ID: 113353.


The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11 4.3.x before 4.3.8 and 4.4.x before 4.4.2 does not recognize the \client ldap sasl wrapping\ setting which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.


The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47 10.0.x before 10.0.23 and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier 5.6.29 and earlier and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via a \/CN=\ string in a field in a certificate as demonstrated by \/OU=/CN=bar.com/CN=foo.com.\


Samba 4.x before 4.2.11 4.3.x before 4.3.8 and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.


Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server which allows man-in-the-middle attackers to spoof this server and obtain sensitive information via a crafted certificate.


Huawei E3276s USB modems with software before E3276s-150TCPU-V200R002B436D09SP00C00 allow man-in-the-middle attackers to intercept spoof or modify network traffic via unspecified vectors related to a fake network.


Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000 Windows XP and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.


Microsoft Terminal Server using Remote Desktop Protocol (RDP) 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate which allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks.


The SMTP client in Mozilla Thunderbird 1.0.5 BETA 1.0.7 and possibly other versions does not notify users when it cannot establish a secure channel with the server which allows remote attackers to obtain authentication information without detection via a man-in-the-middle (MITM) attack that bypasses TLS authentication or downgrades CRAM-MD5 authentication to plain authentication.


The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step that is required for preventing protocol version rollback attacks which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.


The iTAN Online-Banking Security System allows remote attackers to obtain TAN numbers via a man-in-the-middle (MITM) attack while the transaction is taking place which facilitates a \phishing\ attack.


Unspecified vulnerability in Reverse SSL Proxy Plug-in for Sun Java System Application Server Standard Edition 7 2004Q2 Application Server Enterprise Edition 8.1 2005Q1 and Sun ONE Application Server 7 Standard Edition as used in multiple web servers allows remote attackers to conduct man-in-the-middle (MITM) attacks and \compromise data privacy.\


Cisco PIX Firewall 6.0.3 and earlier and 6.1.x to 6.1.3 do not delete the duplicate ISAKMP SAs for a user's VPN session which allows local users to hijack a session via a man-in-the-middle attack.


Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA certificate is in the user's local repository which could allow remote attackers to decrypt web sessions via a man-in-the-middle (MITM) attack.


The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.


The (1) CertGetCertificateChain (2) CertVerifyCertificateChainPolicy and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP Office for Mac Internet Explorer for Mac and Outlook Express for Mac do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions as originally reported for Internet Explorer and IIS.


Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to upload or download arbitrary files to arbitrary locations via a man-in-the-middle attack with modified TGT and TGN parameters in a call to the \Persist\ function.


The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack.


Microsoft Internet Explorer 6.0 when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake does not prompt the user before searching for and finding a newer certificate which may allow attackers to perform a man-in-the-middle attack. NOTE: it is not clear whether this poses a vulnerability.


Symantec Firewall/VPN Appliance 100 through 200R hardcodes the administrator's MAC address inside the firewall's configuration which allows remote attackers to spoof the administrator's MAC address and perform an ARP poisoning man-in-the-middle attack to obtain the administrator's password.


Iomega NAS A300U uses cleartext LANMAN authentication when mounting CIFS/SMB drives which allows remote attackers to perform a man-in-the-middle attack.


Cisco Virtual Private Network (VPN) Client software 2.x.x and 3.x before 3.5.1C does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator which allows remote attackers to conduct man-in-the-middle attacks.


JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key which makes it easier for remote attackers to perform man-in-the-middle attacks.


Apple Mail.app 3.5 on Mac OS X when \Store draft messages on the server\ is enabled stores draft copies of S/MIME email in plaintext on the email server which allows server owners and remote man-in-the-middle attackers to read sensitive mail.


The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted self-signed certificate which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).


Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system and execute these files via unspecified vectors.


Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13 a module for Drupal does not sign all required data in requests which has unspecified impact probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges.


Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature aka a \cookie forcing\ issue.


The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature aka a \cookie forcing\ issue.


Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature aka a \cookie forcing\ issue.


Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature aka a \cookie forcing\ issue.


Opera cannot properly restrict modifications to cookies established in HTTPS sessions which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature aka a \cookie forcing\ issue.


Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature aka a \cookie forcing\ issue.


Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3 and Netscape Certificate Management System 6.x does not recognize Certificate Authority profile constraints on Extensions which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.


Cisco Unified Wireless IP Phone 7921 when using Protected Extensible Authentication Protocol (PEAP) does not validate server certificates which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle (MITM) attacks.


Acresso InstallShield Update Agent does not properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet Connect servers which allows remote man-in-the-middle attackers to execute arbitrary VBScript code via Trojan horse Rules.


Vocera Communications wireless handsets when using Protected Extensible Authentication Protocol (PEAP) do not validate server certificates which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle (MITM) attacks.


reseed seeds random numbers from an insecure HTTP request to random.org during installation which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a man-in-the-middle attack.


The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate as demonstrated by https access with Safari.


The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.


Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6 and Puppet Enterprise (PE) Users 1.0 1.1 and 1.2 before 1.2.4 when signing an agent certificate adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master aka \AltNames Vulnerability.\


Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.


The File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X.509 certificate that a user manually accepted for an initial https WebDAV connection which allows man-in-the-middle attackers to hijack WebDAV communication by presenting an arbitrary certificate for a subsequent connection.


methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.


The SSH configuration in the Red Hat mkdumprd script for kexec-tools as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux disables the StrictHostKeyChecking option which allows man-in-the-middle attackers to spoof kdump servers and obtain sensitive core information by using an arbitrary SSH key.


The SSL protocol as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer Mozilla Firefox Google Chrome Opera and other products encrypts data by using CBC mode with chained initialization vectors which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API (2) the Java URLConnection API or (3) the Silverlight WebClient API aka a \BEAST\ attack.


kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address a different vulnerability than CVE-2009-2702.


The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic a related issue to CVE-2011-5095.


APT before 0.8.15.2 does not properly validate inline GPG signatures which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message.


Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate related to incorrect use of the GnuTLS API.


The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.


** DISPUTED ** The default configuration of Microsoft Windows 7 immediately prefers a new IPv6 and DHCPv6 service over a currently used IPv4 and DHCPv4 service upon receipt of an IPv6 Router Advertisement (RA) and does not provide an option to ignore an unexpected RA which allows remote attackers to conduct man-in-the-middle attacks on communication with external IPv4 servers via vectors involving RAs a DHCPv6 server and NAT-PT on the local network aka a \SLAAC Attack.\ NOTE: it can be argued that preferring IPv6 complies with RFC 3484 and that attempting to determine the legitimacy of an RA is currently outside the scope of recommended behavior of host operating systems.


IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 does not use the CRL Distribution Points (CDP) certificate extension which might allow man-in-the-middle attackers to spoof an SSL partner via a revoked certificate for a (1) client (2) queue manager or (3) application.


Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate a different vulnerability than CVE-2009-3766.


The Net::HTTPS module in libwww-perl (LWP) before 6.00 as used in WWW::Mechanize LWP::UserAgent and other products when running in environments that do not set the If-SSL-Cert-Subject header does not enable full validation of SSL certificates by default which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated. NOTE: it could be argued that this is a design limitation of the Net::HTTPS API and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However because this API was modified within LWP a single CVE identifier has been assigned.


MyProxy 5.0 through 5.2 as used in Globus Toolkit 5.0.0 through 5.0.2 does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.


Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 does not prevent a session from changing from strong encryption to DES encryption which allows man-in-the-middle attackers to spoof network traffic and obtain sensitive information via a DES downgrade aka \Kerberos Spoofing Vulnerability.\


The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP URLs which might allow man-in-the-middle attackers to spoof an SSL server via a revoked certificate.


The default configuration of Terminal in Apple Mac OS X 10.6 before 10.6.7 uses SSH protocol version 1 within the New Remote Connection dialog which might make it easier for man-in-the-middle attackers to spoof SSH servers by leveraging protocol vulnerabilities.


The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.


and

in

libsocialweb

before

automatically

connect

to

Twitter

when

no

Twitter

account

is

set

which

might

allow

remote

attackers

to

obtain

sensitive

information

via

a

man-in-the-middle

(MITM)

attack.


message/ax/AxMessage.java in OpenID4Java before 0.9.6 final as used in JBoss Enterprise Application Platform 5.1 before 5.1.2 Step2 Kay Framework before 1.0.2 and possibly other products does not verify that Attribute Exchange (AX) information is signed which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.


ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.


Dovecot 2.0.x before 2.0.16 when ssl or starttls is enabled and hostname is used to define the proxy destination does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.


nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)


The Single Sign On Client (ubuntu-sso-client) for Ubuntu 11.04 and 11.10 does not properly validate SSL certificates when using HTTPS which allows remote attackers to spoof a server and modify or read sensitive data via a man-in-the-middle (MITM) attack.


The Ubuntu One Client for Ubuntu 10.04 LTS 11.04 11.10 and 12.04 LTS does not properly validate SSL certificates which allows remote attackers to spoof a server and modify or read sensitive information via a man-in-the-middle (MITM) attack.


OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.


Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Moneris eSelectPlus 2.03 PHP API does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8 when FIPS mode is enabled does not properly validate a public parameter which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic a related issue to CVE-2011-1923.


Services_Twitter 0.6.3 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


TwitterOAuth does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


tmhOAuth before 0.61 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Dell PowerScale OneFS 8.2.x-9.3.x contains a Improper Certificate Validation. A unauthenticated remote attacker could potentially exploit this vulnerability leading to a man-in-the-middle capture of administrative credentials.


IBM Security Access Manager 9.0.1 through 9.0.6 does not validate or incorrectly validates a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-Force ID: 158510.


IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not properly implement secure connections which allows man-in-the-middle attackers to discover cleartext credentials via unspecified vectors.


In versions prior to 3.3.0 the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.


A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic.


It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server thereby enabling Man-in-the-Middle attacks.


It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification thereby enabling Man-in-the-Middle attacks.


It was found that apt-key in apt all versions do not correctly validate gpg keys with the master keyring leading to a potential man-in-the-middle attack.


IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41 8.0 before 8.0.0.13 and 8.5 before 8.5.5.10 when FIPS 140-2 is enabled misconfigures TLS which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.


Kerberos in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 and 1607 allows man-in-the-middle attackers to bypass authentication via vectors related to a fallback to NTLM authentication during a domain account password change aka \Kerberos Security Feature Bypass Vulnerability.\


The Layout module in Liferay Portal 7.1.0 through 7.3.2 and Liferay DXP 7.1 before fix pack 19 and 7.2 before fix pack 6 exposes the CSRF token in URLs which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.

man in the middle
cross site request forgery


A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication Theia IDE doesn't properly set the SameSite value allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared between a ClickShare Button and a ClickShare Base Unit is randomly generated for each new session and communicated over a TLS connection. An attacker who is able to perform a Man-in-the-Middle attack between the TLS connection is able to obtain the encryption key.


In all Android releases from CAF using the Linux kernel a TZ memory address is exposed to HLOS by HDCP.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the collaboration functionality.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the JPEG 2000 parser engine.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability when handling a JPEG 2000 code-stream.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the image conversion engine related to parsing of the APP13 segment in JPEG files.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the XSLT engine.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the image conversion engine related to parsing of EMF - enhanced meta file format.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the weblink module.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the JPEG 2000 parser related to contiguous code-stream parsing.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the JPEG 2000 code-stream parser.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability when parsing the header of a JPEG 2000 file.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability in the JPEG 2000 parser related to the palette box.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have a memory address leak vulnerability when handling JPEG 2000 code-stream tile data.


In all Qualcomm products with Android releases from CAF using the Linux kernel if a userspace string is not NULL-terminated kernel memory contents can leak to system logs.


Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption to change process behavior.


Node.js before 16.6.1 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption to change process behavior.


SAP Host Agent SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption.


When processing surfaces the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 81.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Absence of length sanity check may lead to possible stack overflow resulting in memory corruption in trustzone region.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel there is a potential heap overflow and memory corruption due to improper error handling in SOC infrastructure.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel a memory corruption can occur in kernel due to improper check in callers count parameter in display handlers.


In all Qualcomm products with Android releases from CAF using the Linux kernel concurrent calls into ioctl RMNET_IOCTL_ADD_MUX_CHANNEL in ipa wan driver may lead to memory corruption due to missing locks.


In all Qualcomm products with Android releases from CAF using the Linux kernel in a video driver memory corruption can potentially occur due to lack of bounds checking in a memcpy().


In all Qualcomm products with Android releases from CAF using the Linux kernel a pointer is not validated prior to being dereferenced potentially resulting in Guest-OS memory corruption.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12 SD 617 SD 650/52 SD 800 SD 808 and SD 810 missing of return value check in memscpy can cause memory corruption in TQS App.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel a specially-crafted HDMI CEC message can be used to cause stack memory corruption.


Adobe Bridge versions 10.0.1 and earlier version have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution .


Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 10 is missing. The length of an I/O buffer parameter is not checked which might lead to memory corruption.


Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Wired Infrastructure and Networking


Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking


Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking


Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking


Adobe Digital Editions 4.5.4 and earlier has an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Digital Editions 4.5.4 and earlier versions 4.5.4 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects aka memory corruption. Successful exploitation could lead to arbitrary code execution.


A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header an attacker could cause the stack to be smashed memory corruption and possibly code execution.


A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences.


A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.


A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.


A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.


There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152236803


There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152647365


A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue affected versions prior to iOS 12.1.1 tvOS 12.1.1 watchOS 5.1.2 Safari 12.0.2 iTunes 12.9.2 for Windows iCloud for Windows 7.9.


Memory corruption in PAN-OS 8.1.9 and earlier and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session.


Improper

validation

of

array

index

causes

OOB

write

and

then

leads

to

memory

corruption

in

MMCP

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Memory

corruption

while

accessing

the

memory

as

payload

size

is

not

validated

before

access

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Subsequent use of the CBO listener may result in further memory corruption due to use after free issue. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in MDM9205 QCS404 SDX55 SM6150 SM7150 SM8150 SXR2130


In several functions of alarm.cc there is possible memory corruption due to a use after free. This could lead to local code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-117997080.


A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.


A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.


It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory crash the host leading to a denial-of-service or cause a random memory corruption.


An issue was discovered on Samsung mobile devices with P(9.0) (SM6150 SM8150 SM8150_FUSION exynos7885 exynos9610 and exynos9820 chipsets) software. RKP memory corruption allows attackers to control the effective address in EL2. The Samsung ID is SVE-2019-15221 (October 2019).


In Cherokee through 1.2.104 multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (Exynos7570 7580 7870 7880 and 8890 chipsets) software. RKP memory corruption causes an arbitrary write to protected memory. The Samsung ID is SVE-2019-13921-2 (May 2019).


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. A local user may be able to read kernel memory.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3 tvOS 12.1.2 watchOS 5.1.3 Safari 12.0.3 iTunes 12.9.3 for Windows iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 Safari 12.1.1 iTunes for Windows 12.9.5 iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3 tvOS 12.1.2 Safari 12.0.3 iTunes 12.9.3 for Windows iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3 tvOS 12.1.2 watchOS 5.1.3 Safari 12.0.3 iTunes 12.9.3 for Windows iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3 tvOS 12.1.2 Safari 12.0.3 iTunes 12.9.3 for Windows iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2 tvOS 12.2 Safari 12.1 iTunes 12.9.4 for Windows iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can cause a read and write from uninitialized memory resulting in memory corruption and possibly arbitrary code execution. To trigger this vulnerability a specifically crafted PDF document needs to be processed by the target application.


u'Lack

of

check

that

the

TX

FIFO

write

and

read

indices

that

are

read

from

shared

RAM

are

less

than

the

FIFO

size

results

into

memory

corruption

and

potential

information

leakage'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Bitra

Kamorta

Nicobar

Rennell

Saipan


u'Lack

of

check

that

the

current

received

data

fragment

size

of

a

particular

packet

that

are

read

from

shared

memory

are

less

than

the

actual

packet

size

can

lead

to

memory

corruption

and

potential

information

leakage'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Bitra

Kamorta

Nicobar

Rennell

Saipan


u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memory and leads to memory corruption' in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wired Infrastructure and Networking in IPQ6018 Kamorta MSM8998 Nicobar QCS404 QCS605 QCS610 Rennell SA415M SA6155P SC7180 SDA660 SDA845 SDM630 SDM636 SDM660 SDM670 SDM710 SDM845 SDM850 SDX24 SDX55 SM6150 SM7150 SM8150 SM8250 SXR1130 SXR2130


u'SMEM

partition

can

be

manipulated

in

case

of

any

compromise

on

HLOS

thus

resulting

in

access

to

memory

outside

of

SMEM

address

range

which

could

lead

to

memory

corruption'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Bitra

Kamorta

Nicobar

Rennell

Saipan


Accessing

data

buffer

beyond

the

available

data

while

parsing

ogg

clip

can

lead

to

null-pointer

dereference

and

then

memory

corruption

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 68.


Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.


Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69.


Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8 Firefox < 68 and Thunderbird < 60.8.


Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 Thunderbird < 68.2 and Firefox ESR < 68.2.


Mozilla developers and community members reported memory safety bugs present in Firefox 68 Firefox ESR 68 and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 Thunderbird < 68.1 Thunderbird < 60.9 Firefox ESR < 60.9 and Firefox ESR < 68.1.


Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70 Thunderbird < 68.2 and Firefox ESR < 68.2.


An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.


An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.


Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto Snapdragon Compute Snapdragon Mobile Snapdragon Wired Infrastructure and Networking in Kamorta QCS404 Rennell SC7180 SDX55 SM6150 SM7150 SM8250 SXR2130


Buffer over-write when this 0-byte buffer is typecasted to some other structure and hence memory corruption in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Mobile in QCS605 SA6155P SM8150


An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to Memory Corruption due to the use of an invalid pointer copy resulting from a destructed string object.


Lack

of

check

that

the

RX

FIFO

write

index

that

is

read

from

shared

RAM

is

less

than

the

FIFO

size

results

into

memory

corruption

and

potential

information

leakage

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6 Firefox ESR < 60.6 and Firefox < 66.


A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions leading to potential memory corruption. This vulnerability affects Firefox < 66.


Mozilla developers and community members reported memory safety bugs present in Firefox 66 Firefox ESR 60.6 and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7 Firefox < 67 and Firefox ESR < 60.7.


Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 67.


Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 66.


Mozilla developers and community members reported memory safety bugs present in Firefox 65 Firefox ESR 60.5 and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6 Firefox ESR < 60.6 and Firefox < 66.


In MatrixSSL before 4.2.2 Open the DTLS server can encounter an invalid pointer free (leading to memory corruption and a daemon crash) via a crafted incoming network message a different vulnerability than CVE-2019-14431.


Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 72.


During the initialization of a new content process a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.


Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.


Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.


The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3 Firefox ESR < 68.3 and Firefox < 71.


Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 71.


Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3 Firefox ESR < 68.3 and Firefox < 71.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2 tvOS 12.2 watchOS 5.2 Safari 12.1 iTunes 12.9.4 for Windows iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4 macOS Mojave 10.14.6 tvOS 12.4 watchOS 5.3 Safari 12.1.2 iTunes for Windows 12.9.6 iCloud for Windows 7.13 iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2 tvOS 12.2 Safari 12.1 iTunes 12.9.4 for Windows iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 Safari 12.1.1 iTunes for Windows 12.9.5 iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1 Safari 12.1.1 iTunes for Windows 12.9.5 iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4 macOS Mojave 10.14.6 tvOS 12.4 Safari 12.1.2 iTunes for Windows 12.9.6 iCloud for Windows 7.13 iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13 iTunes for Windows 12.10.1 iCloud for Windows 10.7 iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15 iOS 13 iCloud for Windows 10.7 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 iCloud for Windows 7.14 iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1 iTunes for Windows 12.9.5 iCloud for Windows 7.12. A malicious application may be able to elevate privileges.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13 iCloud for Windows 7.14 iCloud for Windows 10.7 Safari 13 tvOS 13 watchOS 6 iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2 tvOS 12.2 Safari 12.1 iTunes 12.9.4 for Windows iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15 iOS 13 iCloud for Windows 7.14 iCloud for Windows 10.7 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6 iTunes 12.10.1 for Windows. Multiple issues in libxml2.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15 tvOS 12.3 watchOS 5.2.1 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 macOS Mojave 10.14.5 Security Update 2019-003 High Sierra Security Update 2019-003 Sierra iOS 12.3 iOS 13. Playing a malicious audio file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2 tvOS 12.2 watchOS 5.2 Safari 12.1 iTunes 12.9.4 for Windows iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 5.2 iCloud for Windows 7.11 iOS 12.2 iTunes 12.9.4 for Windows Safari 12.1. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue existed in the handling of IPv6 packets. This issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6 iOS 13. A malicious application may be able to determine kernel memory layout.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1 iTunes for Windows 12.9.5 iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution.


PotPlayer 1.5.40688: .avi File Memory Corruption


An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption.


Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 6 through Update 38 5.0 through Update 38 and 1.4.2_40 and earlier and OpenJDK 6 and 7 allows remote attackers to affect confidentiality integrity and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to \insufficient validation of raster parameters\ in awt_parseImage.c which triggers memory corruption.


The avcodec_decode_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger memory corruption via vectors related to the channel layout.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier 6 Update 43 and earlier and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality integrity and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to \JPEGImageWriter state corruption\ when using native code which triggers memory corruption.


X.org libXt 1.1.3 and earlier does not check the return value of the XGetWindowProperty function which allows X servers to trigger use of an uninitialized pointer and memory corruption via vectors related to the (1) ReqCleanup (2) HandleSelectionEvents (3) ReqTimedOut (4) HandleNormal and (5) HandleSelectionReplies functions.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted PDF file potentially resulting in memory corruption in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted PDF file in Acrobat Reader.


Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15 Thunderbird < 91.2 Firefox ESR < 91.2 Firefox ESR < 78.15 and Firefox < 93.


Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1.


When interacting with an HTML input element's file picker dialog with webkitdirectory set a use-after-free could have resulted leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94 Thunderbird < 91.3 and Firefox ESR < 91.3.


Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93.


Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93 Thunderbird < 91.2 and Firefox ESR < 91.2.


Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 92.


During operations on MessageTasks a task may have been removed while it was still scheduled resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15 Thunderbird < 91.2 Firefox ESR < 91.2 Firefox ESR < 78.15 and Firefox < 93.


Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14 Thunderbird < 78.14 and Firefox < 92.


An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format.


An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet there is an attempt to remove the RPL extension headers. Because the packet length and the extension header length are unchecked (with respect to the available data) at this stage and these variables are susceptible to integer underflow it is possible to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condition. This is related to rpl-ext-header.c.


An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data race that can cause memory corruption because of the unconditional implementation of Sync for Intern<T>.


The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.


PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting \RMRR\). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour ranging from IOMMU faults to memory corruption.


Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11 Firefox < 89 and Firefox ESR < 78.11.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

can

cause

reads

outside

of

bounds

of

heap

allocated

data

if

attacker

supplies

specially

crafted

inputs.

The

assumes

that

the

last

element

of

`boxes`

input

is

as

required

by

the

Since

this

is

not

checked

attackers

passing

values

less

than

can

write

outside

of

bounds

of

heap

allocated

objects

and

cause

memory

corruption.

If

the

last

dimension

in

`boxes`

is

less

than

accesses

similar

to

`tboxes(b

bb

will

access

data

outside

of

bounds.

Further

during

code

execution

there

are

also

writes

to

these

indices.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 90.


Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88.


Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12 Firefox ESR < 78.12 and Firefox < 90.


In FreeBSD 13.0-STABLE before n246941-20f96f215562 12.2-STABLE before r370400 11.4-STABLE before r370399 13.0-RELEASE before p4 12.2-RELEASE before p10 and 11.4-RELEASE before p13 certain VirtIO-based device models in bhyve failed to handle errors when fetching I/O descriptors. A malicious guest may cause the device model to operate on uninitialized I/O vectors leading to memory corruption crashing of the bhyve process and possibly arbitrary code execution in the bhyve process.


Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89.


A malicious webpage could have triggered a use-after-free memory corruption and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12 Firefox ESR < 78.12 and Firefox < 90.


Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13 Firefox ESR < 78.13 and Firefox < 91.


Firefox incorrectly treated an inline list-item element as a block element resulting in an out of bounds read or memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13 Thunderbird < 91 Firefox ESR < 78.13 and Firefox < 91.


Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91.


Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13 Thunderbird < 91 Firefox ESR < 78.13 and Firefox < 91.


Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13 Thunderbird < 91 Firefox ESR < 78.13 and Firefox < 91.


An Out of Bounds flaw was found fig2dev version 3.2.8a. A flawed bounds check in read_objects() could allow an attacker to provide a crafted malicious input causing the application to either crash or in some cases cause memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.


A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.


An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.


Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Improper length check of public exponent in RSA import key function could cause memory corruption. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Voice & Music Snapdragon Wearables


Possible memory corruption due to improper check when application loader object is explicitly destructed while application is unloading in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT


Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Voice & Music Snapdragon Wearables


Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Voice & Music Snapdragon Wearables


A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina Security Update 2021-003 Mojave. An application may be able to cause unexpected system termination or write kernel memory.


Possible memory corruption due to lack of bound check of input index in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina Security Update 2021-003 Mojave. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.


Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85 Thunderbird < 78.7 and Firefox ESR < 78.7.


Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86 Thunderbird < 78.8 and Firefox ESR < 78.8.


A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9 Firefox < 87 and Thunderbird < 78.9.


A WebGL framebuffer was not initialized early enough resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10 Thunderbird < 78.10 and Firefox < 88.


Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85.


Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85 Thunderbird < 78.7 and Firefox ESR < 78.7.


Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86.


Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87.


Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9 Firefox < 87 and Thunderbird < 78.9.


By causing a transition on a parent node by removing a CSS rule an invalid property for a marker could have been applied resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87.


A vulnerability has been identified in JT2Go (All versions < V13.2.0.7) Solid Edge SE2021 (All versions < SE2021MP9) Solid Edge SE2022 (All versions < SE2022MP1) Teamcenter Visualization V13.1 (All versions) Teamcenter Visualization V13.2 (All versions < V13.2.0.7) Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15112)


A vulnerability has been identified in JT2Go (All versions < V13.2.0.7) Solid Edge SE2021 (All versions < SE2021MP9) Solid Edge SE2022 (All versions < SE2022MP1) Teamcenter Visualization V13.1 (All versions) Teamcenter Visualization V13.2 (All versions < V13.2.0.7) Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15110)


A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0) JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to memory corruption condition while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14912)


A vulnerability has been identified in JT2Go (All versions < V13.2) Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13342)


Improper validation of data length received from DMA buffer can lead to memory corruption. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice leading to memory corruption.


An issue was discovered in the tokio crate before 1.8.4 and 1.9.x through 1.13.x before 1.13.1 for Rust. In certain circumstances involving a closed oneshot channel there is a data race and memory corruption.


An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.


An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.


An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default) a Deserialize operation may lack sufficient validation leading to memory corruption or a panic.


Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory corruption. An attacker could leverage this vulnerability to execute code in the context of the current process.


A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.


arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs aka CID-f62f3c20647e.


An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the JPG sof_nb_comp header processing functionality of Accusoft ImageGear 19.8 and 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the TIF bits_per_sample processing functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.


A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability a victim must be tricked into visiting a malicious webpage.


A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a memory corruption or arbitrary code execution allowing attackers to cause a denial-of-service condition or execute code in the context of the current process.


checkpath

in

OpenRC

before

uses

the

direct

output

of

strlen()

to

allocate

strings

which

does

not

account

for

the

byte

at

the

end

of

the

string.

This

results

in

memory

corruption.

was

introduced

in

git

commit

which

was

introduced

as

part

of

OpenRC

development.


A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference.


An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.


Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94 Thunderbird < 91.3 and Firefox ESR < 91.3.


An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.


Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption data race or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug and dependent on the memory backing for the Instance objects it is possible to trigger a use-after-free when the Instance is dropped. Users should upgrade to the main branch of the Lucet repository. Lucet no longer provides versioned releases on crates.io. There is no way to remediate this vulnerability without upgrading.


Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0.


An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.


An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11926.


A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13287)


JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption.


Improper validation of maximum size of data write to EFS file can lead to memory corruption in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 14.7 macOS Big Sur 11.5 watchOS 7.6 tvOS 14.7 Security Update 2021-004 Catalina. Processing a maliciously crafted audio file may lead to arbitrary code execution.


Improper validation of buffer size input to the EFS file can lead to memory corruption in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible memory corruption due to lack of validation of client data used for memory allocation in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Wearables


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.7 macOS Big Sur 11.5 Security Update 2021-004 Catalina Security Update 2021-005 Mojave. Processing maliciously crafted web content may lead to arbitrary code execution.


A local attacker may be able to elevate their privileges. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave. A memory corruption issue was addressed with improved validation.


Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


Possible heap Memory Corruption Issue due to lack of input validation when sending HWTC IQ Capture command in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Improper validation of input when provisioning the HDCP key can lead to memory corruption in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables


Unspecified vulnerability in dbasvr in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 has unknown impact and attack vectors related to memory corruption.


** DISPUTED ** Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev when running on Windows allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue.


Multiple unspecified vulnerabilities in IBM WebSphere MQ 6.0 have unknown impact and remote attack vectors involving \memory corruption.\ NOTE: as of 20071116 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


IBM DB2 UDB 9.1 before Fixpak 4 does not properly handle use of large numbers of file descriptors which might allow attackers to have an unknown impact involving \memory corruption.\ NOTE: the vendor description of this issue is too vague to be certain that it is security-related.


AllegroSoft RomPager 4.34 and earlier as used in Huawei Home Gateway products and other vendors and products allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption aka the \Misfortune Cookie\ vulnerability.


fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.


Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.


The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler.


The (1) parse_str (2) preg_match (3) unpack and (4) pack functions; the (5) ZEND_FETCH_RW (6) ZEND_CONCAT and (7) ZEND_ASSIGN_CONCAT opcodes; and the (8) ArrayObject::uasort method in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler. NOTE: vectors 2 through 4 are related to the call time pass by reference feature.


Recovery Mode in Apple iPhone OS 1.0 through 3.1.2 and iPhone OS for iPod touch 1.1 through 3.1.2 allows physically proximate attackers to bypass device locking and read or modify arbitrary data via a USB control message that triggers memory corruption.


The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call related to the call time pass by reference feature.


A vulnerability classified as problematic was found in GhostPCL 9.55.0. This vulnerability affects the function chunk_free_object of the file gsmchunk.c. The manipulation with a malicious file leads to a memory corruption. The attack can be initiated remotely but requires user interaction. The exploit has been disclosed to the public as a POC and may be used. It is recommended to apply the patches to fix this issue.


Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server.


Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.


Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.


An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.