Integer overflow in Microsoft Paint in Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted JPEG (.JPG) file aka \MS Paint Integer Overflow Vulnerability.\


Integer overflow in the DWA9W ActiveX control in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to execute arbitrary code via a crafted web page aka SPR PTHN97XHFW.

integer overflow
arbitrary code execution


Integer overflow in the kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a large num_sels argument to the i386_set_ldt system call.


Integer overflow in the FlipFileTypeAtom_BtoN function in Apple Quicktime 7.1.5 and other versions before 7.2 allows remote attackers to execute arbitrary code via a crafted M4V (MP4) file.


Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value.


Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter which causes the same variable to be destroyed twice a related issue to CVE-2007-1286.


Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file which results in a heap overflow.


Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 on FreeBSD and possibly other platforms allows context-dependent attackers to execute arbitrary code via certain maxsize values as demonstrated by 0xffffffff.


Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts which result in a heap overflow.


Integer overflow in the RPC library in Libinfo in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbitrary code via crafted requests to portmap.


Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13 9.x before 9.14 and 10.x before 10.2 allows remote attackers to execute arbitrary code via a crafted Literal Run.


Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.


Integer overflow in the NewIdArray function in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13 and SeaMonkey before 2.0.11 allows remote attackers to execute arbitrary code via a JavaScript array with many elements.


Integer overflow in the TFM font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.


Integer overflow in the dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in the Swap4 function in valet4.dll in Luxology Modo 401 allows user-assisted remote attackers to execute arbitrary code via a .LXO file containing a CHNL subchunk associated with an invalid length.


Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a malformed PDF document.


Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier Poppler before 0.10.6 and other products allows remote attackers to execute arbitrary code via a crafted PDF file.


Integer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 allows remote WINS replication partners to execute arbitrary code via crafted data structures in a packet aka \WINS Integer Overflow Vulnerability.\


Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x and 2.x before 2.24 allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.


Integer overflow in the SCTP_SOCKOPT_DEBUG_NAME SCTP socket option in socket.c in the Linux kernel 2.4.25 and earlier allows local users to execute arbitrary code via an optlen value of -1 which causes kmalloc to allocate 0 bytes of memory.


Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6 and possibly earlier versions allows remote attackers to execute arbitrary code.


Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values which trigger an out-of-bounds write.


Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding.


Integer overflow in the kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that makes unspecified IOKit API calls.


Integer overflow in the Microsoft Malware Protection Engine (mpengine.dll) as used by Windows Live OneCare Antigen Defender and Forefront Security allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file.


Integer overflow in the get_fdb_entries function in net/bridge/br_ioctl.c in the Linux kernel before 2.6.18.4 allows local users to execute arbitrary code via a large maxnum value in an ioctl request.


Integer overflow in the evtFilteredMonitorEventsRequest function in the LDAP service in Novell eDirectory before 8.8.1 FTF1 allows remote attackers to execute arbitrary code via a crafted request.


Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.


Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.


Integer overflow in the dtrace implementation in the kernel in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.


Integer overflow in the searchfs system call in Mac OS X 10.3.9 and earlier allows local users to execute arbitrary code via crafted parameters.


Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP before 4.3.11 may allow remote attackers to execute arbitrary code via an IFD tag that leads to a negative byte count.


Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.


Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.


Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier and m5-rc14 allows remote attackers to execute arbitrary code via a crafted BMP file with a header containing a negative offset field.


Integer overflow in the CursorAsset x32 component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.


xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. A malicious application may be able to execute arbitrary code with kernel privileges.

integer overflow
arbitrary code execution
dos


Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2 6 and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7; and Windows Mail on Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows remote e-mail servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) POP3 or (2) IMAP response as demonstrated by a certain +OK response on TCP port 110 aka \Outlook Express and Windows Mail Integer Overflow Vulnerability.\

integer overflow
arbitrary code execution
man in the middle


Integer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via a crafted packet that triggers an out-of-bounds read operation.

integer overflow
arbitrary code execution
out of bound read


Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file which triggers an out-of-bounds read or write.


CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow.

integer overflow
arbitrary command execution


In AdvanceCOMP 2.1 png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)


An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer over-read related to the load_apng function and the imagesize variable.


An issue was discovered in PHP before 5.6.37 7.0.x before 7.0.31 7.1.x before 7.1.20 and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.


u'Buffer over-read while processing received L2CAP packet due to lack of integer overflow check' in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in APQ8009 APQ8053 QCA6390 QCN7605 QCN7606 SA415M SA515M SA6155P SA8155P SC8180X SDX55


SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.


In Teeworlds 0.7.2 there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow because multiplication of width and height is mishandled.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while accessing the keystore in LK an integer overflow vulnerability exists which may potentially lead to a buffer overflow.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of check while calculating the MPDU data length will cause an integer overflow and then to buffer overflow in WLAN function.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing a fast Initial link setup (FILS) connection request integer overflow may lead to a buffer overflow when the key length is zero.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing preferred network offload scan results integer overflow may lead to buffer overflow when large frame length is received from FW.


In all Qualcomm products with Android releases from CAF using the Linux kernel while reading audio data from an unspecified driver a buffer overflow or integer overflow could occur.


In all Qualcomm products with Android releases from CAF using the Linux kernel an integer overflow to buffer overflow vulnerability exists when loading an ELF file.


In all Qualcomm products with Android releases from CAF using the Linux kernel an integer overflow to buffer overflow vulnerability exists when loading an image file.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in a WiFI driver function an integer overflow leading to heap buffer overflow may potentially occur.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in a qbt1000 ioctl handler an incorrect buffer size check has an integer overflow vulnerability potentially leading to a buffer overflow.


Possible buffer overflow in msm_adsp_stream_callback_put due to lack of input validation of user-provided data that leads to integer overflow in all Android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the Linux kernel.


Kilo 0.0.1 has a heap-based buffer overflow because there is an integer overflow in a calculation involving the number of tabs in one row.


An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.


An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.


libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.


An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c due to an integer overflow.


An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.


Improper

check

in

video

driver

while

processing

data

from

video

firmware

can

lead

to

integer

overflow

and

then

buffer

overflow

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters due to incorrect buffer size calculation. in PostScript and PDF printers that use IPS versions prior to 2019.2 in PostScript and PDF printers that use IPS versions prior to 2019.2


Possible

integer

overflow

to

buffer

overflow

in

WLAN

while

parsing

nonstandard

IE

messages.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Saipan


Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and then to buffer overflow in Snapdragon Industrial IOT in MDM9206 MDM9607


An issue was discovered in GNU libiberty as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value leading to an integer overflow and resultant heap-based buffer overflow.


In Exiv2 before v0.27.2 there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overflow vulnerability and a crash.


tif_getimage.c in LibTIFF through 4.0.10 as used in GDAL through 3.0.1 and other products has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image related to a \Negative-size-param\ condition.


An issue was discovered in SoX 14.4.2. In xmalloc.h there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated it is smaller than expected leading to a heap-based buffer overflow in channels_start in remix.c.


An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated it is smaller than expected leading to a heap-based buffer overflow.


Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value which triggers a buffer overflow.


Multiple integer overflows in X.org libXi 1.7.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XGetDeviceControl (2) XGetFeedbackControl (3) XGetDeviceDontPropagateList (4) XGetDeviceMotionEvents (5) XIGetProperty (6) XIGetSelectedEvents (7) XGetDeviceProperties and (8) XListInputDevices functions.


Multiple integer overflows in X.org libchromeXvMC and libchromeXvMCPro in openChrome 0.3.2 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) uniDRIOpenConnection and (2) uniDRIGetClientDriverName functions.


Multiple

integer

overflows

in

X.org

and

earlier

allow

X

servers

to

trigger

allocation

of

insufficient

memory

and

a

buffer

overflow

via

vectors

related

to

the

XQueryFont

XListFontsWithInfo

XGetMotionEvents

XListHosts

XGetModifierMapping

XGetPointerMapping

XGetKeyboardMapping

XGetWindowProperty

XGetImage

LoadColornameDB

XrmGetFileDatabase

or

TransFileName

functions.


Stack-based buffer overflow in libpixman as used in Pale Moon before 15.4 and possibly other products has unspecified impact and context-dependent attack vectors. NOTE: this issue might be resultant from an integer overflow in the fast_composite_scaled_bilinear function in pixman-inlines.h which triggers an infinite loop.


Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRenderQueryFilters (2) XRenderQueryFormats and (3) XRenderQueryPictIndexValues functions.


Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries (2) XcupStoreColors (3) XdbeGetVisualInfo (4) XeviGetVisualInfo (5) XShapeGetRectangles and (6) XSyncListSystemCounters functions.


Multiple integer overflows in X.org libdmx 1.1.2 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) DMXGetScreenAttributes (2) DMXGetWindowAttributes and (3) DMXGetInputAttributes functions.


Multiple integer overflows in X.org libXp 1.0.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XpGetAttributes (2) XpGetOneAttribute (3) XpGetPrinterList and (4) XpQueryScreens functions.


A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn pvALLOc nano_memalign nano_valloc nano_pvalloc could case an integer overflow leading to an allocation of a small buffer and then to a heap-based buffer overflow.


Integer

Underflow

in

Zephyr

in

IEEE

Fragment

Reassembly

Header

Removal.

Zephyr

versions

contain

Integer

Overflow

to

Buffer

Overflow

For

more

information

see


** DISPUTED ** An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments and possibly in all realistic environments.


An integer overflow vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to a stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


A heap-based buffer overflow vulnerability exists in the PSD read_icc_icCurve_data functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to an integer overflow that in turn leads to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


Hiredis

is

a

minimalistic

C

client

library

for

the

Redis

database.

In

affected

versions

Hiredis

is

vulnurable

to

integer

overflow

if

provided

maliciously

crafted

or

corrupted

`RESP`

`mult-bulk`

protocol

data.

When

parsing

`multi-bulk`

(array-like)

replies

hiredis

fails

to

check

if

`count

sizeof(redisReply*)`

can

be

represented

in

If

it

can

not

and

the

`calloc()`

call

doesn't

itself

make

this

check

it

would

result

in

a

short

allocation

and

subsequent

buffer

overflow.

Users

of

hiredis

who

are

unable

to

update

may

set

the

context

option

to

a

value

small

enough

that

no

overflow

is

possible.


GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input leading to a segmentation fault on 32-bit platforms.


CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.


An issue was discovered in klibc before 2.0.9. Multiplication in the calloc() function may result in an integer overflow and a subsequent heap buffer overflow.


An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow.


An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buffer overflow or other security impact.


An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at line: const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size; The bug leads to Dynamic stack buffer overflow. Depending on the context of the application attack vector can be local or remote and can lead to code execution and/or system crash.


Possible integer overflow to buffer overflow due to improper input validation in FTM ARA commands in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuration command is received in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


When parsing a file that is submitted to the DPDecoder service as a job the service will use the combination of decoding parameters that were submitted with the job along with fields that were parsed for the submitted video by the R3D SDK to calculate the size of a heap buffer. Due to an integer overflow with regards to this calculation this can result in an undersized heap buffer being allocated. When this heap buffer is written to a heap-based buffer overflow will occur. This can result in code execution under the context of the application.


In TrustZone an integer overflow vulnerability leading to a buffer overflow could potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.


In the Secure File System in all Android releases from CAF using the Linux kernel an Integer Overflow to Buffer Overflow vulnerability could potentially exist.


Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16 9.1.x before 9.1.12 9.2.x before 9.2.7 and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv (2) hstore_from_arrays and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.


Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to \access privileged options\ via a long word in an options file which triggers a heap-based buffer overflow that \corrupts security-relevant variables.\


Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20 9.0.x before 9.0.16 9.1.x before 9.1.12 9.2.x before 9.2.7 and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.


Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path which triggers a heap-based buffer overflow related to metadata.


Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21 5.0 Update and 25 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.


Integer overflow in rgbimgmodule.c in the rgbimg module in Python 2.5 allows remote attackers to have an unspecified impact via a large image that triggers a buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-3143.12.


There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc 'img->width' and 'img->height' they are large enough to cause an integer overflow. So the malloc function may return a heap blosmaller than the expected size and it will cause a buffer overflow/Address boundary error in the jpeg_read_scanlines function.


In nbd-server in nbd before 3.24 there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name resulting in a write to a dangling pointer. This issue exists for the NBD_OPT_INFO NBD_OPT_GO and NBD_OPT_EXPORT_NAME messages.


An integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22. A specially-crafted BMP file can lead to an integer overflow that in turn causes a buffer overflow. An attacker can provide a malicious BMP file to trigger this vulnerability.


Integer overflow in the unpack200 utility in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20 allows context-dependent attackers to gain privileges via unspecified length fields in the header of a Pack200-compressed JAR file which leads to a heap-based buffer overflow during decompression.


Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality integrity and availability related to HTML. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is for multiple integer overflows in a function that parses an optional data stream within a Microsoft Office file leading to a heap-based buffer overflow.


Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7 8.1 Gold through SP6 9.0 9.1 9.2 Gold through MP3 10.0 Gold through MP1 and 10.3 allows remote attackers to affect confidentiality integrity and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests which leads to a heap-based buffer overflow.


An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to edit an object within a .blend library in their Scene in order to trigger this vulnerability.


An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.


An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier to a Mesh. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.


An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.


An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.


An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.


An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel an integer overflow leading to a buffer overflow due to improper bound checking in msm_audio_effects_virtualizer_handler file msm-audio-effects-q6-v2.c


An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


An exploitable integer overflow exists in the bmp loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.bmp' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.


An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.


An exploitable integer overflow exists in the PNG loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.png' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.hdr' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to render the thumbnail for the file while in the File->Open dialog.


An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.


An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the processing of messages of type eWNI_SME_MODIFY_ADDITIONAL_IES an integer overflow leading to heap buffer overflow may potentially occur.


In wallpaper.c in feh before v2.18.3 if a malicious client pretends to be the E17 window manager it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.


GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.


An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the read_chunk function making an unchecked addition of 12.


An integer overflow error within the \foveon_load_camf()\ function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.


An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378 if it does not properly validate values for tree length when reading a corrupted undo file which may lead to resultant buffer overflows.


An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377 if it does not properly validate values for tree length when reading a corrupted undo file which may lead to resultant buffer overflows.


The value of fix_param->num_chans is received from firmware and if it is too large an integer overflow can occur in wma_radio_chan_stats_event_handler() for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 if the firmware sends a service ready event to the host with a large number in the num_hw_modes or num_phy then it could result in an integer overflow which may potentially lead to a buffer overflow.


In

all

Qualcomm

products

with

Android

releases

from

CAF

using

the

Linux

kernel

in

wma_unified_link_radio_stats_event_handler()

the

number

of

radio

channels

coming

from

firmware

is

not

properly

validated

potentially

leading

to

an

integer

overflow

vulnerability

followed

by

a

buffer

overflow.


In wma_peer_info_event_handler() in Android for MSM Firefox OS for MSM and QRD Android before 2017-10-03 the value of num_peers received from firmware is not properly validated so that an integer overflow vulnerability in the size of a buffer allocation may potentially lead to a buffer overflow.


Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229 have an integer overflow vulnerability. The camera driver does not validate the external input parameters and causes an integer overflow which in the after processing results in a buffer overflow. An attacker tricks the user to install a crafted application successful exploit could cause malicious code execution.


In all Qualcomm products with Android releases from CAF using the Linux kernel the num_failure_info value from firmware is not properly validated in wma_rx_aggr_failure_event_handler() so that an integer overflow vulnerability in a buffer size calculation may potentially lead to a buffer overflow.


In all Qualcomm products with Android releases from CAF using the Linux kernel multiple values received from firmware are not properly validated in wma_get_ll_stats_ext_buf() and are used to allocate the sizes of buffers and may be vulnerable to integer overflow leading to buffer overflow.


libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors e.g. with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0.


vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.


The UNIX IPC layer in WebKit including WebKitGTK+ prior to 2.16.3 does not properly validate message size metadata allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.


CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c resulting in heap-based buffer overflow (and possible arbitrary code execution)


NGINX before 1.13.6 has a buffer overflow for years that exceed four digits as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future) when encountered by the autoindex module.


In all Qualcomm products with Android releases from CAF using the Linux kernel user controlled variables \nr_cmds\ and \nr_bos\ number are passed across functions without any check. An integer overflow to buffer overflow (with a smaller buffer allocated) may occur when they are too large or negative.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625 MDM9635M MDM9640 MDM9645 MDM9650 MDM9655 SD 400 SD 425 SD 430 SD 450 SD 600 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 SD 850 and SDX20 in the Diag User-PD command registration function a length variable used during buffer allocation is not checked so if it is very large an integer overflow followed by a buffer overflow occurs.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 MDM9635M SD 400 and SD 800 while computing the length of memory allocated for a Diag event if the buffer length is very small or greater than the maximum an integer overflow may occur which later results in a buffer overflow.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12 SD 617 SD 650/52 SD 800 SD 808 and SD 810 in TQS QSEE application while parsing \Set Certificates\ command an integer overflow may result in buffer overflow.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615 MDM9625 MDM9635M SD 400 SD 410/12 SD 615/16/SD 415 SD 800 SD 808 and SD 810 in ADSP's QDI Root-PD driver untrusted arguments from User PD may cause integer overflow resulting in buffer overflow.


Multiple

buffer

overflows

in

Sun

Java

Development

Kit

(JDK)

and

Java

Runtime

Environment

(JRE)

Update

and

earlier

Java

System

Development

Kit

(SDK)

and

JRE

and

earlier

versions

and

SDK

and

JRE

and

earlier

allow

attackers

to

develop

Java

applets

that

read

write

or

execute

local

files

possibly

related

to

integer

overflows

in

the

Java_sun_awt_image_ImagingLib_convolveBI

and

functions;

a

stack

overflow

in

the

Java_sun_awt_image_ImagingLib_lookupByteRaster

function;

and

improper

handling

of

certain

negative

values

in

the

Java_sun_font_SunLayoutEngine_nativeLayout

function.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value which triggers a memory allocation of one byte.


Multiple integer overflows in the (1) malloc and (2) calloc functions in Hoard before 3.9 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows on implementing code via a large size value which causes less memory to be allocated than expected.


Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value which causes less memory to be allocated than expected.


Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value which causes less memory to be allocated than expected.


Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value which causes less memory to be allocated than expected.


Multiple integer overflows in the (1) chk_malloc (2) leak_malloc and (3) leak_memalign functions in libc/bionic/malloc_debug_leak.c in Bionic (libc) for Android when libc.debug.malloc is set make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value which causes less memory to be allocated than expected.


The demangle_template function in cplus-dem.c in GNU libiberty as distributed in GNU Binutils 2.31.1 contains an integer overflow vulnerability (for \Create an array for saving the template argument values\) that can trigger a heap-based buffer overflow as demonstrated by nm.


The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled as demonstrated by tjbench.


load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size.


An integer overflow to buffer overflow vulnerability exists in the ADSPRPC heap manager in all Android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the Linux kernel.


While processing fragments when the fragment count becomes very large an integer overflow leading to a buffer overflow can occur in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


The

getImageData

function

in

the

ImageBufferCairo

class

in

in

WebKit

as

used

in

WebKitGTK+

prior

to

version

and

WPE

WebKit

prior

to

version

is

vulnerable

to

a

heap-based

buffer

overflow

triggered

by

an

integer

overflow

which

could

be

abused

by

crafted

HTML

content.


Unchecked

OTA

field

in

GNSS

lead

to

integer

overflow

and

then

buffer

overflow

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier when processing very long pathname arguments to the realpath function could encounter an integer overflow on 32-bit architectures leading to a stack-based buffer overflow and potentially arbitrary code execution.


Improper

buffer

length

check

before

copying

can

lead

to

integer

overflow

and

then

a

buffer

overflow

in

WMA

event

handler

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


The Rust Programming Language Standard Library version 1.29.0 1.28.0 1.27.2 1.27.1 127.0 126.2 126.1 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat passed a large number can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1.


curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)


While parsing an mp4 file an integer overflow leading to a buffer overflow can occur in Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear.


In the function wmi_set_ie() the length validation code does not handle unsigned integer overflow properly. As a result a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.


In the cryptography package before 3.3.2 for Python certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow as demonstrated by the Fernet class.


A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg which can lead to an impact to application availability or data integrity.


An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.


u'Possible buffer overflow in WMA message processing due to integer overflow occurs when processing command received from user space' in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in APQ8009 APQ8053 APQ8096AU MDM9206 MDM9250 MDM9628 MDM9640 MDM9650 MSM8996AU QCS405 SDA845 SDX20 SDX20M WCD9330


u'Integer

overflow

to

buffer

overflow

occurs

while

playback

of

ASF

clip

having

unexpected

number

of

codec

entries'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in


In FreeRDP less than or equal to 2.0.0 an Integer Overflow to Buffer Overflow exists. When using /video redirection a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.


u'Integer

overflow

can

cause

a

buffer

overflow

due

to

lack

of

table

length

check

in

the

extensible

boot

Loader

during

the

validation

of

security

metadata

while

processing

objects

to

be

loaded'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in


Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days).


Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.


Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.


An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow leading to a heap-based buffer overflow exists in the UnicodeString::doAppend() function in common/unistr.cpp.


GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.


u'A

potential

buffer

overflow

exists

due

to

integer

overflow

when

parsing

handler

options

due

to

wrong

data

type

usage

in

operation'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Kamorta

Nicobar

Rennell

Saipan


Multiple integer overflows in the (1) curl_escape (2) curl_easy_escape (3) curl_unescape and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff which triggers a heap-based buffer overflow.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

an

integer

overflow

leading

to

buffer

overflow

can

occur

in

a

QuRT

API

function.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Small

Cell

SoC

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

an

integer

overflow

leading

to

buffer

overflow

can

potentially

occur

in

a

memory

API

function.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205 SD 400 SD 430 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 and SD 820 lack input validation may lead to a integer overflow that could potentially lead to a buffer overflow.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 430 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 and SD 835 an integer overflow leading to buffer overflow can occur during a VT call.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

integer

overflow

may

lead

to

buffer

overflows

in

IPC

router

Root-PD

driver.


Integer

overflow

in

tools/tiffcp.c

in

LibTIFF

and

allows

remote

attackers

to

have

unspecified

impact

via

a

crafted

image

which

triggers

a

heap-based

buffer

overflow.


Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors which triggers a buffer overflow.


In an audio driver in all Qualcomm products with Android for MSM Firefox OS for MSM or QRD Android if a function is called with a very large length an integer overflow could occur followed by a heap buffer overflow.


In an audio driver function in all Qualcomm products with Android for MSM Firefox OS for MSM or QRD Android some parameters are from userspace and if they are set to a large value integer overflow is possible followed by buffer overflow. In another function a missing check for a lower bound may result in an out of bounds memory access.


In a sound driver in all Qualcomm products with Android for MSM Firefox OS for MSM or QRD Android if a function is called with a very large length an integer overflow could occur followed by a buffer overflow.


Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12 3.x before 3.4.5 and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value which triggers a heap-based buffer overflow.


Integer overflow in Computer Associates Vet Antivirus library as used by CA InoculateIT 6.0 eTrust Antivirus r6.0 through 7.1 eTrust Antivirus for the Gateway r7.0 and r7.1 eTrust Secure Content Manager eTrust Intrusion Detection BrightStor ARCserve Backup (BAB) r11.1 Vet Antivirus Zonelabs ZoneAlarm Security Suite and ZoneAlarm Antivirus allows remote attackers to gain privileges via a compressed VBA directory with a project name length of -1 which leads to a heap-based buffer overflow.


Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value which causes less memory to be allocated than expected.


Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier and JDK and JRE 5.0 Update 16 and earlier allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.


imlib2 before 1.4.2 allows context-dependent attackers to have an unspecified impact via a crafted (1) ARGB (2) BMP (3) JPEG (4) LBM (5) PNM (6) TGA or (7) XPM file related to \several heap and stack based buffer overflows - partly due to integer overflows.\


Integer overflow in the dccp_feat_change function in net/dccp/feat.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.18 and 2.6.17 through 2.6.20 allows local users to gain privileges via an invalid feature length which leads to a heap-based buffer overflow.


** DISPUTED ** gcc 4.2.0 through 4.3.0 in GNU Compiler Collection when casts are not used considers the sum of a pointer and an int to be greater than or equal to the pointer which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999).


Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21 when the mod_setenvif module is enabled allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive in conjunction with a crafted HTTP request header leading to a heap-based buffer overflow.


Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it leading to hardlink executable crash or potentially arbitrary code execution with user privileges.


Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact and vectors which trigger a heap-based buffer overflow.


Multiple integer overflows in X.org libXRes 1.0.6 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XResQueryClients and (2) XResQueryClientResources functions.


Multiple integer overflows in X.org libXvMC 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvMCListSurfaceTypes and (2) XvMCListSubpictureTypes functions.


Multiple integer overflows in X.org libXv 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvQueryPortAttributes (2) XvListImageFormats and (3) XvCreateImage function.


Multiple integer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XDGAQueryModes and (2) XDGASetMode functions.


Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XF86DRIOpenConnection and (2) XF86DRIGetClientDriverName functions.


Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRRQueryOutputProperty and (2) XRRQueryProviderProperty functions.


Multiple integer overflows in Christos Zoulas file before 5.02 allow user-assisted remote attackers to have an unspecified impact via a malformed compound document (aka cdf) file that triggers a buffer overflow.


Integer overflow in the showLog function in fake_log_device.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines.


Integer overflow in the do_replace function in netfilter for Linux before 2.6.16-rc3 when using \virtualization solutions\ such as OpenVZ allows local users with CAP_NET_ADMIN rights to cause a buffer overflow in the copy_from_user function.


Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file which triggers a heap-based buffer overflow.


Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size which triggers a heap-based buffer overflow.


Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file which triggers a buffer overflow.


Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header which triggers a buffer overflow.


Integer overflow in X.org libXinerama 1.1.2 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XineramaQueryScreens function.


Integer overflow in X.org libXfixes 5.0 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XFixesGetCursorImage function.


Integer overflow in X.org libXtst 1.2.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XRecordGetContext function.


Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.


Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the read_packet function.


In the standard library in Rust before 1.52.0 the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.


In TrustZone in all Android releases from CAF using the Linux kernel an Integer Overflow to Buffer Overflow vulnerability could potentially exist.


Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file which triggers a heap-based buffer overflow.

integer overflow
buffer overflow
arbitrary code execution


Integer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a long TIFF tag that triggers a heap-based buffer overflow as demonstrated using a Canon RAW CR2 file with a long TIFF StripByteCounts tag.


Integer overflow in the JavaScript implementation in Mozilla Firefox before 18.0 Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted string concatenation leading to improper memory allocation and a heap-based buffer overflow.


Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM_ELEMENTS field in an IFD_ENTRY structure in a JXR file which triggers a heap-based buffer overflow.


Integer overflow in Sagelight 4.4 and earlier allows remote attackers to execute arbitrary code via crafted width and height dimensions in a BMP file which triggers a heap-based buffer overflow.


A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.


Integer overflow in the RPCFN_SYNC_TASK function in StRpcSrv.dll as used by the ServerProtect service (SpntSvc.exe) in Trend Micro ServerProtect for Windows before 5.58 Security Patch 4 allows remote attackers to execute arbitrary code via a certain integer field in a request packet to TCP port 5168 which triggers a heap-based buffer overflow.


Integer overflow in the build_range function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values which triggers a heap-based buffer overflow.


Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 as used in Winamp before 5.5 and other products allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation resulting in a heap-based buffer overflow.


Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file which triggers an integer overflow and a heap-based buffer overflow.


Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 Server 2008 Office XP SP3 Office 2003 SP2 and SP3 2007 Microsoft Office System Gold and SP1 Visio 2002 SP2 PowerPoint Viewer 2003 Works 8 Digital Image Suite 2006 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 Report Viewer 2005 SP1 and 2008 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via an image file with crafted gradient sizes in gradient fill input which triggers a heap-based buffer overflow related to GdiPlus.dll and VGX.DLL aka \GDI+ VML Buffer Overrun Vulnerability.\


Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file which triggers a heap-based buffer overflow.


Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that triggers a heap-based buffer overflow.


Integer overflow in the ID_PSP.apl plug-in for ACD ACDSee Photo Manager 9.0 build 108 Pro Photo Manager 8.1 build 99 and Photo Editor 4.0 build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted PSP image that triggers a heap-based buffer overflow.


Multiple buffer overflows in ACD products allow user-assisted remote attackers to execute arbitrary code via a long section string in a (1) XBM or (2) XPM file to (a) ID_X.apl or (b) IDE_ACDStd.apl. NOTE: the PSP and LHA vectors are already covered by CVE-2007-4344 and CVE-2007-6007. NOTE: these might be integer overflows rather than buffer overflows.


Integer overflow in McAfee E-Business Server before 8.5.3 for Solaris and before 8.1.2 for Linux HP-UX and AIX allows remote attackers to execute arbitrary code via a large length value in an authentication packet which results in a heap-based buffer overflow.


Object linking and embedding (OLE) Automation as used in Microsoft Windows 2000 SP4 XP SP2 Server 2003 SP1 and SP2 Office 2004 for Mac and Visual Basic 6.0 allows remote attackers to execute arbitrary code via the substringData method on a TextNode object which causes an integer overflow that leads to a buffer overflow.


Integer overflow in the TIFF parser in OpenOffice.org (OOo) before 2.3; and Sun StarOffice 6 7 and 8 Office Suite (StarSuite); allows remote attackers to execute arbitrary code via a TIFF file with crafted values of unspecified length fields which triggers allocation of an incorrect amount of memory resulting in a heap-based buffer overflow.


Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02 as used in (1) poppler before 0.5.91 (2) gpdf before 2.8.2 (3) kpdf (4) kdegraphics (5) CUPS (6) PDFedit and other products might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.


Integer overflow in Panda Software AdminSecure allows remote attackers to execute arbitrary code via crafted packets with modified length values to TCP ports 19226 or 19227 resulting in a heap-based buffer overflow.


Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4 XP SP2 and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted metafile (image) with a large record length value which triggers a heap-based buffer overflow.


Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line.


Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01 6 and 7 on Windows 2000 SP4 XP SP2 Server 2003 and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow aka the \VML Buffer Overrun Vulnerability.\


Integer overflow in Adobe Flash Player 9.0.115.0 and earlier and 8.0.39.0 and earlier allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value which passes a signed comparison is used as an offset of a NULL pointer and triggers a buffer overflow.


Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file which triggers a stack-based buffer overflow.


Integer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted layer mask data in a PSD file which triggers a heap-based buffer overflow.


Multiple integer overflows in the (1) fs_get_reply (2) fs_alloc_glyphs and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply which triggers a buffer overflow.


Integer overflow in the FRAMESET element implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9 Thunderbird before 3.0.7 and 3.1.x before 3.1.3 and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via a large number of values in the cols (aka columns) attribute leading to a heap-based buffer overflow.


Integer overflow in the nsGenericDOMDataNode::SetTextInternal function in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4 Thunderbird before 3.0.5 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a DOM node with a long text value that triggers a heap-based buffer overflow.


Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow as demonstrated by the vd_ff module in VulnDisco 9.0.


Integer overflow in the load_iface function in Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 might allow context-dependent attackers to execute arbitrary code via a (1) file or (2) socket that provides configuration data with many entries leading to a heap-based buffer overflow.


Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via (1) a large JPG image related to the jpg2bitmap function or (2) a large PNG image related to the png2bitmap function leading to heap-based buffer overflows.


Multiple integer overflows in libgdiplus 2.6.7 as used in Mono allow attackers to execute arbitrary code via (1) a crafted TIFF file related to the gdip_load_tiff_image function in tiffcodec.c; (2) a crafted JPEG file related to the gdip_load_jpeg_image_internal function in jpegcodec.c; or (3) a crafted BMP file related to the gdip_read_bmp_image function in bmpcodec.c leading to heap-based buffer overflows.


Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver as used in pcscd in PCSC-Lite 1.5.3 and possibly other products allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negative value to be used in a memcpy operation which triggers a buffer overflow. NOTE: some sources refer to this issue as an integer overflow.


An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2 12.x before 12.1.3_U8 and 12.2.x through 12.5.x before 12.5.9_U2.


Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7 and 1.6.x before 1.6.4 allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow a related issue to CVE-2009-2412.


Integer overflow in the text converters in Microsoft Office Word 2002 SP3 and 2003 SP3; Works 8.5; Office Converter Pack; and WordPad in Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a DOC file with an invalid number of property names in the DocumentSummaryInformation stream which triggers a heap-based buffer overflow.


Multiple integer overflows in CamlImages 2.2 might allow context-dependent attackers to execute arbitrary code via images containing large width and height values that trigger a heap-based buffer overflow related to (1) crafted GIF files (gifread.c) and (2) crafted JPEG files (jpegread.c) a different vulnerability than CVE-2009-2295.


Integer overflow in javaws.exe in Sun Java Web Start in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 allows context-dependent attackers to execute arbitrary code via a crafted JPEG image that is not properly handled during display to a splash screen which triggers a heap-based buffer overflow.


Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24 function.


Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2 3.9 and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.


Integer overflow in IrfanView 4.23 when the resampling or screen fitting option is enabled allows remote attackers to execute arbitrary code via a crafted TIFF 1 BPP image which triggers a heap-based buffer overflow.


Integer overflow in kvolefio.dll 8.5.0.8339 and 10.5.0.0 in the Autonomy KeyView Filter SDK as used in IBM Lotus Notes 8.5 Symantec Mail Security for Microsoft Exchange 5.0.10 through 5.0.13 and other products allows context-dependent attackers to execute arbitrary code via a crafted OLE document that triggers a heap-based buffer overflow.


Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize and possibly (2) ProtoSize and (3) ServerSize field that triggers a stack-based buffer overflow involving a crafted HostList field. NOTE: some of these details are obtained from third party information.


Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188.


Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22 JDK and JRE 6 before Update 17 and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow aka Bug Id 6874643.


Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 as used in GPdf kdegraphics KPDF CUPS pdftops and teTeX might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.


Integer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57 might allow remote attackers to execute arbitrary code via an Oktalyzer file that triggers a heap-based buffer overflow.


Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6 as used in gstreamer-plugins TTPlayer and other products allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name which triggers a heap-based buffer overflow as exploited in the wild in August 2008.


Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via (1) a crafted PNG image that triggers an integer overflow during memory allocation for display on the splash screen aka CR 6804996; and (2) a crafted GIF image from which unspecified values are used in calculation of offsets leading to object-pointer corruption aka CR 6804997.


Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927.


Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom which triggers a heap-based buffer overflow.


The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via a crafted MAKI file which triggers an incorrect sign extension an integer overflow and a stack-based buffer overflow.


Integer overflow in Excel in Microsoft Office 2000 SP3 Office XP SP3 Office 2003 SP3 and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; Microsoft Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2; and Microsoft Office SharePoint Server 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via an Excel file with a Shared String Table (SST) record with a numeric field that specifies an invalid number of unique strings which triggers a heap-based buffer overflow aka \Record Integer Overflow Vulnerability.\


Integer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a PowerPoint file containing a crafted record type for \collaboration information for different slides\ that contains a field that specifies a large number of records which triggers an under-allocated buffer and a heap-based buffer overflow aka \Integer Overflow Vulnerability.\


Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.


Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2 as used in Firefox 3.1beta OpenJDK and GIMP allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.


Integer overflow in libsndfile 1.0.18 as used in Winamp and other products allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file leading to a heap-based buffer overflow.


Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation which triggers a heap-based buffer overflow.


Integer overflow in the WriteProlog function in texttops in CUPS 1.1.17 on Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2008-3640.


Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value each of which triggers a heap-based buffer overflow.


Integer overflow in XnView before 1.97.2 might allow remote attackers to execute arbitrary code via a DICOM image with crafted dimensions leading to a heap-based buffer overflow.


Multiple integer overflows in LibThai before 0.1.13 might allow context-dependent attackers to execute arbitrary code via long strings that trigger heap-based buffer overflows related to (1) thbrk/thbrk.c and (2) thwbrk/thwbrk.c. NOTE: some of these details are obtained from third party information.


Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.


traceroute-nanog 6.1.1 allows local users to overwrite unauthorized memory and possibly execute arbitrary code via certain \nprobes\ and \max_ttl\ arguments that cause an integer overflow that is used when allocating memory which leads to a buffer overflow.


Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string or (2) a large number of tracks which leads to a heap-based buffer overflow.


Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.


Integer overflow in fetch on FreeBSD 4.1 through 5.3 allows remote malicious servers to execute arbitrary code via certain HTTP headers in an HTTP response which lead to a buffer overflow.


Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp .cur .ico or .ani file with a large image size field which leads to a buffer overflow aka the \Cursor and Icon Format Handling Vulnerability.\


Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count which leads to a heap-based buffer overflow.


Multiple integer overflows in (1) readbmp.c (2) readgif.c (3) readgif.c (4) readmrf.c (5) readpcx.c (6) readpng.c (7) readpnm.c (8) readprf.c (9) readtiff.c (10) readxbm.c (11) readxpm.c in zgv 5.8 allow remote attackers to execute arbitrary code via certain image headers that cause calculations to be overflowed and small buffers to be allocated leading to buffer overflows. NOTE: CVE-2004-0994 and CVE-2004-1095 identify sets of bugs that only partially overlap despite having the same developer. Therefore they should be regarded as distinct.


Integer overflow in pnen3260.dll in RealPlayer 8 through 10.5 (6.0.12.1040) and earlier and RealOne Player 1 or 2 on Windows or Mac OS allows remote attackers to execute arbitrary code via a SMIL file and a .rm movie file with a large length field for the data chunk which leads to a heap-based buffer overflow.


Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier and gdk-pixbuf before 0.22 allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).


Multiple integer overflows in xzgv 0.8 and earlier allow remote attackers to execute arbitrary code via images with large width and height values which trigger a heap-based buffer overflow as demonstrated in the read_prf_file function in readprf.c. NOTE: CVE-2004-0994 and CVE-2004-1095 identify sets of bugs that only partially overlap despite having the same developer. Therefore they should be regarded as distinct.


Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01 5.5 and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.


Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 on 64-bit platforms allows remote attackers to execute arbitrary code via a crafted MP4 video file that triggers a buffer overflow.


Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42 5.5.x before 5.5.26 and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.


Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41 5.5.x before 5.5.25 and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command leading to a heap-based buffer overflow.


Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application that uses HDCP encryption leading to a heap-based buffer overflow aka internal bug 20222489.


Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms as used in NetBSD through 6.1.5 and other products might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.


Integer overflow in Autodesk Design Review (ADR) before 2013 Hotfix 2 allows remote attackers to execute arbitrary code via a crafted biClrUsed value in a BMP file which triggers a buffer overflow.


Integer

overflow

in

the

ImageRegionReader::ReadIntoBuffer

function

in

MediaStorageAndFileFormat/gdcmImageRegionReader.cxx

in

Grassroots

DICOM

(aka

GDCM)

before

allows

attackers

to

execute

arbitrary

code

via

crafted

header

dimensions

in

a

DICOM

image

file

which

triggers

a

buffer

overflow.


Integer overflow in the ReadWideString function in agentdpv.dll in Microsoft Agent on Microsoft Windows 2000 SP4 XP SP2 and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a large length value in an .ACF file which results in a heap-based buffer overflow.


Integer overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe Font Metrics (AFM) files with a modified number of character metrics (StartCharMetrics) which leads to a heap-based buffer overflow.


Integer overflow in Tor before 0.1.1.20 allows remote attackers to execute arbitrary code via crafted large inputs which result in a buffer overflow when elements are added to smartlists.


Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based buffer overflow.


Multiple integer overflows in the DPRPC library (DPRPCW32.DLL) in Novell Client 4.83 SP3 4.90 SP2 and 4.91 SP2 allow remote attackers to execute arbitrary code via an XDR encoded array with a field that specifies a large number of elements which triggers the overflows in the ndps_xdr_array function. NOTE: this was originally reported to be a buffer overflow by Novell but the original cause is an integer overflow.


Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated which triggers a heap-based buffer overflow in a memcpy function call a different vulnerability than CVE-2002-1396.


Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.


Integer overflow in the Real-Time Information Server (RIS) Data Collector service (RisDC.exe) in Cisco Unified Communications Manager (CUCM formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via crafted packets resulting in a heap-based buffer overflow.


Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13 as used by Cisco SCCP phones allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.


Multiple integer overflows in Grisoft AVG Anti-Virus before 7.1.407 allow remote attackers to execute arbitrary code via crafted (1) CAB or (2) RAR archives that trigger a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.


Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1) wmf/winwmf.cxx during processing of META_ESCAPE records; and wmf/enhwmf.cxx during processing of (2) EMR_POLYPOLYGON and (3) EMR_POLYPOLYGON16 records.


Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1 on Chinese and possibly other Windows distributions allows remote attackers to execute arbitrary code via unknown manipulations in arguments to the KeyFrame method possibly related to an integer overflow as demonstrated by daxctle2 and a different vulnerability than CVE-2006-4446.


Integer overflow in Msg.dll in Novell ZENworks 7 Asset Management (ZAM) before SP1 IR11 and the Collection client allows remote attackers to execute arbitrary code via crafted packets which trigger a heap-based buffer overflow.


Integer overflow in the packed PE file parsing implementation in BitDefender products before 20060829 including Antivirus Antivirus Plus Internet Security Mail Protection for Enterprises and Online Scanner; and BitDefender products for Microsoft ISA Server and Exchange 5.5 through 2003; allows remote attackers to execute arbitrary code via a crafted file which triggers a heap-based buffer overflow aka the \cevakrnl.xmd vulnerability.\


Integer overflow in the KPresenter import filter for Microsoft PowerPoint files (filters/olefilters/lib/klaola.cc) in KOffice before 1.6.1 allows user-assisted remote attackers to execute arbitrary code via a crafted PPT file which results in a heap-based buffer overflow.


Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size) which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224 but that CVE has been REJECTED and split.


Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large (1) min (2) max or (3) duplength values that cause an incorrect length calculation and trigger a buffer overflow a different vulnerability than CVE-2006-7227. NOTE: this issue was originally subsumed by CVE-2006-7224 but that CVE has been REJECTED and split.


Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the ImportGR in the JPG image filter module (HncJpeg10.flt) or (2) PNG image to the PNG image filter module (HncPng10.flt) which triggers a heap-based buffer overflow.


Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function leading to a heap-based buffer overflow.


Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2) PNG image object in a Symphony document that triggers a heap-based buffer overflow as demonstrated by a .doc file.