SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) before versions 4.2 does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls resulting in Stored Cross-Site Scripting.


SAP BusinessObjects Business Intelligence Platform (BI Workspace) versions 4.10 and 4.20 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT before versions 3.73 7.31 7.32) does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


SAP Enable Now before version 1908 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


SAPUI5 and OpenUI5 before versions 1.38.39 1.44.39 1.52.25 1.60.6 and 1.63.0 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.

insufficient user input encoding
cross site scripting vulnerability


SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS) versions 7.10 to 7.11 7.20 7.30 7.31 7.40 and 7.50 does not sufficiently encode user-controlled inputs which results in cross-site scripting (XSS) vulnerability.


Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600 602 603 604 605 606 616 617) does not sufficiently encode user-controlled inputs this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there resulting in Cross-Site Scripting (XSS) vulnerability.


SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31 7.46 7.47 7.48 8.0 8.01) does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP versions 7.30 7.31 7.32 7.33 7.54.


SAP Financial Consolidation before versions 10.0 and 10.1 does not sufficiently encode user-controlled inputs which allows an attacker to execute scripts by uploading files containing malicious scripts leading to reflected cross site scripting vulnerability.


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Nexus 3500 Platform Switches and Nexus 3000 Series Switches software versions prior to 7.0(3)I7(4) are affected.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an authenticated remote attacker to execute arbitrary commands on the underlying Linux shell as the root user. Exploitation of this vulnerability requires privileged access to an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrator privileges and then sending a malicious request to a certain part of the interface.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated remote attacker to inject arbitrary commands and obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input in the Certificate Signing Request (CSR) function of the web-based management interface. An attacker could exploit this vulnerability by submitting a crafted CSR in the web-based management interface. A successful exploit could allow an attacker with administrator privileges to execute arbitrary commands on the device with full root privileges.


In sam2p 0.49.3 an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp leading to an invalid write operation.


The mintToken buy and sell functions of a smart contract implementation for LEF an Ethereum token have an integer overflow.


The transfer transferFrom and mint functions of a smart contract implementation for PFGc an Ethereum token have an integer overflow.


In PoDoFo 0.9.5 there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.


Adobe s 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable integer overflow vulnerability in the CCITT fax PDF filter. Successful exploitation could lead to arbitrary code execution.


In all Android releases from CAF using the Linux kernel an integer overflow vulnerability exists in debug functionality.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of check on buffer length while processing debug log event from firmware can lead to an integer overflow.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel When allocating heap using user supplied size Possible heap overflow vulnerability due to integer overflow in roundup to native pointer.


In all Qualcomm products with Android releases from CAF using the Linux kernel an integer overflow vulnerability exists in boot.


In all Qualcomm products with Android releases from CAF using the Linux kernel an integer overflow vulnerability exists in the hypervisor.


DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.


DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability triggered when the user opens a malformed PhotoShop file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.


DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability triggered when the user opens a malformed Image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 SD 410/12 SD 617 SD 650/52 SD 800 and SD 810 if Widevine App TZ_WV_CMD_DECRYPT_VIDEO is called with a size too large an integer overflow may occur.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800 lack of validation of input could cause a integer overflow that could subsequently lead to a buffer overflow.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800 an integer overflow to buffer overflow can occur in a DRM API.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 617 incorrect size calculation in QCRIL SCWS processing have Integer overflow which will lead to a buffer overflow.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205 SD 400 SD 430 SD 450 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 820 SD 835 an integer overflow vulnerability exists in a video library.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while flashing a meta image an integer overflow can occur if user-defined image offset and size values are too large.


Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer overflow.


A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting.


A component of the HarmonyOS has a Out-of-bounds Write Vulnerability. Local attackers may exploit this vulnerability to cause integer overflow.


A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause the memory which is not released.


Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable integer overflow vulnerability related to Flash Broker COM. Successful exploitation could lead to arbitrary code execution.


Adobe Flash Player versions 23.0.0.207 and earlier 11.2.202.644 and earlier have an exploitable integer overflow vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.


A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted djvu file may lead to application crash and other consequences.


In FreeRDP before version 2.1.2 there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.


In FreeRDP less than or equal to 2.0.0 when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0.


WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later \unofficial\ releases through 5.3.2 which are also affected.


Improper input validation in DSP driver prior to SMR Apr-2022 Release 1 allows out-of-bounds write by integer overflow.


In register_app of btif_hd.cc there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-119819889.


In getReadIndex and getWriteIndex of FifoControllerBase.cpp there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege in the audio server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-120789744


While storing calibrated data from firmware in cache An integer overflow may occur since data length received may exceed real data length. in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in MDM9150 MDM9206 MDM9607 MDM9640 MDM9650 MSM8996AU QCA6174A QCA6574AU QCA9377 QCA9379 SD 210/SD 212/SD 205 SD 425 SD 625 SD 636 SD 712 / SD 710 / SD 670 SD 820A SD 845 / SD 850 SDM660 SDX20


In phFriNfc_ExtnsTransceive of phNxpExtns_MifareStd.cpp there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132083376.


While

processing

vendor

command

which

contains

corrupted

channel

count

an

integer

overflow

occurs

and

finally

will

lead

to

heap

overflow.

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in


** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable a running Unbound installation cannot be remotely or locally exploited.


** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable a running Unbound installation cannot be remotely or locally exploited.


** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable a running Unbound installation cannot be remotely or locally exploited.


** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin leading to an out-of-bounds write. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable a running Unbound installation cannot be remotely or locally exploited.


** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable a running Unbound installation cannot be remotely or locally exploited.


An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.


An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.


An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.


p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment.


Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size.


libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.


The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages which can possibly result in a privilege escalation.


A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image.


An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.


An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.


This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.3.0.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Stuff method. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before writing to memory. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7561.


A pointer overflow with code execution was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e. it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).


An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Integer Overflow and crash during the handling of certain PDF files that embed specifically crafted 3D content because of a free of valid memory.


P30 smart phones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an integer overflow vulnerability due to insufficient check on specific parameters. An attacker tricks the user into installing a malicious application obtains the root permission and constructs specific parameters to the camera program to exploit this vulnerability. Successful exploit could cause the program to break down or allow for arbitrary code execution.


Integer overflow in download manager in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.


An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an integer overflow resulting in heap corruption. An attacker can send a packet to trigger this vulnerability.


An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function allocating too small of a buffer. This buffer can then be written out of bounds resulting in a heap overflow ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A specially crafted BMP image file can cause an integer overflow potentially resulting in code execution. An attacker can specially craft a BMP image to trigger this vulnerability.


An exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an integer overflow resulting in heap corruption. An attacker can send a packet to trigger this vulnerability.


Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Integer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. parseOptions() in tools/rosbag/src/record.cpp has an integer overflow when a crafted split option can be entered on the command line.


ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.


Multiple

integer

overflows

exist

in

MATIO

before

related

to

mat.c

and


In Ming (aka libming) 0.4.8 there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.


** DISPUTED ** QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environment variables. NOTE: This has been disputed as not exploitable.


Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in Snapdragon Auto Snapdragon Compute Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile in QCN7605 QCS605 Rennell SC8180X SDA845 SDM710 SDX24 SDX55 SM7150 SM8150 SM8250 SXR2130


Possible

integer

overflow

while

multiplying

two

integers

of

bit

in

QDCM

API

of

get

display

modes

as

there

is

no

check

on

the

maximum

mode

count

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Possible

integer

overflow

happens

when

mmap

find

function

will

increment

refcount

every

time

when

it

invokes

and

can

lead

to

use

after

free

issue

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in

Nicobar


Improper validation of event buffer extracted from FW response can lead to integer overflow which will allow to pass the length check and eventually will lead to buffer overwrite when event data is copied to context buffer in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in MDM9607 Nicobar QCA6574AU QCN7605 QCS405 QCS605 SDM660 SDM845 SDX55 SM6150 SM7150 SM8150 SM8250 SXR1130 SXR2130


The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.


The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952 1062. The attack vector is: Victim must open a crafted HFS filesystem image.


An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags in WEBP images. This issue affects WhatsApp for Android before version 2.19.143 and WhatsApp for iOS before version 2.19.100.


Kevin Backhouse discovered an integer overflow in bson_ensure_space as used in whoopsie.


An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00035520.12012.047500.00200 cameras. An attacker on the same local network as the camera can craft a message with a size field larger than 0x80000000 and send it to the camera related to an integer overflow or use of a negative number. This then crashes the camera for about 120 seconds.


An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1 0.2.62ubuntu0.1 0.2.64ubuntu0.1 0.2.66 results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-execution in the context of the whoopsie process.


libZetta.rs through 0.1.2 has an integer overflow in the zpool parser (for error stats) that leads to a panic.


Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp.


Integer

overflow

occurs

while

playing

the

clip

which

is

nonstandard

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


An issue was discovered in Xpdf 4.01.01. There is an integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the \multiple bytes per line\ case.


apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file as demonstrated by readelf.


Integer

overflow

in

diag

command

handler

when

user

inputs

a

large

value

for

number

of

tasks

field

in

the

request

packet

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Kamorta

Nicobar

Rennell

Saipan


An issue was discovered in Xpdf 4.01.01. There is an Integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the \one byte per line\ case.


u'Possible

integer

overflow

in

API

due

to

lack

of

check

on

large

oid

range

count

in

cert

extension

field'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Kamorta

Nicobar

Rennell


Possible integer overflow while checking the length of frame which is a 32 bit integer and is added to another 32 bit integer which can lead to unexpected result during the check in Snapdragon Auto Snapdragon Compute Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile in APQ8098 MDM9607 MSM8998 QCA6584 QCN7605 QCS605 SDA660 SDM630 SDM636 SDM660 SDM670 SDM710 SDM845 SDM850 SM6150 SM7150 SM8150 SXR1130


Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs Serial Numbers or checking Feature ID status in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in Kamorta MDM9205 MDM9607 Nicobar QCS404 QCS405 Rennell SA6155P SC7180 SC8180X SDX55 SM6150 SM7150 SXR2130


_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can for example lead to an application crash.


The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS because of missing checks of the count argument in sde_evtlog_filter_write in drivers/gpu/drm/msm/sde_dbg.c. This is exploitable for a device crash via a syscall by a crafted application on a rooted device.


The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length leading to an Integer Overflow thereby making it possible to allocate a large memory chunk on the heap with a size controlled by an attacker as demonstrated by pdftocairo.


The

msm

gpu

driver

for

custom

Linux

kernels

on

the

Xiaomi

perseus-p-oss

MIX

device

through

has

an

integer

overflow

and

OOPS

because

of

missing

checks

of

the

count

argument

in

in

This

is

exploitable

for

a

device

crash

via

a

syscall

by

a

crafted

application

on

a

rooted

device.


The Imagination Technologies driver for Chrome OS before R74-11895.B R75 before R75-12105.B and R76 before R76-12208.0.0 allows attackers to trigger an Integer Overflow and gain privileges via a malicious application. This occurs because of intentional access for the GPU process to /dev/dri/card1 and the PowerVR ioctl handler as demonstrated by PVRSRVBridgeSyncPrimOpCreate.


Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow.


An

integer

overflow

was

discovered

in

the

CoAP

library

in

Arm

Mbed

OS

The

function

sn_coap_builder_calc_needed_packet_data_size_2()

is

used

to

calculate

the

required

memory

for

the

CoAP

message

from

the

data

structure.

Both

and

are

of

type

When

added

together

the

result

can

wrap

around

the

maximum

value.

As

a

result

insufficient

buffer

space

is

allocated

for

the

corresponding

CoAP

message.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c as demonstrated by nm.


Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory and consequently gain privileges via crafted mmap operations related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c.


Integer overflow in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 and Windows Server 2012 Gold and R2 allows local users to gain privileges via a crafted application aka \Win32k Integer Overflow Vulnerability.\


Multiple integer overflows in the process_frame_obj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an unspecified impact via crafted image dimensions in LucasArts Smush video data which triggers an out-of-bounds array access.


Multiple integer overflows in the (1) old_codec37 and (2) old_codec47 functions in libavcodec/sanm.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via crafted LucasArts Smush data which triggers an out-of-bounds array access.


Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec (ALAC) data which triggers an out-of-bounds array access.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier 6 Update 45 and earlier and 5.0 Update 45 and earlier and OpenJDK 7 allows remote attackers to affect confidentiality integrity and availability via vectors related to AWT. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to \integer overflow checks.\


Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9 as used in a certain Motorola build of Android 4.1.2 and other products allows local users to create a read-write memory mapping for the entirety of kernel memory and consequently gain privileges via crafted /dev/graphics/fb0 mmap2 system calls as demonstrated by the Motochopper pwn program.


IrfanView FlashPix Plugin 4.3.4 0 has an Integer Overflow Vulnerability


Integer overflow in the NWFS.SYS kernel driver 4.91.5.8 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003 and the NCPL.SYS kernel driver in Novell Client 2 SP2 on Windows Vista and Windows Server 2008 and Novell Client 2 SP3 on Windows Server 2008 R2 Windows 7 Windows 8 and Windows Server 2012 might allow local users to gain privileges via a crafted 0x1439EB IOCTL call.


XnView 2.03 has an integer overflow vulnerability


Multiple integer overflows in the IP_MSFILTER and IPV6_MSFILTER features in (1) sys/netinet/in_mcast.c and (2) sys/netinet6/in6_mcast.c in the multicast implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE allow local users to bypass intended restrictions on kernel-memory read and write operations and consequently gain privileges via vectors involving a large number of source-filter entries.


In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8 there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.


An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.


Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10 Thunderbird < 78.10 and Firefox < 88.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

TFLite

code

for

allocating

`TFLiteIntArray`s

is

vulnerable

to

an

integer

overflow

An

attacker

can

craft

a

model

such

that

the

`size`

multiplier

is

so

large

that

the

return

value

overflows

the

`int`

datatype

and

becomes

negative.

In

turn

this

results

in

invalid

value

being

given

to

In

this

case

`ret->size`

would

dereference

an

invalid

pointer.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

TFLite

implementation

of

concatenation

is

vulnerable

to

an

integer

overflow

An

attacker

can

craft

a

model

such

that

the

dimensions

of

one

of

the

concatenation

input

overflow

the

values

of

`int`.

TFLite

uses

`int`

to

represent

tensor

dimensions

whereas

TF

uses

Hence

valid

TF

models

can

trigger

an

integer

overflow

when

converted

to

TFLite

format.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


There

is

a

integer

overflow

in

function

filter_core/filter_props.c:gf_props_assign_value

in

GPAC

In

which

the

arg

const

*value

maybe

value->value.data.size

is

a

negative

number.

In

result

memcpy

in

failed.


There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image arbitrary code may be executed in the victim's system.


Stormshield Network Security (SNS) 3.x has an Integer Overflow in the high-availability component.


An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value which could lead to problems with application stability or lead to other attack paths.


There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow potentially leading to problems with application availability.


There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow leading to calling of memmove() on a negative size argument causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability with some potential impact to confidentiality and integrity as well.


An integer overflow was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina Security Update 2021-003 Mojave. An attacker in a privileged network position may be able to leak sensitive user information.


Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music


Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wired Infrastructure and Networking


Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables


Possible integer overflow can occur due to improper length check while calculating count and grace period in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calloc size calculation can cause the multiplication of count and size can overflow which might lead to heap overflows.


Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calculation of a length could lead to a heap overflow.


Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-service condition or code execution on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior CC32XX SDK v4.30.00.06 and prior CC13X0 SDK versions prior to v4.10.03 CC13X2 and CC26XX SDK versions prior to v4.40.00 CC3200 SDK v1.5.0 and prior CC3100 SDK v1.3.0 and prior).


Some Huawei products have an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to kernel crash.


There is a software integer overflow leading to a TOCTOU condition in smartphones. Successful exploitation of this vulnerability may cause random address access.


Multiple integer overflow issues exist while processing long domain names which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior CC32XX SDK v4.30.00.06 and prior CC13X0 SDK versions prior to v4.10.03 CC13X2 and CC26XX SDK versions prior to v4.40.00 CC3200 SDK v1.5.0 and prior CC3100 SDK v1.3.0 and prior).


The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files which may allow an attacker to remotely execute code on SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior CC32XX SDK v4.30.00.06 and prior CC13X0 SDK versions prior to v4.10.03 CC13X2 and CC26XX SDK versions prior to v4.40.00 CC3200 SDK v1.5.0 and prior CC3100 SDK v1.3.0 and prior).


The interface of a certain HarmonyOS module has an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to heap memory overflow.


The affected product is vulnerable to an integer overflow while processing HTTP headers which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior CC32XX SDK v4.30.00.06 and prior CC13X0 SDK versions prior to v4.10.03 CC13X2 and CC26XX SDK versions prior to v4.40.00 CC3200 SDK v1.5.0 and prior CC3100 SDK v1.3.0 and prior).


A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR to trigger an integer overflow. The highest threat from this vulnerability is to system availability.


A flaw was found in ImageMagick in versions 7.0.11 where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.


A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability with some potential impact to data integrity as well.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

In

affected

versions

the

implementation

of

is

vulnerable

to

an

integer

overflow

issue

caused

by

converting

a

signed

integer

value

to

an

unsigned

one

and

then

allocating

memory

based

on

this

value.

The

calls

`reserve`

on

a

`tstring`

with

a

value

that

sometimes

can

be

negative

if

user

supplies

negative

The

`reserve`

method

calls

which

has

an

`unsigned

long`

argument

for

the

size

of

the

buffer.

Hence

the

implicit

conversion

transforms

the

negative

value

to

a

large

integer.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Confidentiality or Availability impacted.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

In

affected

versions

the

implementation

of

`tf.raw_ops.QuantizeAndDequantizeV4Grad`

is

vulnerable

to

an

integer

overflow

issue

caused

by

converting

a

signed

integer

value

to

an

unsigned

one

and

then

allocating

memory

based

on

this

value.

The

uses

the

`axis`

value

as

the

size

argument

to

`absl::InlinedVector`

constructor.

But

the

constructor

uses

an

unsigned

type

for

the

argument

so

the

implicit

conversion

transforms

the

negative

value

to

a

large

integer.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


IIPImage

High

Resolution

Streaming

Image

Server

prior

to

commit

is

affected

by

an

integer

overflow

in

iipsrv.fcgi

through

malformed

HTTP

query

parameters.


MariaDB before 10.6.5 has a sql_lex.cc integer overflow leading to an application crash.


From version 0.2.14 to 0.2.16 for Solana rBPF function \relocate\ in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large an integer overflow is triggered while calculating the variable \addr\ via \addr = (sym.st_value + refd_pa) as u64\;


In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3 an integer overflow exists for m_groupSize.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Integer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.


An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate the embedded length field of an authenticated message received from the device because response_msg.st.len=8 can be accepted but triggers an integer overflow which causes CRYPTO_cbc128_decrypt (in OpenSSL) to encounter an undersized buffer and experience a segmentation fault. The yubihsm-shell project is included in the YubiHSM 2 SDK product.


hyper is an HTTP library for Rust. In versions prior to 0.14.10 hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does can result in \request smuggling\ or \desync attacks.\ The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain a `Transfer-Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers.


Redis is an open source in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6 6.0.16 and 5.0.14.


An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process.


Due to incorrect string size calculations inside the preg_quote function a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3 all versions between 4.57.0 and 4.80.1 all versions between 4.81.0 and 4.93.1 and versions 4.94.0 4.95.0 4.96.0 4.97.0 4.98.0.


runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3 the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.


fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations leading to an integer overflow an Out-of-bounds Write and escalation to root by an unprivileged user aka CID-8cae8cd89f05.


TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior integer overflows segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1 TensorFlow 2.5.2 and TensorFlow 2.4.4 as these are also affected and still in supported range.


prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.


The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.


An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.


Telegram Android <7.1.0 (2090) Telegram iOS <7.1 and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.


The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.


AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.


An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN resulting in potentially arbitrary code execution.


An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate Mem_DynPoolCreate and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker.


ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.


NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function which could allow to access memory locations outside the bounds of a specified array leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc.


An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition.


There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC 1.0.1 which results in a crash.


An integer overflow was addressed through improved input validation. This issue is fixed in iOS 14.7 macOS Big Sur 11.5 watchOS 7.6 tvOS 14.7 Security Update 2021-005 Mojave Security Update 2021-004 Catalina. Processing a maliciously crafted font file may lead to arbitrary code execution.


There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC 1.0.1. pps_id may be a negative number so it will not return. However avc->pps only has 255 unit so there is an overflow which results a crash.


Possible integer overflow due to improper validation of command length parameters while processing WMI command in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music


Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.


The -ftrapv compiler option in gcc and g++ 3.3.3 and earlier does not handle all types of integer overflows which may leave applications vulnerable to vulnerabilities related to overflows.


Integer overflow in exiftags before 1.01 has unknown impact and attack vectors resulting from a \field offset overflow\ that triggers an \illegal memory access \ a different vulnerability than CVE-2007-6354.


Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.


Integer overflow in the str_replace function in PHP 4.4.5 and PHP 5.2.1 allows context-dependent attackers to have an unknown impact via a single character search string in conjunction with a single character replacement string which causes an \off by one overflow.\


Multiple vulnerabilities in (1) bank.php (2) landfill.php (3) outposts.php (4) tribes.php (5) house.php (6) tribearmor.php (7) tribeastral.php (8) tribeware.php and (9) includes/head.php in Bartek Jasicki Vallheru before 1.3 beta have unknown impact and remote attack vectors probably related to large integer values containing more than 15 digits. NOTE: the original vendor report is for integer overflows but this is probably an incorrect usage of the term.


Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument as demonstrated by (1) modifying the iseve function to gain privileges and (2) making the devpermcheck function grant unrestricted device permissions.


Multiple integer overflows in lib/libfdt/fdt.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to gain privileges via a crafted application aka Android internal bug 28821965 and Qualcomm internal bug CR705108.


app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices does not properly check for an integer overflow which allows attackers to bypass intended access restrictions via crafted start and size values aka Android internal bug 28820720 and Qualcomm internal bug CR681957 a related issue to CVE-2014-4325.


Multiple integer overflows in lib/libfdt/fdt_rw.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allow attackers to gain privileges via a crafted application aka Android internal bug 28822060 and Qualcomm internal bug CR705078.


In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel due to an improper address range computation.


Integer overflow in lib/heap/heap.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application aka Android internal bug 28822150 and Qualcomm internal bug CR692478.


Integer overflow in drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application aka Android internal bug 28571496 and Qualcomm internal bug CR545764.


Integer overflow in drivers/char/diag/diag_dci.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges or obtain sensitive information via a crafted application aka Android internal bug 28769912 and Qualcomm internal bug CR565160.


Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the (1) xf_Pointer_New or (2) xf_Bitmap_Decompress function which causes an incorrect amount of memory to be allocated.


Integer

overflow

in

in

Apache

Tomcat

before

before

and

before

when

operated

behind

a

reverse

proxy

allows

remote

attackers

to

conduct

HTTP

request

smuggling

attacks

via

a

crafted

Content-Length

HTTP

header.


Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.


Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a \buffer\ function.


Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors aka internal bug 15328708.


Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors aka internal bug 15342751.


Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors aka internal bug 15342615.


Integer overflow in IOSurface in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad allows local users to gain privileges via vectors involving IOSurface properties as demonstrated by JailbreakMe.


Integer overflow in Arora allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type as demonstrated by a value of 65561 for TCP port 25.


Integer overflow in Alexander Clauss iCab allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type as demonstrated by a value of 65561 for TCP port 25.


Integer overflow in the TCP/IP stack in Microsoft Windows Vista SP1 Windows Server 2008 Gold and R2 and Windows 7 allows local users to gain privileges via a buffer of user-mode data that is copied to kernel mode aka \Integer Overflow in Windows Networking Vulnerability.\


Integer overflow in Stainless allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type as demonstrated by a value of 65561 for TCP port 25.


Integer overflow in OmniWeb allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type as demonstrated by a value of 65561 for TCP port 25.


Integer overflow in wxBitcoin and bitcoind before 0.3.11 allows remote attackers to bypass intended economic restrictions and create many bitcoins via a crafted Bitcoin transaction.


Integer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 RealPlayer Enterprise 2.1.2 Linux RealPlayer 11.0.2.1744 and possibly HelixPlayer 1.0.6 and other versions allows remote attackers to have an unspecified impact via crafted frame dimensions in an SIPR stream.


An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.


Integer overflow in the vorbis_residue_decode_internal function in libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg possibly 0.6 has unspecified impact and remote attack vectors related to the sizes of certain integer data types. NOTE: this might overlap CVE-2011-0480.


In libxml2 before 2.9.14 several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted multi-gigabyte XML file. Other software using libxml2's buffer functions for example libxslt through 1.1.35 is affected as well.


Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.


In ffjpeg (commit hash: caade60) the function bmp_load() in bmp.c contains an integer overflow vulnerability which eventually results in the heap overflow in jfif_encode() in jfif.c. This is due to the incomplete patch for issue 38


In Expat (aka libexpat) before 2.4.5 there is an integer overflow in copyString.


In Expat (aka libexpat) before 2.4.5 there is an integer overflow in storeRawNames.


GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integer Overflow.


If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.


lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.


defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.


addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.


nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.


build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.


storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.


Tensorflow

is

an

Open

Source

Machine

Learning

Framework.

The

implementation

of

`OpLevelCostEstimator::CalculateOutputSize`

is

vulnerable

to

an

integer

overflow

if

an

attacker

can

create

an

operation

which

would

involve

tensors

with

large

enough

number

of

elements.

We

can

have

a

large

enough

number

of

dimensions

in

or

just

a

small

number

of

dimensions

being

large

enough

to

cause

an

overflow

in

the

multiplication.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled a malicious person can trigger undefined behavior. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. The implementation of `Range` suffers from integer overflows. These can trigger undefined behavior or in some scenarios extremely large allocations. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.


Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer for configurations with a nonzero XML_CONTEXT_BYTES.


Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer).


Tensorflow

is

an

Open

Source

Machine

Learning

Framework.

The

implementation

of

`OpLevelCostEstimator::CalculateTensorSize`

is

vulnerable

to

an

integer

overflow

if

an

attacker

can

create

an

operation

which

would

involve

a

tensor

with

large

enough

number

of

elements.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in `TfLiteIntArrayCreate`. The `TfLiteIntArrayGetSizeInBytes` returns an `int` instead of a `size_t. An attacker can control model inputs such that `computed_size` overflows the size of `int` datatype. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence a malicious user could trigger overflows in the multiplication. In certain scenarios this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.


Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by an integer overflow bug. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer overflow weakness. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately the upper bound is not checked and since the code computes `axis + 1` an attacker can trigger an integer overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.


Integer overflow in the pipe_build_write_buffer function (sys/kern/sys_pipe.c) in the direct write optimization feature in the pipe implementation in FreeBSD 7.1 through 7.2 and 6.3 through 6.4 allows local users to bypass virtual-to-physical address lookups and read sensitive information in memory pages via unspecified vectors.


Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel 2.6.24.4 and other versions before 2.6.30-rc1 might allow remote attackers to obtain sensitive information via a large length value which causes \garbage\ memory to be sent.


Integer overflows in (1) base64_encode and (2) the GD library for PHP before 4.3.3 have unknown impact and unknown attack vectors.


Multiple

integer

overflows

in

and

in

procfs

for

OpenBSD

and

earlier

allow

local

users

to

read

sensitive

kernel

memory

and

possibly

perform

other

unauthorized

activities.


Integer overflow in the \Max-dotdot\ CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8 and 1.11.x through 1.11.16 may allow remote attackers to cause a server crash which could cause temporary data to remain undeleted and consume disk space.


An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4 4.1.0 through 4.1.7 5.0.0 and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert related to an Integer Overflow. This causes the varnishd worker process to abort and restart losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.


Multiple integer overflows in CCN-lite before 2.00 allow context-dependent attackers to have unspecified impact via vectors involving the (1) vallen variable in the iottlv_parse_sequence function or (2) typ vallen and i variables in the localrpc_parse function.


In the sendFormatChange function of ACodec there is a possible integer overflow which could lead to an out-of-bounds write. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0 8.1. Android ID: A-67737022.


NVIDIA driver contains an integer overflow vulnerability which could cause a use after free and possibly lead to an elevation of privilege enabling code execution as a privileged process. This issue is rated as high. Version: N/A. Android ID: A-37776156. References: N-CVE-2017-0869.


An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer due to an integer overflow; the computation is part of the abstraction that creates an arbitrarily sized transparent or opaque bitmap image. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.


An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A specially crafted jpeg2000 image can cause an integer overflow leading to wrong memory allocation resulting in arbitrary code execution. Vulnerability can be triggered by viewing the image in via the application or by using thumbnailing feature of IrfanView.


honor 8 Pro with software Duke-L09C10B120 and earlier versions Duke-L09C432B120 and earlier versions Duke-L09C636B120 and earlier versions has an integer overflow vulnerability. The attacker sends a response message to the device which contains an illegal length field it could produce an integer overflow and restart the modem system.


An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability a victim must open the malicious PDF in an application using this library.


An exploitable heap overflow vulnerability exists in the ipStringCreate function of Iceni Argus Version 6.6.05. A specially crafted pdf file can cause an integer overflow resulting in heap overflow. An attacker can send file to trigger this vulnerability.


An integer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a length counter to overflow leading to a controlled out of bounds copy operation. To trigger this vulnerability a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection


Adobe Acrobat Reader versions 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable integer overflow vulnerability in the XML Forms Architecture (XFA) engine related to layout functionality. Successful exploitation could lead to arbitrary code execution.


In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10 an integer overflow might occur for the addition operation \GetQuantumRange(depth)+1\ when \depth\ is large producing a smaller value than expected. As a result an infinite loop would occur for a crafted TXT file that claims a very large \max_value\ value.


An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an integer overflow cascading to a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.


In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText) by causing an integer overflow an authenticated client can crash the server.


In Eclipse Jetty versions 9.2.x and older 9.3.x (all configurations) and 9.4.x (non-default configuration with RFC2616 compliance enabled) transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.


Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.


An issue was discovered in tnef before 1.4.13. Several Integer Overflows which can lead to Heap Overflows have been identified in the functions that wrap memory allocation.


An issue was discovered in ytnef before 1.9.1. This is related to a patch described as \6 of 9. Invalid Write and Integer Overflow.\


An issue was discovered in ytnef before 1.9.1. This is related to a patch described as \5 of 9. Integer Overflow.\


Huawei AR3200 with software V200R006C10 V200R006C11 V200R007C00 V200R007C01 V200R007C02 V200R008C00 V200R008C10 V200R008C20 V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could cause system reboot.


The Bdat driver of Prague smart phones with software versions earlier than Prague-AL00AC00B211 versions earlier than Prague-AL00BC00B211 versions earlier than Prague-AL00CC00B211 versions earlier than Prague-TL00AC01B211 versions earlier than Prague-TL10AC01B211 has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and execute it as a specific privilege; the APP can then send a specific parameter to the driver of the smart phone causing arbitrary code execution.


Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1 as used in V8 in Google Chrome prior to 63.0.3239.84 and other products allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


Huawei AR3200 with software V200R006C10 V200R006C11 V200R007C00 V200R007C01 V200R007C02 V200R008C00 V200R008C10 V200R008C20 V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could system reboot.


The

function

in

in

BusyBox

has

an

Integer

Overflow

that

may

lead

to

a

write

access

violation.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while loading a user application in qseecom an integer overflow could potentially occur if the application partition size is rounded up to page_size.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the function wma_ndp_end_indication_event_handler() there is no input validation check on a event_info value coming from firmware which can cause an integer overflow and then leads to potential heap overwrite.


An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11.


VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.


The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.


An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow which may cause ioqueue backends to reject future key registrations.


The xsltAddTextString function in transform.c in libxslt 1.1.29 as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac Windows and Linux and 57.0.2987.108 for Android lacked a check for integer overflow during a size calculation which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.


An

issue

was

discovered

in

Artifex

Software

Inc.

MuJS

before

The

MakeDay

function

in

jsdate.c

does

not

validate

the

month

leading

to

an

integer

overflow

when

parsing

a

specially

crafted

JS

file.


An integer overflow in \createImageBitmap()\ was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the \createImageBitmap\ API. This function runs in the content sandbox requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.


In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9 the ASTERIX dissector could go into an infinite loop triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow.


In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9 the DHCPv6 dissector could go into a large loop triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow.


An

issue

was

discovered

in

Artifex

Software

Inc.

MuJS

before

The

function

in

jsrun.c

lacks

a

check

for

a

negative

array

length.

This

leads

to

an

integer

overflow

in

the

function

in

jsrun.c

when

parsing

a

specially

crafted

JS

file.


Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.


In ARM mbed TLS before 2.7.0 there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.


In a device with screen size 1440x2560 the check of contiguous buffer will overflow on certain buffer size resulting in an Integer Overflow or Wraparound in System UI in Snapdragon Automobile Snapdragon Mobile in version MDM9635M SD 400 SD 410/12 SD 425 SD 427 SD 430 SD 435 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 810 SD 820 SD 820A SD 835 SDM630 SDM636 SDM660 Snapdragon_High_Med_2016.


An integer overflow (CWE-190) led to an out-of-bounds write (CWE-787) on a heap-allocated area leading to heap corruption in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed.


The Bastet driver of Honor 9 Huawei smart phones with software of versions earlier than Stanford-AL10C00B175 has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the driver of the smart phone causing arbitrary code execution.


An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon it leads to an immediate crash.


Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.


Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application aka Android Bug ID 19261727.


Integer overflow in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to bypass intended access restrictions via a crafted block count and block size of a sparse header aka Android internal bug 28822465 and Qualcomm internal bug CR813933.


Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file which triggers undefined behavior.


Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access restrictions via a crafted image aka Android internal bug 28842418 and Qualcomm internal bug CR813930.


Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19 2.4.18 and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.


In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.


Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted application with the system or camera permission.


Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19 2.4.18 and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.


Integer overflow in sound/soc/msm/qdsp6v2/q6lsm.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application aka Android internal bug 28813987 and Qualcomm internal bug CR792367.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9607 MDM9635M MDM9650 MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 425 SD 430 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 and SD 850 integer overflow may occur when values passed from HLOS (graphics driver busy time and total time) in TZBSP_GFX_DCVS_UPDATE_ID are very large.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

and

integer

overflow

occurs

when

the

size

of

the

firmware

section

is

incorrectly

encoded

in

the

firmware

image.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

integer

overflow

in

tzbsp

can

lead

to

privilege

escalation.


TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code and trigger assert errors via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving \unchecked arithmetic operations\.


systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow but it is probably more like a signedness error or integer underflow.


Borland C++Builder 6 (BCB6) with Update Pack 4 Enterprise edition (ent_upd4) evaluates the \i>sizeof(int)\ expression to false when i equals -1 which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.


Tiny C Compiler (TCC) 0.9.23 (aka TinyCC) evaluates the \i>sizeof(int)\ expression to false when i equals -1 which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.


Cisco IOS 12.0 12.1 and 12.2 when GRE IP tunneling is used and the RFC2784 compliance fixes are missing does not verify the offset field of a GRE packet during decapsulation which leads to an integer overflow that references data from incorrect memory locations which allows remote attackers to inject crafted packets into the routing queue possibly bypassing intended router ACLs.


Integer overflow in memory allocation routines in PHP before 5.1.6 when running on a 64-bit system allows context-dependent attackers to bypass the memory_limit restriction.


** DISPUTED ** Integer overflow in banner/banner.c in FreeBSD NetBSD and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid an exploit would not cross privilege boundaries in normal operations. This issue is not a vulnerability.


Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels including DragonFlyBSD FreeBSD 5.5 MidnightBSD 0.1-CURRENT before 20061115 NetBSD-current before 20061116 NetBSD-4 before 20061203 and TrustedBSD allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow but it is more like an integer signedness error.


Oracle 10g R2 and possibly other versions allows remote attackers to trigger internal errors and possibly have other impacts via an \alter session set events\ command with invalid arguments. NOTE: this issue was originally disputed by a third party but the dispute was retracted. NOTE: this issue was called an \integer overflow\ in the original source but this might be incorrect.


Integer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted TrueType font file that triggers incorrect memory allocation aka \Font Resource Refcount Integer Overflow Vulnerability.\


Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 and Windows Server 2012 allows local users to gain privileges via a crafted briefcase aka \Windows Briefcase Integer Overflow Vulnerability.\


Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism conduct format string attacks and write to arbitrary memory via a large number of arguments.


Integer overflow in the kernel in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory aka \Windows Kernel Integer Overflow Vulnerability.\


Integer overflow in pgpwded.sys in Symantec PGP Desktop 10.x and Encryption Desktop 10.3.0 before MP1 allows local users to gain privileges via a crafted application.


SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file.


An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.


Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.


An issue was discovered on Samsung mobile devices with N(7.x) (MT6755/MT6757 Mediatek models) software. Bootloader has an integer overflow that leads to arbitrary code execution via the download offset control. The Samsung ID is SVE-2017-10732 (January 2018).


in

Python

before

has

an

integer

overflow

via

a

large

value

that

is

mishandled

during

a

\resize

to

twice

the

size\

attempt.

This

issue

might

cause

memory

exhaustion

but

is

only

relevant

if

the

pickle

format

is

used

for

serializing

tens

or

hundreds

of

gigabytes

of

data.

This

issue

is

fixed

in:


The

touchscreen

driver

for

custom

Linux

kernels

on

the

Xiaomi

perseus-p-oss

MIX

device

through

has

an

integer

overflow

and

OOPS

because

of

missing

checks

of

the

size

argument

in

in

This

is

exploitable

for

a

device

crash

via

a

syscall

by

a

crafted

application

on

a

rooted

device.


An improper computation of p_tx0 p_tx1 p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.


read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime crash because of an integer overflow) via a crafted file.


In the hidp_process_report in bluetooth there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.


data-tools through 2017-07-26 has an Integer Overflow leading to an incorrect end value for the write_wchars function.


International

Components

for

Unicode

(ICU)

for

C/C++

has

an

integer

overflow

in

number::impl::DecimalQuantity::toScientificString()

in


Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.


A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4 Firefox ESR < 60.4 and Firefox < 64.


An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60 Firefox ESR < 60.1 and Firefox < 61.


An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1 Thunderbird < 60 and Firefox < 61.


In the mintToken function of a smart contract implementation for Substratum (SUB) an Ethereum ERC20 token the administrator can control mintedAmount leverage an integer overflow and modify a user account's balance arbitrarily.


An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60 Thunderbird < 52.9 Firefox ESR < 60.1 Firefox ESR < 52.9 and Firefox < 61.


A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63 Firefox ESR < 60.3 and Thunderbird < 60.3.


qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.


SP8DE Token (SPX) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


SpadePreSale is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


The mintTokens function of a smart contract implementation for Play2LivePromo an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Enterprise Token Ecosystem (ETE) (Contract Name: NetkillerToken) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The sellBuyerTokens function of a smart contract implementation for SwapToken an Ethereum token has an integer overflow in which \amount * sellPrice\ can be zero consequently reducing a seller's assets.


The mintToken function of a smart contract implementation for Providence Crypto Casino (PVE) (Contract Name: ProvidenceCasinoToken) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


Untrusted

header

fields

in

GNSS

function

can

lead

to

integer

overflow

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Etherty Token (ETY) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


Bitotal (TFUND) is a smart contract running on Ethereum. The mintTokens function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


The transfer and transferFrom functions of a smart contract implementation for Pandora (PDX) an Ethereum token have an integer overflow.


The mintToken function of a smart contract implementation for Virtual Energy Units (VEU) (Contract Name: VEU_TokenERC20) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


MoxyOnePresale is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


The mintlvlToken function of a smart contract implementation for Krown an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The transfer and transferFrom functions of a smart contract implementation for Easy Trading Token (ETT) an Ethereum token have an integer overflow.


The transfer and transferFrom functions of a smart contract implementation for Bittelux (BTX) an Ethereum token have an integer overflow.


Spadeico is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used.


The transfer and transferFrom functions of a smart contract implementation for ChuCunLingAIGO (CCLAG) an Ethereum token have an integer overflow.


SP8DE PreSale Token (DSPX) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.


GVToken Genesis Vision (GVT) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.


Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Industrial IOT Snapdragon Mobile in MDM9206 MDM9607 MDM9650 MDM9655 MSM8996AU SD 410/12 SD 820A


Integer

overflow

may

happen

in

WLAN

when

calculating

an

internal

structure

size

due

to

lack

of

validation

of

the

input

length

in

Snapdragon

Mobile

Snapdragon

Wear

in

version

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD