The mintToken function of a smart contract implementation for AnovaBace an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ipshoots an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for VICETOKEN_ICO_IS_A_SCAM an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Reimburse Token (REIM) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CrimsonShilling an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CHERRYCOIN an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for WorldOpctionChain an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for IdeaCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ElevateCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for mkethToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for AMToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for BiquToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for TongTong Coin (TTCoin) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for HashShield an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for GreenEnergyToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for DataShieldCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for OTAKUToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for doccoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for EristicaICO an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Essence an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for FinalToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for TravelCoin (TRV) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MktCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for SmartPayment an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for PhilCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for SmartHomeCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for UTCT an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MultiGames (MLT) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MyBO an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CGCToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ProjectJ an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Rice an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for RobotBTC an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ResidualValue an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for JustWallet an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for HBCM an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for wellieat an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MoneyChainNet (MCN) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for PlatoToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for DVChain an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Air-Contact Token (AIR) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CryptoLeu an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for EPPCOIN (EPP) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ohni_2 (OHNI) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for C3 Token (C3) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MicoinToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ELearningCoinERC an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for TheGoDigital an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for BSCToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for YSS an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MomentumToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for yasudem an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for GEMCHAIN (GEM) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for WangWangToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Cranoo (CRN) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for GalacticX an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for LandCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ETHERCASH (ETC) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Numisma an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for YESToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MehdiTAZIToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CryptosisToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for DoccoinPreICO an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CarToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ProvidenceCasino (PVE) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for UTBTokenTest an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CERB_Coin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for EXGROUP an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for HitToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for etktokens (ETK) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for rhovit an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CTESale an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Ubiou an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for RiptideCoin (RIPT) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Sample Token (STK) (Contract Name: cashBackMintable) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for YLCToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for RedTicket an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for GoramCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for SendMe an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for RichiumToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MediaCubeToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Super Carbon Coin (SCC) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for HELP an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Extreme Coin (XT) (Contract Name: ExtremeToken) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for NetkillerAdvancedTokenAirDrop an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for GSI an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ECToints (ECT) (Contract Name: ECPoints) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ISeeVoiceToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for SECoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CSAToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CryptoABS (ABS) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for T-Swap-Token (T-S-T) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for SLCAdvancedToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for JavaSwapTest (JST) an Ethereum token has an integer overflow.


The mintToken function of a smart contract implementation for ERC20_ICO an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CardFactory an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Bitpark an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for GoldTokenERC20 an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for HormitechToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Plaza Token (PLAZA) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MoneyTree (TREE) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for appcoins (APPC) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for naga an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for CDcurrency an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for RCKT_Coin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Crowdnext (CNX) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for TripCash an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ViteMoneyCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Co2Bit an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Coffeecoin (COFFEE) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ForeverCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Mindexcoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Goochain an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Tradesman an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for SIPCOIN an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for LoliCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Coinstar (CSTR) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for JeansToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Datiac an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Snoqualmie Coin (SNOW) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for EpiphanyCoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for South Park Token Token (SPTKN) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ESH an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Mimicoin an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for OneChain an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for WXSLToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Code47 (C47) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for YourCoin (ICO) (Contract Name: ETH033) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ICO Dollar (ICOD) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Betcash (BC) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for bankcoin (BNK) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Coquinho Coin (CQNC) (Contract Name: CoquinhoERC20) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Yu Gi Oh (YGO) (Contract Name: NetkillerBatchToken) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for Troo an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for MJCToken an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for ExacoreContract an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for RajTestICO an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


The mintToken function of a smart contract implementation for PolyAi (AI) an Ethereum token has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.


Integer overflow in Apple Safari allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type as demonstrated by a value of 65561 for TCP port 25.


Integer overflow in Linux kernel 2.6 allows local users to overwrite kernel memory by writing to a sysfs file.


Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.


Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.


Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a large value in the length argument a different vulnerability than CVE-2006-1991.


Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.


Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFS_IOC_CLONE_RANGE ioctl call.


Integer overflow in the in_nsv plugin in Winamp before 5.6 allows remote attackers to have an unspecified impact via vectors related to improper allocation of memory for NSV metadata a different vulnerability than CVE-2010-2586.


Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier as used in Poppler and other products when running on Mac OS X has unspecified impact related to \g*allocn.\


Integer overflow in the do_brk function for the brk system call in Linux kernel 2.4.22 and earlier allows local users to gain root privileges.


Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a date/time that is more than 34 years away from the server's time.


Integer overflow in the rnd arithmetic rounding function for various versions of FishCart before 3.1 allows remote attackers to \cause negative totals\ via an order with a large quantity.


Integer overflow in the ndn_parse_sequence function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors involving the typ and vallen variables.


Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections which triggers the issuance of a duplicate cookie value.


Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image related to integer multiplication for memory allocation.


Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file which triggers an assertion failure.


Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file which triggers use of an uninitialized value.


Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.


Integer overflow in the bhyve hypervisor in FreeBSD 10.1 10.2 10.3 and 11.0 when configured with a large amount of guest memory allows local users to gain privilege via a crafted device descriptor.


Integer overflow in the Region::unflatten function in libs/ui/Region.cpp in mediaserver in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows attackers to obtain sensitive information via a crafted application aka internal bug 29983260.


Integer overflow in the new operator in gcc before 4.8.0 allows attackers to have unspecified impacts.


Integer overflow in the Berkeley Fast File System (FFS) in FreeBSD 4.6.1 RELEASE-p4 and earlier allows local users to access arbitrary file contents within FFS to gain privileges by creating a file that is larger than allowed by the virtual memory system.


Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height.


Integer overflow in the COFF/EPOC/EXPLOAD input file loaders in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to memory allocation.


Integer overflow in the PSX/GEOS input file loaders in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to memory allocation.


Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter as demonstrated by a value that exceeds mt_getrandmax.


Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX which triggers the client to stop reading data and get out of sync.


SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.


The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.


An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

integer overflow
arbitrary code execution


An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.


An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.


An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.


An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

integer overflow vulnerability
denial of service
integer overflow


An integer overflow vulnerability was found in FFmpeg 5.0.1 and in previous versions in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file.


An integer overflow vulnerability exists in the function multiTransfer of Rocket Coin (XRC) an Ethereum token smart contract. An attacker could use it to set any user's balance.


An integer overflow vulnerability exists in the function transfer_tokens_after_ICO of GlobeCoin (GLB) an Ethereum token smart contract. An attacker could use it to set any user's balance.


An integer overflow vulnerability exists in the function batchTransfer of SHARKTECH (SKT) an Ethereum token smart contract. An attacker could use it to set any user's balance.


An integer overflow vulnerability exists in the function transferAny of Malaysia coins (Xmc) an Ethereum token smart contract. An attacker could use it to set any user's balance.


An integer overflow vulnerability exists in the function batchTransfer of WeMediaChain (WMC) an Ethereum token smart contract. An attacker could use it to set any user's balance.


An integer overflow vulnerability exists in the function distribute of MP3 Coin (MP3) an Ethereum token smart contract. An attacker could use it to set any user's balance.


An integer overflow vulnerability exists in the function multipleTransfer of Neo Genesis Token (NGT) an Ethereum token smart contract. An attacker could use it to set any user's balance.


An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2 resulting in heap buffer overflow.

integer overflow vulnerability
integer overflow
buffer overflow


WinRAR 3.40 and possibly earlier versions allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename possibly causing an integer overflow that leads to a buffer overflow.

integer overflow
buffer overflow
arbitrary code execution


An issue was discovered in Corel PaintShop Pro 2019 21.0.0.119. An integer overflow in the jp2 parsing library allows an attacker to overwrite memory and to execute arbitrary code.


An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.0.7. An integer overflow can occur while calculating the row's allocation size that could be exploited to corrupt memory and eventually execute arbitrary code. In order to trigger this vulnerability a victim would need to open a specially crafted XCF file.


An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.


An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.


An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools version 1.0.7. An integer overflow can occur while walking through tiles that could be exploited to corrupt memory and execute arbitrary code. In order to trigger this vulnerability a victim would need to open a specially crafted XCF file.


Integer overflow in the drawLineLoop function in the libGLESv2 library in Almost Native Graphics Layer Engine (ANGLE) as used in Mozilla Firefox before 24.0 and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via a crafted web site.


Integer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X before 10.3.183.68 and 11.x before 11.2.202.275 on Linux before 11.1.111.44 on Android 2.x and 3.x and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in IBM Notes 8.5.x before 8.5.3 FP4 Interim Fix 1 and 9.x before 9.0 Interim Fix 1 on Windows and 8.5.x before 8.5.3 FP5 and 9.x before 9.0.1 on Linux allows remote attackers to execute arbitrary code via a malformed PNG image in a previewed e-mail message aka SPR NPEI96K82Q.


Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X before 10.3.183.75 and 11.x before 11.2.202.280 on Linux before 11.1.111.50 on Android 2.x and 3.x and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.


The DSA_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT does not properly allocate memory which allows remote attackers to execute arbitrary code via a crafted value in an argument to an ASP.NET web application aka \Comctl32 Integer Overflow Vulnerability.\


Integer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X before 11.2.202.297 on Linux before 11.1.111.64 on Android 2.x and 3.x and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via PCM data that is not properly handled during resampling.


GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file associated with the -E option is untrusted data.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Parallels Tools component. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel on the target guest system. Was ZDI-CAN-12790.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Parallels Tools component. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel on the target guest system. Was ZDI-CAN-12791.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-11924.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12021.


Integer overflow in Cisco IOS allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Integer overflow in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allows remote attackers to execute arbitrary code via a long username and a certain \useless\ password.


Integer overflow in libexif 0.6.16 and earlier allows context-dependent attackers to execute arbitrary code via an image with crafted EXIF tags possibly involving the exif_data_load_data_thumbnail function in exif-data.c.


Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.


Multiple integer overflows in the Edge server in Adobe Flash Media Server 2 before 2.0.5 and Connect Enterprise Server 6 before SP3 allow remote attackers to execute arbitrary code via a Real Time Message Protocol (RTMP) message with a crafted integer field that is used for allocation.


Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file related to improper calculations for memory allocation.


Integer overflow in the \file\ program 4.20 when running on 32-bit systems as used in products including The Sleuth Kit might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.


Integer overflow in the _ncp32._NtrpTCPReceiveMsg function in rds.exe in the Cell Manager Database Service in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via a large value in the size parameter.


** DISPUTED ** Integer overflow in the process_envvars function in elf/rtld.c in glibc before 2.5-rc4 might allow local users to execute arbitrary code via a large LD_HWCAP_MASK environment variable value. NOTE: the glibc maintainers state that they do not believe that this issue is exploitable for code execution.


Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet related to an unchecked return value.


Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file related to an \input validation error \ including a signed comparison of values that are assumed to be non-negative.


Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a ZIP archive that contains an entry with a length value of 0xffffffff which is incremented before use in an emalloc call triggering a heap overflow.


Multiple integer overflows in ImageMagick before 6.3.3-5 allow remote attackers to execute arbitrary code via (1) a crafted DCM image which results in a heap-based overflow in the ReadDCMImage function or (2) the (a) colors or (b) comments field in a crafted XWD image which results in a heap-based overflow in the ReadXWDImage function different issues than CVE-2007-1667.


Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function which triggers the overflow in the ZVAL reference counter.


Integer overflow in the str_replace function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via a single character search string in conjunction with a long replacement string which overflows a 32 bit length counter. NOTE: this is probably the same issue as CVE-2007-0906.6.


Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.


Integer overflow in the _NtSetValueKey function in klif.sys in Kaspersky Anti-Virus Anti-Virus for Workstations Anti-Virus for File Server 6.0 and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows context-dependent attackers to execute arbitrary code via a large unsigned \data size argument \ which results in a heap overflow.


Integer overflow in launchd in Apple iOS before 7.1.2 Apple OS X before 10.9.4 and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.


Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux Adobe AIR before 15.0.0.293 Adobe AIR SDK before 15.0.0.302 and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14 1.1.x before 1.1.12 1.2.x before 1.2.7 2.0.x before 2.0.5 2.1.x before 2.1.5 and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.


Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted API arguments.


Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21 5.0 Update 25 1.4.2_27 and 1.3.1_28 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile.


Integer overflow in the PICT image converter in the graphics filters in Microsoft Office XP SP3 Office 2003 SP3 and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted PICT image in an Office document aka \PICT Image Converter Integer Overflow Vulnerability.\


Multiple integer overflows in the ParseKnownType function in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows allow remote attackers to execute arbitrary code via crafted (1) HX_FLV_META_AMF_TYPE_MIXEDARRAY or (2) HX_FLV_META_AMF_TYPE_ARRAY data in an FLV file.


Integer overflow in an array class in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1 and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code by placing many Cascading Style Sheets (CSS) values in an array related to references to external font resources and an inconsistency between 16-bit and 32-bit integers.


Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3 and Acrobat 9.3.3 allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table.


Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1 and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element which triggers a use-after-free.


Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold SP1 and SP2; Windows Server 2008 Gold SP2 and R2; and Windows 7 allows remote attackers to execute arbitrary code via compressed data that represents a crafted EOT font aka \Microtype Express Compressed Fonts Integer Flaw in the LZCOMP Decompressor Vulnerability.\


Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18 5.0 Update 23 and 1.4.2_25 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the Java Runtime Environment that allows remote attackers to execute arbitrary code via a JPEG image that contains subsample dimensions with large values related to JPEGImageReader and \stepX\.


Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows remote attackers to execute arbitrary code via a crafted table in an embedded font aka \Embedded OpenType Font Integer Overflow Vulnerability.\


Integer overflow in the AgentX::receive_agentx function in AgentX++ 1.4.16 as used in RealNetworks Helix Server and Helix Mobile Server 11.x through 13.x and other products allows remote attackers to execute arbitrary code via a request with a crafted payload length.


Integer overflow in Opera 10.10 through 10.50 allows remote attackers to execute arbitrary code via a large Content-Length value which triggers a heap overflow.


Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4 Thunderbird before 3.0.5 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node.


Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7 and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via plugin content with many parameter elements.


Integer overflow in the pnen3260.dll module in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.1 Mac RealPlayer 11.0 through 11.1 and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a crafted TIT2 atom in an AAC file.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 1.1.4 Build 20211022 rel.59103(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko module. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15835.


Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1 .NET Framework 2.0 SP1 and SP2 Windows XP SP2 and SP3 Windows Server 2003 SP2 Vista Gold and SP1 Server 2008 Gold Office XP SP3 Office 2003 SP3 2007 Microsoft Office System SP1 and SP2 Office Project 2002 SP1 Visio 2002 SP2 Office Word Viewer Word Viewer 2003 Gold and SP3 Office Excel Viewer 2003 Gold and SP3 Office Excel Viewer Office PowerPoint Viewer 2007 Gold SP1 and SP2 Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 Expression Web Expression Web 2 Groove 2007 Gold and SP1 Works 8.5 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 and SP3 Report Viewer 2005 SP1 Report Viewer 2008 Gold and SP1 and Forefront Client Security 1.0 allow remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka \GDI+ .NET API Vulnerability.\


Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Office XP SP3 Office 2003 SP3 2007 Microsoft Office System SP1 and SP2 Office Project 2002 SP1 Visio 2002 SP2 Office Word Viewer Word Viewer 2003 Gold and SP3 Office Excel Viewer 2003 Gold and SP3 Office Excel Viewer Office PowerPoint Viewer 2007 Gold SP1 and SP2 Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 Expression Web Expression Web 2 Groove 2007 Gold and SP1 Works 8.5 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 and SP3 Report Viewer 2005 SP1 Report Viewer 2008 Gold and SP1 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted WMF image file aka \GDI+ WMF Integer Overflow Vulnerability.\


Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Office XP SP3 Office 2003 SP3 2007 Microsoft Office System SP1 and SP2 Office Project 2002 SP1 Visio 2002 SP2 Office Word Viewer Word Viewer 2003 Gold and SP3 Office Excel Viewer 2003 Gold and SP3 Office Excel Viewer Office PowerPoint Viewer 2007 Gold SP1 and SP2 Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP1 and SP2 Expression Web Expression Web 2 Groove 2007 Gold and SP1 Works 8.5 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 and SP3 Report Viewer 2005 SP1 Report Viewer 2008 Gold and SP1 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted PNG image file aka \GDI+ PNG Integer Overflow Vulnerability.\


Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier and 6 Update 12 and earlier allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.


Integer overflow in Roxio Easy Media Creator 9.0.136 and Roxio Creator 2010 before SP1 might allow remote attackers to execute arbitrary code via an image with crafted dimensions.


Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.


Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table aka \Embedded OpenType Font Integer Overflow Vulnerability.\


Integer overflow in the xdrmem_getbytes() function and possibly other functions of XDR (external data representation) libraries derived from SunRPC including libnsl libc glibc and dietlibc allows remote attackers to execute arbitrary code via certain integer values in length fields a different vulnerability than CVE-2002-0391.


Integer overflow in parse_decode_path() of slocate may allow attackers to execute arbitrary code via a LOCATE_PATH with a large number of \:\ (colon) characters whose count is used in a call to malloc.


Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL) as used in LSASS.EXE CRYPT32.DLL and other Microsoft executables and libraries on Windows NT 4.0 2000 and XP allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten or (2) modified bit strings.


Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27 2.6.x up to 2.6.7 and possibly later versions allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.


Integer overflow in DUNZIP32.DLL for Microsoft Windows XP Windows XP 64-bit Edition Windows Server 2003 and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an \unchecked buffer\ and improper length validation.


Multiple integer overflows in (1) the xpmParseColors function in parse.c (2) XpmCreateImageFromXpmImage (3) CreateXImage (4) ParsePixels and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.


Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within pdf.xmd. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4361.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5101.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x10A in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5102.


Integer

overflow

in

the

mozilla::layers::BufferTextureClient::AllocateForSurface

function

in

Mozilla

Firefox

before

and

Firefox

ESR

before

allows

remote

attackers

to

execute

arbitrary

code

by

triggering

a

graphics

operation

that

requires

a

large

texture

allocation.


Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5097 and CVE-2015-5109.


Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5097 and CVE-2015-5108.


Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux Adobe AIR before 18.0.0.199 Adobe AIR SDK before 18.0.0.199 and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors.


An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or potentially execute arbitrary code.


Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2015-5108 and CVE-2015-5109.


Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted application.


Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication aka internal bug 20139950 a related issue to CVE-2015-4496.


Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux Adobe AIR before 17.0.0.172 Adobe AIR SDK before 17.0.0.172 and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to execute arbitrary code via unspecified vectors.


Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation aka internal bug 22802399.


Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Windows Journal in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file aka \Windows Journal Integer Overflow RCE Vulnerability.\


Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux Adobe AIR before 20.0.0.233 Adobe AIR SDK before 20.0.0.233 and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in the Shader filter implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux Adobe AIR before 20.0.0.204 Adobe AIR SDK before 20.0.0.204 and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a large BitmapData source object.


Integer overflow in player.c in libwmf 0.2.8.4 as used in multiple products including (1) wv (2) abiword (3) freetype (4) gimp (5) libgsf and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.


Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange (b) cidrange and (c) notdefrange sections.


Integer overflow in Microsoft Word 2000 2002 2003 2004 for Mac and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string in a Word document which overflows a 16-bit integer length value aka \Memmove Code Execution \ a different vulnerability than CVE-2006-3651 and CVE-2006-4693.


Integer overflow in Opera 8.54 and earlier allows remote attackers to execute arbitrary code via a JPEG image with large height and width values which causes less memory to be allocated than intended.


Multiple integer overflows in the Javascript engine in Mozilla Firefox before 1.5.0.5 Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving (1) long strings in the toSource method of the Object Array and String objects; and (2) unspecified \string function arguments.\


Integer overflow in wv2 before 0.2.3 might allow context-dependent attackers to execute arbitrary code via a crafted Microsoft Word document.


Multiple integer overflows in the DPRPC library (DPRPCNLM.NLM) NDPS/iPrint module in Novell Distributed Print Services in Novell NetWare 6.5 SP3 SP4 and SP5 allow remote attackers to execute arbitrary code via an XDR encoded array with a field that specifies a large number of elements which triggers the overflows in the ndps_xdr_array function.


Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE while scanning for wireless networks allows remote attackers to execute arbitrary code by broadcasting crafted (1) beacon or (2) probe response frames.


Multiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field which causes an overflow in the ReadBuffer function in (a) BTPacket.cpp and (b) EDPacket.cpp or (2) a large packet which causes a heap-based overflow in the Write function in (c) Packet.h.


Multiple integer overflows in (1) the new_demux_packet function in demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in MPlayer 1.0pre7try2 and earlier allow remote attackers to execute arbitrary code via an ASF file with a large packet length value. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.


Multiple integer overflows in Mozilla Firefox 1.5 Thunderbird 1.5 if Javascript is enabled in mail and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X (2) nsSVGCairoSurface::Init in SVG and (3) nsCanvasRenderingContext2D.cpp in Canvas.


Integer overflow in the AAC file parsing code in Apple iTunes before 6.0.5 on Mac OS X 10.2.8 or later and Windows XP and 2000 allows remote user-assisted attackers to execute arbitrary code via an AAC (M4P M4A or M4B) file with a sample table size (STSZ) atom with a \malformed\ sample_size_table value.


Integer overflow in CFNetwork in Apple Mac OS X 10.4.6 allows remote attackers to execute arbitrary code via crafted chunked transfer encoding.


Integer overflow in Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted MacMIME encapsulated attachment.


Multiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3 as used by AbiWord KWord and possibly other products allow user-assisted remote attackers to execute arbitrary code via a crafted Microsoft Word (DOC) file that produces (1) large LFO clfolvl values in the wvGetLFO_records function or (2) a large LFO nolfo value in the wvGetFLO_PLF function.


Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).


Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive which triggers \improper restrictions of operations within the bounds of a memory buffer\ and an information leak.


Integer overflow in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors.


Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types a different vulnerability than CVE-2012-0685.


Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types a different vulnerability than CVE-2012-0684.


The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8 as used by OpenOffice.org (OOo) before 3.4 allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow.


Integer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x and Adobe AIR before 3.3.0.3610 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X before 10.3.183.23 and 11.x before 11.2.202.238 on Linux before 11.1.111.16 on Android 2.x and 3.x and before 11.1.115.17 on Android 4.x; Adobe AIR before 3.4.0.2540; and Adobe AIR SDK before 3.4.0.2540 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X before 10.3.183.48 and 11.x before 11.2.202.258 on Linux before 11.1.111.29 on Android 2.x and 3.x and before 11.1.115.34 on Android 4.x; Adobe AIR before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X; and Adobe AIR SDK before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X allows attackers to execute arbitrary code via unspecified vectors.


In versions of mruby up to and including 1.4.0 an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF Phantom PDF 9.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PDF documents. When parsing shading patterns the process does not properly validate user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6223.


An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.


Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page.


An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG files within CovertToPDF. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9102.


An integer overflow was addressed through improved input validation. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of user-supplied data which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9768.


Integer overflow in Adobe Reader and Acrobat before 11.0.18 Acrobat and Acrobat Reader DC Classic before 15.006.30243 and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Reader and Acrobat before 11.0.17 Acrobat and Acrobat Reader DC Classic before 15.006.30198 and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image which triggers an out-of-bounds heap memory write operation.


Integer overflow in Adobe Reader and Acrobat before 11.0.16 Acrobat and Acrobat Reader DC Classic before 15.006.30172 and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0963 and CVE-2016-0993.


Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0963 and CVE-2016-1010.


Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux Adobe AIR before 21.0.0.176 Adobe AIR SDK before 21.0.0.176 and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-0993 and CVE-2016-1010.


Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56 and possibly earlier versions allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.


Integer overflow in mlterm 2.5.0 through 2.9.1 with gdk-pixbuf support enabled allows remote attackers to execute arbitrary code via a large image file that is used as a background.


Multiple vulnerabilities in xli before 1.17 may allow remote attackers to execute arbitrary code via \buffer management errors\ from certain image properties some of which may be related to integer overflows in PPM files.


Integer overflow in xdr_array function in RPC servers for operating systems that use libc glibc or other code based on SunRPC including dietlibc allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.


Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.


Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via (1) the CUPSd HTTP interface as demonstrated by vanilla-coke and (2) the image handling code in CUPS filters as demonstrated by mksun.


Integer overflow in pdftops as used in Xpdf 2.01 and earlier xpdf-i and CUPS before 1.1.18 allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements as demonstrated by cups-pdf.


Integer overflow in the REPT function in Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 and SP3 and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; Office SharePoint Server 2007 Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file containing a formula within a cell aka \Formula Parsing Vulnerability.\


Integer signedness error in the ip_set_srcfilter function in the IP Multicast Filter in uts/common/inet/ip/ip_multi.c in the kernel in Sun Solaris 10 and OpenSolaris before snv_92 allows local users to execute arbitrary code in other Solaris Zones via an SIOCSIPMSFILTER IOCTL request with a large value of the imsf->imsf_numsrc field which triggers an out-of-bounds write of kernel memory. NOTE: this was reported as an integer overflow but the root cause involves the bypass of a signed comparison.


Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value a different vulnerability than CVE-2008-2955.


The excel_read_HLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing XLS HLINK opcodes possibly because of an integer signedness error that leads to an integer overflow. NOTE: some of these details are obtained from third party information.


Integer overflow in CoreFoundation in Apple Mac OS X 10.4.11 might allow local users to execute arbitrary code via crafted time zone data.


Multiple integer overflows in libc in NetBSD 4.x FreeBSD 6.x and 7.x and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c related to the GET_NUMBER macro; and (2) the printf function related to left_prec and right_prec.


Integer overflow in pdftops filter in CUPS in Red Hat Enterprise Linux 3 and 4 when running on 64-bit platforms allows remote attackers to execute arbitrary code via a crafted PDF file. NOTE: this issue is due to an incomplete fix for CVE-2004-0888.


Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file which triggers a heap overflow.


Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker aka \Integer Overflow in IPP Service Vulnerability.\


Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP parameter. NOTE: this issue has been referred to as an integer overflow.


Integer overflow in Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allows local users to execute arbitrary code via a crafted IOCTL request.


Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2138 and CVE-2011-2416.


Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1 Thunderbird before 3.1.11 and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via vectors involving a long JavaScript Array object.


Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2136 and CVE-2011-2138.


Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code by sending a sequence of crafted UDP packets to a closed port aka \Reference Counter Overflow Vulnerability.\


Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows Mac OS X Linux and Solaris and before 10.3.186.3 on Android and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2011-2136 and CVE-2011-2416.


Integer overflow in WebKit as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246 in Google Chrome before 10.0.648.133 and in Apple Safari before 5.0.5 allows remote attackers to execute arbitrary code via unknown vectors related to CSS \style handling \ nodesets and a length value as demonstrated by Vincenzo Iozzo Willem Pinckaers and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.


Integer overflow in gdiplus.dll in GDI+ in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold and SP2 and Office XP SP3 allows remote attackers to execute arbitrary code via a crafted EMF image aka \GDI+ Integer Overflow Vulnerability.\


Integer overflow in ACE.dll in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to execute arbitrary code via crafted ICC data a different vulnerability than CVE-2011-0596 CVE-2011-0599 and CVE-2011-0602.


Multiple integer overflows in libext2fs in e2fsprogs before 1.40.3 allow user-assisted remote attackers to execute arbitrary code via a crafted filesystem image.


Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code as demonstrated using a crafted PNG image with large width and height values which is not properly handled by the read_png function.


Multiple integer overflows in factory.cc in Google V8 before r3560 as used in Google Chrome before 4.0.249.89 allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.


Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file related to the getPNG function in lib/png.c; or (2) a crafted JPEG file related to the jpeg_load function in lib/jpeg.c.


Multiple integer overflows in Skia as used in Google Chrome 1.x before 1.0.154.64 and 2.x and possibly Android might allow remote attackers to execute arbitrary code in the renderer process via a crafted (1) image or (2) canvas.


Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c (2) sfnt/ttcmap.c and (3) cff/cffload.c.


Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.


Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file a related issue to CVE-2015-1538.


Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.


Multiple integer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime H.264 (M4V) video format file.


Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM (2) PNM (3) PSD (4) PSP (5) Sun RAS (6) XBM and (7) XWD files.


Multiple integer overflows in the kernel in Apple iOS before 9.3 OS X before 10.11.4 tvOS before 9.2 and watchOS before 2.2 allow attackers to execute arbitrary code in a privileged context via a crafted app.


Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.


Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.


Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.


Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player probably 0.9.4 might allow remote attackers to execute arbitrary code via a crafted .ty file a different vulnerability than CVE-2008-4654.


Multiple integer overflows in a \legacy serialization format\ parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list.


Multiple integer overflows in Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.


Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attackers to execute arbitrary code via a crafted web page aka \Scripting Memory Reallocation Vulnerability.\


Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0609.


Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0613.


Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5 10.x before 10.1.7 and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-2729.


Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5 10.x before 10.1.7 and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-2727.


Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-3357.


Integer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-3358.


Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2010-2170 and CVE-2010-2181.


Integer overflow in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2010-2170 and CVE-2010-2183.


Integer overflow in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64 and Adobe AIR before 2.0.2.12610 might allow attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2010-2181 and CVE-2010-2183.


Integer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via a crafted .dir (aka Director) file.


Integer overflow in Adobe Acrobat 9.x before 9.2 8.x before 8.1.7 and possibly 7.x through 7.1.4 might allow attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code via a crafted TrueType font.


Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Flash Player before 10.2.152.26 allows attackers to execute arbitrary code via a large array length value in the ActionScript method of the Function class.


Integer overflow in Adobe Flash Player before 10.3.181.14 on Windows Mac OS X Linux and Solaris and before 10.3.185.21 on Android allows remote attackers to execute arbitrary code via ActionScript that improperly handles a long array object.


Integer overflow in Adobe Flash Player before 10.3.181.14 on Windows Mac OS X Linux and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Adobe Reader 9.x before 9.4.6 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Integer overflow in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote user-assisted attackers to execute arbitrary code via a crafted AppleSingleEncoding disk image.


Integer overflow in Apple QuickTime Player 7.0.3 and 7.0.4 and iTunes 6.0.1 and 6.0.2 allows remote attackers to execute arbitrary code via a FlashPix (FPX) image that contains a field that specifies a large number of blocks.


Integer overflow in Apple QuickTime Player before 7.1 allows remote attackers to execute arbitrary code via a crafted JPEG image.


Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie a different issue than CVE-2006-4381.


Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie.


Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted FlashPix file.


Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified image height and width (ImageWidth) tags.


Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via crafted TGA image files.


Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified (1) \strips\ (StripByteCounts) or (2) \bands\ (StripOffsets) values.


Integer overflow in Apple QuickTime before 7.0.3 allows user-assisted attackers to execute arbitrary code via a crafted MOV file that causes a sign extension of the length element in a Pascal style string.


Integer overflow in Apple QuickTime before 7.0.3 allows user-assisted attackers to execute arbitrary code via a crafted MOV file with \Improper movie attributes.\


Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper allocation-size calculation aka \Publisher Integer Overflow Vulnerability.\


Integer overflow in Microsoft Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel document with crafted record information aka \Excel Record Parsing Integer Overflow Vulnerability.\