Buffer overflow in eEye Retina WiFi Scanner 1.0.8.68 as used in Retina Network Security Scanner 5.10.14 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a .rws file with a long RWS010 entry.


Buffer overflow in the FTP service on the Tandberg MXP F7.0 allows remote attackers to cause a denial of service (process crash or device reboot) or possibly execute arbitrary code via a long USER command as demonstrated by a command ending with many space characters.

denial of service
buffer overflow
arbitrary code execution


Heap-based buffer overflow in the exif_entry_fix function (aka the tag fixup routine) in libexif/exif-entry.c in libexif 0.6.18 allows remote attackers to cause a denial of service or possibly execute arbitrary code via an invalid EXIF image. NOTE: some of these details are obtained from third party information.


Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1 and process_query_section in query.c in nsd 2.3.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a buffer overflow.


Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18 and Adobe AIR before 1.5.2 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving URL parsing.


Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19 as used in Winamp 5.552 and possibly other media programs allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.


Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent) 3.3.2 and probably earlier and CTorrent 1.3.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Torrent file containing a long path.


Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 when used with SNMP (aka HPOvNNM.HPOVSNMP) before 1.30.009 and MIB (aka HPOvNNM.HPOVMIB) before 1.30.009 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.


Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19 as used in Winamp 5.552 and possibly other media programs allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.


Stack-based buffer overflow in the URL Search Hook (ICQToolBar.dll) in ICQ 6.5 allows remote attackers to cause a denial of service (persistent crash) and possibly execute arbitrary code via an Internet shortcut .URL file containing a long URL parameter which triggers a crash when browsing a folder that contains this file.


Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request related to use of XDR arrays.


Stack-based buffer overflow in Image RAW in Apple Mac OS X 10.5 before 10.5.8 and 10.4 before Digital Camera RAW Compatibility Update 2.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image.


Buffer overflow in the Web GUI in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 through 5.1.8.2 5.2.0.0 through 5.2.5.3 5.3.0.0 through 5.3.6.4 5.4.0.0 through 5.4.2.6 and 5.5.0.0 through 5.5.1.17 allows attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors.


** DISPUTED ** NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) Authorization or (2) Referer HTTP header to TCP port 18624. NOTE: the vendor has disputed this issue stating \Check Point Security Alert Team has analyzed this report. We've tried to reproduce the attack on all VPN-1 versions from NG FP2 and above with and without HFAs. The issue was not reproduced. We have conducted a thorough analysis of the relevant code and verified that we are secure against this attack. We consider this attack to pose no risk to Check Point customers.\ In addition the original researcher whose reliability is unknown as of 20090407 also states that the issue \was discovered during a pen-test where the client would not allow further analysis.\


Heap-based buffer overflow in the ParamTraits<SkBitmap>::Read function in Google Chrome before 1.0.154.64 allows attackers to leverage renderer access to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to a large bitmap that arrives over the IPC channel.


Integer underflow in QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 and Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a crafted 0x77 Poly tag and a crafted length field which triggers a heap-based buffer overflow.


Integer underflow in CoreGraphics in Apple Mac OS X 10.5 before 10.5.7 iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file that triggers a heap-based buffer overflow.


Buffer overflow in the client in IBM Tivoli Storage Manager (TSM) HSM 5.3.2.0 through 5.3.5.0 5.4.0.0 through 5.4.2.5 and 5.5.0.0 through 5.5.1.4 on Windows allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.


Stack-based buffer overflow in the DtbClsLogin function in NovaStor NovaNET 12 allows remote attackers to (1) execute arbitrary code on Linux platforms via a long username field during backup domain authentication related to libnnlindtb.so; or (2) cause a denial of service (daemon crash) on Windows platforms via a long username field during backup domain authentication related to nnwindtb.dll. NOTE: some of these details are obtained from third party information.


Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2 NetBSD 5.0 OpenBSD 4.5 Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 K-Meleon 1.5.3 SeaMonkey 1.1.8 and other products allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.


Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a QuickTime movie file containing invalid image width data in JPEG atoms within STSD atoms.


Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string.


Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.


Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier and possibly 5.02 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a STATS line with a long pwd field. NOTE: some of these details are obtained from third party information.


Integer signedness error in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a Cinepak encoded movie file with a crafted MDAT atom that triggers a heap-based buffer overflow.


Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10 10.1 11.0 and 11.0.1; Linux RealPlayer 10 11.0.0 and 11.0.1; and Helix Player 10.x 11.0.0 and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules related to an \array overflow.\


Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5 and 5.x including 5.1.4.3.1 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a playlist file (.pls) containing a long string. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta 3.0.0.5 and earlier in AwingSoft Awakening Web3D Player and Winds3D Viewer allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long SceneUrl property value a different vulnerability than CVE-2009-2386. NOTE: some of these details are obtained from third party information.


Buffer overflow in BrotherSoft BMXPlay 0.4.4b allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .BMX file.


Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit 20091125231942 as used in SumatraPDF before 1.0.1 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a /Decode array for certain types of shading that are not properly handled by the (1) pdf_loadtype4shade (2) pdf_loadtype5shade (3) pdf_loadtype6shade and (4) pdf_loadtype7shade functions. NOTE: some of these details are obtained from third party information.


Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets.


FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers leading to processing of a video-structure pointer by the mp3 decoder and a stack-based buffer overflow.


Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code cause a denial of service via a crafted USB device or take full control of the system.


Buffer overflow in Robo-FTP 3.6.17 and possibly other versions allows remote FTP servers to cause a denial of service and possibly execute arbitrary code via unspecified FTP server responses. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8 when allow::options::noident is enabled allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


Buffer

overflow

in

the

RTSPProtocol::HandleSetParameterRequest

function

in

in

RealNetworks

RealPlayer

RealPlayer

through

RealPlayer

through

RealPlayer

Enterprise

Mac

RealPlayer

and

Linux

RealPlayer

and

Helix

Player

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

or

possibly

execute

arbitrary

code

via

a

crafted

RTSP

request.


Stack-based buffer overflow in BrotherSoft EW-MusicPlayer 0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a malformed playlist (.m3u) file. NOTE: some of these details are obtained from third party information.


vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that modifies a loop counter and triggers a heap-based buffer overflow.


Stack-based buffer overflow in converter/ppm/xpmtoppm.c in netpbm before 10.47.07 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an XPM image file that contains a crafted header field associated with a large color index value.


Heap-based buffer overflow in RealNetworks RealPlayer 10 RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741 RealPlayer 11 11.0.0 through 11.0.4 RealPlayer Enterprise Mac RealPlayer 10 and 10.1 Linux RealPlayer 10 and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file related to gifcodec.cpp and gifimage.cpp.


Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file as originally reported for debug logging code in gdevcups.c in the CUPS output driver.


Buffer overflow in Tuniac 090517c allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long URL in a .m3u playlist file.


Buffer overflow in the \create torrent dialog\ functionality in uTorrent 1.8.3 build 15772 and possibly other versions before 1.8.3 (Build 16010) allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a text file containing a large string. NOTE: some of these details are obtained from third party information.


Multiple buffer overflows in Novell iChain 2.1 before Field Patch 3 and iChain 2.2 before Field Patch 1a allow attackers to cause a denial of service (ABEND) and possibly execute arbitrary code via (1) a long user name or (2) an unknown attack related to a \special script against login.\


Stack-based buffer overflow in Active Directory in Windows 2000 before SP4 allows remote attackers to cause a denial of service (reboot) and possibly execute arbitrary code via an LDAP version 3 search request with a large number of (1) \AND \ (2) \OR \ and possibly other statements which causes LSASS.EXE to crash.


Multiple buffer overflows in SLWebMail 3 on Windows systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a long Language parameter to showlogin.dll (2) a long CompanyID parameter to recman.dll (3) a long CompanyID parameter to admin.dll or (4) a long CompanyID parameter to globallogin.dll.


Buffer overflow in BRS WebWeaver 1.04 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP (1) POST or (2) HEAD request.


Buffer overflow in Pi3Web 2.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a GET request with a large number of / characters.


Multiple buffer overflows in Lotus Domino Web Server before 6.0.1 allow remote attackers to cause a denial of service or execute arbitrary code via (1) the s_ViewName option in the PresetFields parameter for iNotes (2) the Foldername option in the PresetFields parameter for iNotes or (3) a long Host header which is inserted into a long Location header and used during a redirect operation.


Multiple buffer overflows in Hypermail 2 before 2.1.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code (1) via a long attachment filename that is not properly handled by the hypermail executable or (2) by connecting to the mail CGI program from an IP address that reverse-resolves to a long hostname.


Multiple buffer overflows in ircII 20020912 allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via responses that are not properly fed to the my_strcat function by (1) ctcp_buffer (2) cannot_join_channel (3) status_make_printable for Statusbar drawing (4) create_server_list and possibly other functions.


The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types which can cause a length check to be disabled when Sendmail misinterprets an input value as a special \NOCHAR\ control value allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages a different vulnerability than CVE-2002-1337.


Buffer overflow in Ethereal 0.9.15 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed GTP MSISDN string.


Buffer overflow in Prishtina FTP client 1.x allows remote FTP servers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP banner.


Multiple buffer overflows in Kerio MailServer 5.6.3 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a long showuser parameter in the do_subscribe module (2) a long folder parameter in the add_acl module (3) a long folder parameter in the list module and (4) a long user parameter in the do_map module.


Buffer overflow in atftp daemon (atftpd) 0.6.1 and earlier and possibly later versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename.


The OSI dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via invalid IPv4 or IPv6 prefix lengths possibly triggering a buffer overflow.


Buffer overflow in Mutt 1.4.0 and possibly earlier versions 1.5.x up to 1.5.3 and other programs that use Mutt code such as Balsa before 2.0.10 allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.


The getgrouplist function in GNU libc (glibc) 2.2.4 and earlier allows attackers to cause a denial of service (segmentation fault) and execute arbitrary code when a user is a member of a large number of groups which can cause a buffer overflow.


Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier and Balsa 1.2.4 and earlier allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder a different vulnerability than CVE-2003-0140.


Buffer overflows in EPIC IRC Client (EPIC4) 1.0.1 allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via long replies that are not properly handled by the (1) userhost_cmd_returned function or (2) Statusbar capability.


Snowblind Web Server 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP request which may trigger a buffer overflow.


The try_uudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malicious uuencoded (UUE) header possibly triggering a heap-based buffer overflow.


Multiple buffer overflows in libnasl in Nessus before 2.0.6 allow local users with plugin upload privileges to cause a denial of service (core dump) and possibly execute arbitrary code via (1) a long proto argument to the scanner_add_port function (2) a long user argument to the ftp_log_in function (3) a long pass argument to the ftp_log_in function.


OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c which leads to a stack-based buffer overflow.


Cistron RADIUS daemon (radiusd-cistron) 1.6.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large value in an NAS-Port attribute which is interpreted as a negative number and causes a buffer overflow.


Buffer overflow in Eudora 5.2.1 allows remote attackers to cause a denial of service (crash and failed restart) and possibly execute arbitrary code via an Attachment Converted argument with a large number of . (dot) characters.


Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via cut-and-paste operation as demonstrated in Internet Explorer 5.0 using a long \align\ argument in an HR tag.


Buffer overflow in RogerWilco graphical server 1.4.1.6 and earlier dedicated server 0.32a and earlier for Windows and 0.27 and earlier for Linux and BSD allows remote attackers to cause a denial of service and execute arbitrary code via a client request with a large length value.


Buffer overflows in noffle news server 1.0.1 and earlier allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code.


Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.


Multiple buffer overflows in BitchX IRC client 1.0-0c19 and earlier allow remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via long hostnames nicknames or channel names which are not properly handled by the functions (1) send_ctcp (2) cannot_join_channel (3) cluster (4) BX_compress_modes (5) handle_oper_vision and (6) ban_it.


Buffer overflow in Gupta SQLBase 8.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long EXECUTE command.


Buffer overflow in CuteFTP 4.2 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.


Buffer overflow in Avant Browser 8.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.


Stack-based buffer overflow in eZnet.exe as used in eZ (a) eZphotoshare (b) eZmeeting (c) eZnetwork and (d) eZshare allows remote attackers to cause a denial of service (crash) or execute arbitrary code as demonstrated via (1) a long GET request and (2) a long operation or autologin parameter to SwEzModule.dll.


Buffer overflow in IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a CREATE command with a long mailbox name.


Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) AUTH command to the POP3 server or (2) AUTHENTICATE command to the IMAP server.


Buffer overflow in 3D-FTP client 4.0 allows remote FTP servers to cause a denial of service (crash) and possibly execute arbitrary code via a long banner.


Buffer overflow in BRS WebWeaver 1.06 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with a long User-Agent header.


Buffer overflow in ByteCatcher FTP client 1.04b allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.


Buffer overflow in the prepare_reply function in request.c for Mathopd 1.2 through 1.5b13 and possibly earlier versions allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via an HTTP request with a long path.


Buffer overflow in RealSystem Server 6.x 7.x and 8.x and RealSystem Proxy 8.x related to URL error handling allows remote attackers to cause a denial of service and possibly execute arbitrary code.


Buffer overflow in the imap_fetch_overview function in the IMAP functionality (php_imap.c) in PHP before 4.3.3 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long e-mail address in a (1) To or (2) From header.


Buffer overflow in KaZaA Media Desktop 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a response to the ad server.


Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function.


Multiple buffer overflows in Gyach Enhanced (Gyach-E) before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1) sending certain typing statuses or (2) setting the chat room status bar to the current chat room name.


Buffer overflow in command-packet processing of Quake II server before R1Q2 as used in multiple products allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a packet with a long cmd_args buffer.


ActivePerl 5.8.x and others and Larry Wall's Perl 5.6.1 and others when running on Windows systems allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to the system command which leads to a stack-based buffer overflow. NOTE: it is unclear whether this bug is in Perl or the OS API that is used by Perl.


Buffer overflow in Mollensoft Lightweight FTP Server 3.6 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long CWD command as demonstrated in one example by using the \cd\ command in an interactive FTP client.


Buffer overflow in postfile.exe for Twilight Utilities Web Server 2.0.0.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL request with a long attfile attribute.


Buffer overflow in pop3.c in gnubiff before 2.0.0 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code.


Buffer overflow in vsybase.c in vpopmail 5.4.2 and earlier might allow attackers to cause a denial of service or execute arbitrary code.


Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long RSYNC_PROXY environment variable. NOTE: since rsync is not setuid this issue does not provide any additional privileges beyond those that are already available to the user. Therefore this issue may be REJECTED in the future.


Buffer overflow in ADA Image Server (ImgSvr) 0.4 allows remote attackers to cause a denial of service (web server crash) or execute arbitrary code via a long GET request.


Multiple buffer overflows in ArGoSoft FTP Server before 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a SITE ZIP command with a long first or second argument or (2) a SITE COPY with a long argument.


Buffer overflow in MyWeb 3.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.


Buffer overflow in aGSM Half-Life client allows remote Half-Life servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server response.


Buffer overflow in Painkiller 1.3.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.


Buffer overflow in Check Point SmartDashboard in Check Point NG AI R54 and R55 allows remote authenticated users to cause a denial of service (server disconnect) and possibly execute arbitrary code via a large filter on a column when using SmartView Tracker.


Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE (2) SUBSCRIBE (3) STATUS (4) APPEND (5) CHECK (6) CLOSE (7) EXPUNGE (8) FETCH (9) RENAME (10) DELETE (11) LIST (12) SEARCH (13) CREATE or (14) UNSUBSCRIBE commands.


Buffer overflow in the http_open function in Kaffeine before 0.5 whose code is also used in gxine before 0.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file.


Buffer overflow in Orbz 2.10 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long password field in a join request.


Buffer overflow in (1) MusicConverter.exe (2) playlist.exe and (3) amp.exe in dBpowerAMP Audio Player 2.0 and dbPowerAmp Music Converter 10.0 allows remote attackers to cause a denial of service or execute arbitrary code via a .pls or .m3u playlist that contains long File1 (filename) fields.


The binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27 and 2.6.x up to 2.6.8 may create an interpreter name string that is not NULL terminated which could cause strings longer than PATH_MAX to be used leading to buffer overflows that allow local users to cause a denial of service (hang) and possibly execute arbitrary code.


Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow (1) remote attackers to execute arbitrary code via an SSH2 packet with a base argument that is larger than the mod argument which causes the modpow function to write memory before the beginning of its buffer and (2) remote malicious servers to cause a denial of service (client crash) and possibly execute arbitrary code via a large bignum during authentication.


Buffer overflow in hsrun.exe for HAHTsite Scenario Server 5.1 Patch 06 (build 91) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long project name.


Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00 and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded.


Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request as demonstrated using a long (1) GET argument or (2) method name.


Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long username.


Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a null byte to be written beyond the buffer (2) octal encoding in yahoo_decode that causes a pointer to reference memory beyond the terminating null byte (3) a quoted printable string to the gaim_quotedp_decode MIME decoder that causes a null byte to be written beyond the buffer and (4) quoted printable encoding in gaim_quotedp_decode that causes a pointer to reference memory beyond the terminating null byte.


Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4 and 6.x before 6.0.6.2 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via malformed (1) AVI (2) BMP or (3) DIB files.


Buffer overflow in eauth in Load Sharing Facility 4.x 5.x and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long LSF_From_PC parameter.


Buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an \unexpected sequence of MSNSLP messages\ that results in an unbounded copy operation that writes to the wrong buffer.


Buffer overflow in hpsockd before 0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code.


Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.


Multiple buffer overflows in Gaim before 0.82 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) Rich Text Format (RTF) messages (2) a long hostname for the local system as obtained from DNS or (3) a long URL that is not properly handled by the URL decoder.


Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.


Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3 and possibly other versions allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file including (1) an offset that triggers an out-of-bounds memory access (2) a certain value that causes a large memory copy as triggered by an integer conversion error and other values.


Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field which causes a large amount of data to be copied.


Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1 WIndows 2000 Windows 98 and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names as demonstrated using Samba.


The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a NT Terminal Server 4.0 SP 6 Windows 2000 Server SP3 and SP4 and Windows Server 2003 does not properly validate the computer name value in a WINS packet which allows remote attackers to execute arbitrary code or cause a denial of service (server crash) which results in an \unchecked buffer\ and possibly triggers a buffer overflow aka the \Name Validation Vulnerability.\


The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 when compiled in environments that do not provide the vsnprintf function uses C include files that define vsnprintf to use the less safe vsprintf function which can lead to buffer overflow vulnerabilities that enable a denial of service (server crash) and possibly execute arbitrary code.


Buffer overflow in LHA 1.14 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to \command line processing \ a different vulnerability than CVE-2004-0771. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.


Multiple buffer overflows in Gaim 0.75 and earlier and Ultramagnetic before 0.81 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) cookies in a Yahoo web connection (2) a long name parameter in the Yahoo login web page (3) a long value parameter in the Yahoo login page (4) a YMSG packet (5) the URL parser and (6) HTTP proxy connect.


Multiple vulnerabilities in SYMDNS.SYS for Symantec Norton Internet Security and Professional 2002 through 2004 Norton Personal Firewall 2002 through 2004 Norton AntiSpam 2004 Client Firewall 5.01 and 5.1.1 and Client Security 1.0 through 2.0 allow remote attackers to cause a denial of service or execute arbitrary code via (1) a manipulated length byte in the first-level decoding routine for NetBIOS Name Service (NBNS) that modifies an index variable and leads to a stack-based buffer overflow (2) a heap-based corruption problem in an NBNS response that is missing certain RR fields and (3) a stack-based buffer overflow in the DNS component via a Resource Record (RR) with a long canonical name (CNAME) field composed of many smaller components.


McAfee ePolicy Orchestrator agent allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via an HTTP POST request with an invalid Content-Length value possibly triggering a buffer overflow.


Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long GET request on port 1080.


Buffer overflow in Whisper FTP Surfer 1.0.7 allows remote FTP servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long filename.


Buffer overflow in the MSN protocol plugins (1) object.c and (2) slp.c for Gaim before 0.82 allows remote attackers to cause a denial of service and possibly execute arbitrary code via MSNSLP protocol messages that are not properly handled in a strncpy call.


Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4 when playing Real RTSP (realrtsp) streams allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (a) long URLs (b) long Real server responses or (c) long Real Data Transport (RDT) packets.


Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release Mozilla before 1.7.3 and Thunderbird before 0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via (1) the \Send page\ functionality (2) certain responses from a malicious POP3 server or (3) a link containing a non-ASCII hostname.


Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER (2) OFFER (3) REQUEST (4) ACK or (5) NAK messages which can generate a long string when writing to a log file.


Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to cause a denial of service (heap corruption and crash) or execute arbitrary code via a long string to the open method.


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \libarchive\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file.


An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the \Kernel\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (buffer overflow) via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \Carbon\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted .dfont file.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \Security\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (buffer overflow) via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \SQLite\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the \Contacts\ component. A buffer overflow allows remote attackers to execute arbitrary code or cause a denial of service (application crash).


Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the \libarchive\ component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file.


Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted image containing a malformed image size descriptor in the IHDR chunk.


Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute arbitrary code via a crafted image containing a malformed chunk size descriptor.


in

MIT

Kerberos

(aka

through

mishandles

Distinguished

Name

(DN)

fields

which

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

(buffer

overflow

and

application

crash)

in

situations

involving

untrusted

data

related

to

the

and

functions.

NOTE:

this

has

security

relevance

only

in

use

cases

outside

of

the

MIT

Kerberos

distribution

e.g.

the

use

of

in

KDC

certauth

plugin

code

that

is

specific

to

Red

Hat.


A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 888.


Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size a different vulnerability than CVE-2014-3618.


An issue was discovered in EMC NetWorker (prior to 8.2.4.9 all supported 9.0.x versions prior to 9.1.1.3 prior to 9.2.0.4). The Server service (nsrd) is affected by a buffer overflow vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on vulnerable installations of the software or cause a denial of service depending on the target system's platform.


The AddUserFinding implementation in Medicomp MEDCIN Engine 2.22.20153.x before 2.22.20153.226 might allow remote attackers to execute arbitrary code or cause a denial of service (integer truncation and heap-based buffer overflow) via a crafted packet on port 8190.


Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an \oversized\ XML element name.


Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long USER command.


Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file as demonstrated by sixteen-stereo-to-eight-mono.c.


Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1 as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.


Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family related to performing \dual A/AAAA DNS queries\ and the libnss_dns.so.2 NSS module.


Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.


Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the last row of RLE data in a crafted BMP file.


Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX frame within an ID3 tag in MP3 data in a movie file a different vulnerability than CVE-2015-7085 CVE-2015-7086 CVE-2015-7087 CVE-2015-7088 CVE-2015-7089 CVE-2015-7090 CVE-2015-7091 and CVE-2015-7117.


The

VertexBufferInterface::reserveVertexSpace

function

in

libGLES

in

ANGLE

as

used

in

Mozilla

Firefox

before

and

Firefox

ESR

before

on

Windows

incorrectly

allocates

memory

for

shader

attribute

arrays

which

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

(buffer

overflow

and

application

crash)

via

crafted

OpenGL

or

WebGL

content.


Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.


io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.


Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.


Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image aka SPRs KLYH9ZDKRE and KLYH9ZTLEZ a different vulnerability than CVE-2015-4994.


Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.


Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before 8.4.4 Rendezvous Network Server before 1.1.1 Substation ES before 2.9.0 and Messaging Appliance before 8.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors related to the Rendezvous Daemon (rvd) Routing Daemon (rvrd) Secure Daemon (rvsd) Secure Routing Daemon (rvsrd) Gateway Daemon (rvgd) Daemon Adapter (rvda) Cache (rvcache) Agent (rva) and Relay Agent (rvrad) components.


Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image aka SPRs KLYH9ZDKRE and KLYH9ZTLEZ a different vulnerability than CVE-2015-5040.


Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19 9.1.x before 9.1.15 9.2.x before 9.2.10 9.3.x before 9.3.6 and 9.4.x before 9.4.1 when running on a Windows system allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision as demonstrated by using the to_char function.


Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19 9.1.x before 9.1.15 9.2.x before 9.2.10 9.3.x before 9.3.6 and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image.


Multiple

buffer

overflows

in

in

the

QtBase

module

in

Qt

before

and

before

allow

remote

attackers

to

cause

a

denial

of

service

(segmentation

fault

and

crash)

and

possibly

execute

arbitrary

code

via

a

crafted

ICO

image.


Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response which triggers a call with a misaligned buffer.


Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.


Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash) read memory or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.


The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data aka internal bug 21132860.


The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.


Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.


Buffer overflow in the C_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors aka SAP Security Note 2063369.


Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6 Netweaver Application Server ABAP Netweaver Application Server Java Netweaver RFC SDK GUI RFC SDK SAPCAR archive tool and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors aka SAP Security Note 2124806 2121661 2127995 and 2125316.


Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures which allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (buffer overflow) by leveraging guest OS privileges aka \Hyper-V Buffer Overflow Vulnerability.\


The file_check_mem function in funcs.c in file before 5.23 as used in the Fileinfo component in PHP before 5.5.34 5.6.x before 5.6.20 and 7.x before 7.0.5 mishandles continuation-level jumps which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.


Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) or execute arbitrary code via an unspecified parameter.


Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.


Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354 MT7-TL10 before MT7-TL10C00B354 MT7-TL00 before MT7-TL00C01B354 and MT7-CL00 before MT7-CL00C92B354 and P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01 GRA-CL00 before GRA-CL00C92B220 GRA-CL10 before GRA-CL10C92B220 GRA-UL00 before GRA-UL00C00B220 and GRA-UL10 before GRA-UL10C00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application.


Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.


Heap-based buffer overflow in the AirPort wireless driver on Apple Mac OS X 10.4.7 allows physically proximate attackers to cause a denial of service (crash) gain privileges and execute arbitrary code via a crafted frame that is not properly handled during scan cache updates.


Unspecified vulnerability in the daemons for Sun N1 Grid Engine 5.3 and N1 Grid Engine 6.0 allows local users to cause a denial of service (grid service shutdown) and possibly execute arbitrary code using buffer overflows via unknown vectors that cause (1) qmaster or (2) execd to terminate.


Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2 as used in Adobe Reader 9.3.0 and other products allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.


Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG stream that is longer than the scan line size (TiffScanLineSize).


Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to \chunk error processing \ possibly involving the \chunk_name\.


Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values possibly related to improper escaping and long strings.


Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1 with versions the MS06-042 patch before 20060912 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL in a GZIP-encoded website that was the target of an HTTP redirect due to an incomplete fix for CVE-2006-3869.


Buffer overflow in Freeciv 2.1.0-beta1 and earlier and SVN 15 Jul 2006 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) negative chunk_length or a (2) large chunk->offset value in a PACKET_PLAYER_ATTRIBUTE_CHUNK packet in the generic_handle_player_attribute_chunk function in common/packets.c and (3) a large packet->length value in the handle_unit_orders function in server/unithand.c.


Buffer overflow in Wireshark (aka Ethereal) 0.8.16 to 0.99.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the NFS dissector.


Buffer overflow in Windows Explorer (explorer.exe) on Windows XP and 2003 allows user-assisted attackers to cause a denial of service (repeated crash) and possibly execute arbitrary code via a .url file with an InternetShortcut tag containing a long URL and a large number of \file:\ specifiers.


Buffer overflow in pamtofits of NetPBM 10.30 through 10.33 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code when assembling the header possibly related to an off-by-one error.


Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1 with versions the MS06-042 patch before 20060824 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL on a website that uses HTTP 1.1 compression.


WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a \memory management error\ in WebKit possibly due to a buffer overflow as originally reported for the KHTMLParser::popOneBlock function in Apple Safari 2.0.4 using Javascript that changes document.body.innerHTML within a DIV tag.


Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink as demonstrated using an Excel worksheet with a long link in Unicode aka \Hyperlink COM Object Buffer Overflow Vulnerability.\ NOTE: this is a different issue than CVE-2006-3059.


Buffer overflow in the xcf_load_vector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property.


Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a long (1) PORT or (2) PASS followed by the MLSD command or (2) the remote server interface as demonstrated by the Infigo FTPStress Fuzzer.


Buffer overflow in the web console in F-Secure Anti-Virus for Microsoft Exchange 6.40 and Internet Gatekeeper 6.40 through 6.42 and 6.50 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors. NOTE: By default the connections are only allowed from the local host.


Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.


Buffer overflow in Gene6 FTP Server 3.1.0 allows remote authenticated attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to (1) MKD or (2) XMKD as demonstrated by the Infigo FTPStress Fuzzer.


Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423 as used by GNU strings allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a file with a crafted Tektronix Hex Format (TekHex) record in which the length character is not a valid hexadecimal character.


Buffer overflow in TIBCO Rendezvous before 7.5.1 TIBCO Runtime Agent (TRA) before 5.4 and Hawk before 4.6.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the HTTP administrative interface.


Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Stack-based buffer overflow in the ServerNetworking::incoming_client_data function in servnet.cpp in Outgun 1.0.3 bot 2 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a data_file_request command with a long (1) type or (2) name string.


Buffer overflow in iMonitor 2.4 in Novell eDirectory 8.8 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown attack vectors.


Buffer overflow in EMC Retrospect Client 5.1 through 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet to port 497.


Stack-based buffer overflow in libmms as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command (2) string_utf16 (3) get_data and (4) get_media_packet functions and possibly other functions.


Buffer overflow in Golden FTP Server Pro 2.70 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long argument to the (1) NLST or (2) APPE commands as demonstrated by the Infigo FTPStress Fuzzer.


Buffer overflow in BL4 SMTP Server 0.1.4 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the (1) EHLO (2) MAIL FROM and (3) RCPT TO commands.


Heap-based buffer overflow in Splash.cc in xpdf as used in other products such as (1) poppler (2) kdegraphics (3) gpdf (4) pdfkit.framework and others allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap.


Buffer overflow in Metamail 2.7-50 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via e-mail messages with a long boundary attribute a different vulnerability than CVE-2004-0105.


Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .m3u file that causes an incorrect strncpy function call when the player pauses or stops the file.


Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the DHCP options field.


Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute.


Buffer overflow in an unspecified Oracle Client utility might allow remote attackers to execute arbitrary code or cause a denial of service. NOTE: due to the lack of relevant details from the Oracle advisory a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DBC02 from the January 2006 CPU in which case this would be a duplicate of CVE-2006-0283. However there are enough inconsistencies that the mapping can not be made authoritatively.


Unspecified vulnerability in AOL Instant Messenger (AIM) 5.9.3861 allows user-assisted remote attackers to cause a denial of service (client crash) and possibly execute arbitrary code by tricking the user into requesting Buddy Info about a long screen name which might cause a buffer overflow.


Multiple buffer overflows in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) ALCAP dissector (2) Network Instruments file code or (3) NetXray/Windows Sniffer file code.


Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900 which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800 which triggers an overflow in VNCLog::ReallyPrint.


Multiple heap-based buffer overflows in Mac OS X 10.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) PredictorVSetField function for TIFF or (2) CFAllocatorAllocate function for GIF as used in applications that use ImageIO or AppKit. NOTE: the BMP vector has been re-assigned to CVE-2006-2238 because it affects a separate product family.


Buffer overflow in Ethereal 0.9.15 up to 0.10.14 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the COPS dissector.


Mozilla Firefox 1.5.0.2 when designMode is enabled allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll but the vendor disputes this claim.


The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow.


Buffer overflow in client/server Doom (csDoom) 0.7 and earlier allows remote attackers to (1) cause a denial of service via a long nickname or teamname to the SV_SetupUserInfo function or (2) execute arbitrary code via a long string sent when joining a match or a long chat message to the SV_BroadcastPrintf function.


Buffer overflow in SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malformed HB-ACK chunk.


Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.


Buffer overflow in the Motorola PEBL U6 08.83.76R and possibly other Motorola P2K-based phones allows remote attackers to cause a denial of service (device shutdown) and possibly execute arbitrary code via a long OBEX setpath to the OBEX File Transfer (aka FTP) service on Bluetooth channel 9.


Stack-based buffer overflow in an ActiveX control used in Symantec Automated Support Assistant as used in Norton AntiVirus Internet Security and System Works 2005 and 2006 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


Multiple heap-based buffer overflows in RevilloC MailServer 1.21 and earlier allow remote attackers to cause a denial of service (CPU consumption or application crash) or execute arbitrary code via a long argument to the (1) MAIL FROM or (2) RCPT TO command.


Multiple buffer overflows in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in (1) the language field at logon that begins with a 0x18 byte (2) two unspecified parameters to the SmExecuteWdsfSession function and (3) the contact field in an open registration message.


Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.


Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitrary code or cause a denial of service (application crash) via crafted APPE commands that contain \/\ (slash) or \\\\ (backslash) characters.


Multiple

buffer

overflows

in

libavcodec

in

ffmpeg

before

allow

remote

attackers

to

cause

a

denial

of

service

or

possibly

execute

arbitrary

code

via

multiple

unspecified

vectors

in

dtsdec.c

vorbis.c

rm.c

sierravmd.c

smacker.c

tta.c

alac.c

cook.c

shorten.c

smacker.c

snow.c

and

tta.c.

NOTE:

it

is

likely

that

this

is

a

different

vulnerability

than

and


Multiple heap-based buffer overflows in Symantec VERITAS Backup Exec for Netware Server Remote Agent for Windows Server 9.1 and 9.2 (all builds) Backup Exec Continuous Protection Server Remote Agent for Windows Server 10.1 (builds 10.1.325.6301 10.1.326.1401 10.1.326.2501 10.1.326.3301 and 10.1.327.401) and Backup Exec for Windows Server and Remote Agent 9.1 (build 9.1.4691) 10.0 (builds 10.0.5484 and 10.0.5520) and 10.1 (build 10.1.5629) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted RPC message.


Multiple buffer overflows in libmusicbrainz (aka mb_client or MusicBrainz Client Library) 2.1.2 and earlier and SVN 8406 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a long Location header by the HTTP server which triggers an overflow in the MBHttp::Download function in lib/http.cpp; and (2) a long URL in RDF data as demonstrated by a URL in an rdf:resource field in an RDF XML document which triggers overflows in many functions in lib/rdfparse.c.


Multiple buffer overflows in ArcSoft MMS Composer 1.5.5.6 and possibly earlier and 2.0.0.13 and possibly earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted MMS (Multimedia Messaging Service) messages that trigger the overflows in the (1) M-Notification.ind (2) M-Retrieve.conf (Header and Body) or (3) SMIL parsers.


Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1 NetBSD 2.0 through 4.0 beta before 20060823 and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service (panic) obtain sensitive information and possibly execute arbitrary code via crafted Link Control Protocol (LCP) packets with an option length that exceeds the overall length which triggers the overflow in (1) pppoe and (2) ippp. NOTE: this issue was originally incorrectly reported for the ppp driver.


Stack-based buffer overflow in tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a long file name. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Heap-based buffer overflow in SAP Internet Graphics Service (IGS) 6.40 and earlier and 7.00 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via an HTTP request with an ADM:GETLOGFILE command and a long portwatcher argument which triggers the overflow during error message construction when the _snprintf function returns a negative value that is used in a memcpy operation.


Heap-based buffer overflow in DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a Spline function call whose first argument specifies a large number of points.


Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors including (1) a long pathname that is not properly handled during file list parsing (2) long pathnames that result from path variable expansion such as tilde expansion for the HOME environment variable and (3) a long -f (aka reffile) command line argument.


Heap-based buffer overflow in Mozilla Firefox before 1.5.0.7 Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a JavaScript regular expression with a \minimal quantifier.\


Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via long strings that contain '@' characters in the (1) USER and (2) APOP commands.


Buffer overflow in the telnet service in Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier SDM-93xx 10.x.x (R2) and earlier and SDM-92xx 9.x.x (R1) and earlier allows remote attackers to cause a denial of service (reboot) and possibly execute arbitrary code via a long username.


Multiple buffer overflows in the (a) Session Clustering Daemon and the (b) mod_cluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a (1) empty or (2) crafted PHP session identifier (PHPSESSID).


Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by sending a crafted packet to port 69/UDP which triggers the overflow when constructing an absolute path name. NOTE: Some details are obtained from third party information.


Buffer overflow in Open Movie Editor 0.0.20060901 allows local users to cause a denial of service (system crash) or execute arbitrary code via a long project name in an open_movie_editor_project XML tag.


Heap-based buffer overflow in the uploadprogress_php_rfc1867_file function in uploadprogress.c in Bitflux Upload Progress Meter before 8276 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted HTTP POST fileupload requests.


Buffer overflow in the Bluetooth Stack COM Server in the Widcomm Bluetooth stack as packaged as Widcomm Stack 3.x and earlier on Windows Widcomm BTStackServer 1.4.2.10 and 1.3.2.7 on Windows Widcomm Bluetooth Communication Software 1.4.1.03 on Windows and the Bluetooth implementation in Windows Mobile or Windows CE on the HP IPAQ 2215 and 5450 allows remote attackers to cause a denial of service (service crash) and possibly execute arbitrary code via unspecified vectors.


Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6 and 2.6.19.x allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.


Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long X-Forwarded-For HTTP header. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in the asmrp_eval function in the RealMedia RTSP stream handler (asmrp.c) for Real Media input plugin as used in (1) xine/xine-lib (2) MPlayer 1.0rc1 and earlier and possibly others allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches.


Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2.3.3 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long REMOTE_ADDR environment variable. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3 and Helix DNA Server 11.0 and 11.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a DESCRIBE request that contains an invalid LoadTestPassword field.


Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1 1.5.x before 1.5.0.9 Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by setting the CSS cursor to certain images that cause an incorrect size calculation when converting to a Windows bitmap.


Buffer overflow in Quintessential Player 4.50.1.82 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) M3u or (2) M3u-8 file; or a (3) crafted PLS file with a long value in the (a) NumberofEntries (b) Length (aka Length1) (c) Filename (aka File1) (d) Title (aka Title1) field or other unspecified fields.


Multiple stack-based buffer overflows in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.82 and 2.0 through 2.33 and MailEnable Enterprise 1.1 through 1.30 and 2.0 through 2.33 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a long argument to the (1) EXAMINE or (2) SELECT command.


Multiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an (a) long username or a (b) crafted packet to the FindBasicAuth function in security.cpp related to the /browse URI; and allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long path string in the (2) Browse (3) CControl::Download and (4) CControl::Load functions related to the file parameter in the /dl URI. NOTE: some of these details are obtained from third party information.


Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2 Server 2003 and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute using an unrecognized protocol in a REF element in an ASX PlayList file.


Buffer overflow in the readAA function in read_aa.cpp in Winamp iPod Plugin (ml_ipod) 2.00 p19 and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long tag in an audible.com audiobook (aa) file.


Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command. NOTE: it was later reported that 4.70 is also affected. NOTE: the USER vector is already covered by CVE-2005-0634.


Integer signedness error in the network_receive_packet function in socket.c in dimension 3 engine (dim3) 1.5 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large data_len value which is cast to a signed short and results in a buffer overflow.


Buffer overflows in iPlanet Directory Server 4.1.4 and earlier (LDAP) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Buffer overflow in mcedit in Midnight Commander 4.5.1 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted text file.


Buffer overflows in Icecast before 1.3.10 allow remote attackers to cause a denial of service (crash) and execute arbitrary code.


Buffer overflow in AOLserver 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP request with a long Authorization header.


Buffer overflow in MIT Kerberos 5 (krb5) 1.2.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via base-64 encoded data which is not properly handled when the radix_encode function processes file glob output from the ftpglob function.


Buffer overflows in Teamware Office Enterprise Directory allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Multiple vulnerabilities in xinetd 2.3.0 and earlier and additional variants until 2.3.3 may allow remote attackers to cause a denial of service or execute arbitrary code primarily via buffer overflows or improper NULL termination.


Buffer overflows in (1) Icecast before 1.3.9 and (2) libshout before 1.0.4 allow remote attackers to cause a denial of service (crash) and execute arbitrary code.


Buffer overflows in Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.


Buffer overflow in Claris Emailer 2.0v2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an email attachment with a long filename.


Buffer overflow in print-rx.c of tcpdump 3.x (probably 3.6x) allows remote attackers to cause a denial of service and possibly execute arbitrary code via AFS RPC packets with invalid lengths that trigger an integer signedness error a different vulnerability than CVE-2000-1026.


Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows) as demonstrated by the PROTOS LDAPv3 test suite.


Buffer overflows in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Buffer overflows in IBM SecureWay 3.2.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by the PROTOS LDAPv3 test suite.


Buffer overflow in Mercury MTA POP3 server for NetWare 1.48 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long APOP command.


Buffer overflow in Olivier Debon Flash plugin (not the Macromedia plugin) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long DefineSound tag.


Buffer overflow in ftp daemon (ftpd) 6.2 in Debian GNU/Linux allows attackers to cause a denial of service and possibly execute arbitrary code via a long SITE command.


Buffer overflow in iPlanet Web Server (iWS) Enterprise Edition 4.1 service packs 3 through 7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long method name in an HTTP request.


Buffer overflow in glob function of glibc allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a glob pattern that ends in a brace \{\ character.


Buffer overflow in Web Publisher in iPlanet Web Server Enterprise Edition 4.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a request for a long URI with (1) GETPROPERTIES (2) GETATTRIBUTENAMES or other methods.


Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long command.


Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0 related to an \incorrect loop construct.\


Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2 S612 V2 and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute arbitrary code via a crafted DCP frame.


Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.


Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1 X308-2M before 3.7.2 X-300EEC before 3.7.2 XR-300 before 3.7.2 and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.


Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1 10.3.1 11.3 and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file.


Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.6 and 0.8.x before 0.8.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VQA media file in which the image size is not a multiple of the block size.


Heap-based buffer overflow in process.c in smbd in Samba 3.0 as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion.


Multiple heap-based buffer overflows in XnView before 1.99 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a (1) SGI32LogLum compressed TIFF image or (2) SGI32LogLum compressed TIFF image with the PhotometricInterpretation encoding set to LogL.


Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12 and possibly other versions allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets.


Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a series of fragmented RLC packets.


Buffer overflow in the VSFlex7.VSFlexGrid ActiveX control in ComponentOne FlexGrid 7.1 as used in Open Automation Software OPC Systems.NET allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long archive file name argument to the Archive method.


Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) or execute arbitrary code via a UTF-8 line from server containing characters outside of the Basic Multilingual Plane (BMP).


Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors.


Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wizard 1.0; VAIO Wireless Wizard 1.00 1.00_64 1.0.1 2.0 and 3.0; SmartWi Connection Utility 4.7 4.7.4 4.8 4.9 4.10 and 4.11; and VAIO Easy Connect software 1.0.0 and 1.1.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the second argument of the (1) SetTmpProfileOption or (2) ConnectToNetwork method.


Heap-based

buffer

overflow

in

the

nsSVGFEDiffuseLightingElement::LightPixel

function

in

Mozilla

Firefox

through

Firefox

ESR

before

Thunderbird

through

Thunderbird

ESR

before

and

SeaMonkey

before

allows

remote

attackers

to

cause

a

denial

of

service

(invalid

gfxImageSurface

free

operation)

or

possibly

execute

arbitrary

code

by

leveraging

the

use

of

\different

number

systems.\


Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long string in a version attribute of an ispXCF element in an .xcf file.


Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21 when global.tune.bufsize is set to a value greater than the default and header rewriting is enabled allows remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors.


Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI) irq routing entries and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.


Buffer overflow in the addchar function in common/parseconf.c in upsd in Network UPS Tools (NUT) before 2.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (electric-power outage) via a long string containing non-printable characters.


Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with (1) a child tag within an incorrect parent tag (2) duplicate tags or (3) a Base64 ChecksumAttribute whose length is not evenly divisible by four.


Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18 when the mp4 directive is used allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.


Multiple

buffer

overflows

in

FlightGear

and

earlier

and

SimGear

and

earlier

allow

user-assisted

remote

attackers

to

cause

a

denial

of

service

(crash)

and

possibly

execute

arbitrary

code

via

a

long

string

in

a

rotor

tag

of

an

aircraft

xml

model

to

the

Rotor::getValueforFGSet

function

in

or

a

crafted

UDP

packet

to

the

SGSocketUDP::read

function

in


Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image which triggers an improper conversion between signed and unsigned types leading to a heap-based buffer overflow.


Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.


Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12 when using TLS-based EAP methods allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long \not after\ timestamp in a client certificate.


Heap-based

buffer

overflow

in

the

read

function

in

in

the

Microsoft

import

filter

in

KOffice

and

earlier

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

and

possibly

execute

arbitrary

code

via

a

crafted

ODF

style

in

an

ODF

document.

NOTE:

this

is

the

same

vulnerability

as

but

it

was

SPLIT

by

the

CNA

even

though

Calligra

and

KOffice

share

the

same

codebase.


Heap-based

buffer

overflow

in

the

read

function

in

in

the

Microsoft

import

filter

in

Calligra

and

earlier

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

and

possibly

execute

arbitrary

code

via

a

crafted

ODF

style

in

an

ODF

document.

NOTE:

this

is

the

same

vulnerability

as

but

it

was

SPLIT

by

the

CNA

even

though

Calligra

and

KOffice

share

the

same

codebase.


Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.


The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.


Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.


Stack-based buffer overflow in utp.cpp in libutp as used in Transmission before 2.74 and possibly other products allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted \micro transport protocol packets.\


Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.


Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.


Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit as used in WaveSurfer 1.8.8p4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file.


Buffer overflow in LogReceiver.exe in Rockwell Automation RSLinx Enterprise CPR9 CPR9-SR1 CPR9-SR2 CPR9-SR3 CPR9-SR4 CPR9-SR5 CPR9-SR5.1 and CPR9-SR6 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a UDP packet with a certain integer length value that is (1) too large or (2) too small leading to improper handling by Logger.dll.


Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib) as used in Ghostscript 9.06 and Argyll Color Management System allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error.


Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7 1.2.x before 1.2.2 1.3.x before 1.3.1 and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow related to an error message and a \triggering event attached to applet.\ NOTE: the 1.4.x versions were originally associated with CVE-2013-4349 but that entry has been MERGED with this one.