Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow as demonstrated by a request with -1 in the Content-Length HTTP header.


Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0 Firefox ESR 10.x before 10.0.7 Thunderbird before 15.0 Thunderbird ESR 10.x before 10.0.7 and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation leading to a heap-based buffer overflow.

integer overflow
buffer overflow
arbitrary code execution


Multiple unspecified vulnerabilities in HP Intelligent Management Center (IMC) before 5.0 E0101P05 allow remote attackers to execute arbitrary code via crafted input as demonstrated by an integer overflow and heap-based buffer overflow in img.exe for a crafted message packet.


Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file leading to a heap-based buffer overflow.


SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \merge\ operation that occurs after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.


SQLite before 3.25.3 when the FTS3 extension is enabled encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases) aka Magellan.


Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or potentially execute arbitrary code.


Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2 as shipped in Debian Red Hat and Ubuntu (the functionality is not included in GRUB2 upstream) leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.


Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.


SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can trigger a line number to CSI functions that exceeds INT_MAX.


Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams which triggers a heap-based buffer overflow.


Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees which triggers a heap-based buffer overflow.


Integer overflow in RealArcade 1.2.0.994 and earlier allows remote attackers to execute arbitrary code via an RGS file with an invalid size string for the GUID and game name which leads to a buffer overflow.


Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1 which leads to a zero byte memory allocation and a buffer overflow.


Integer overflow in Microsoft Windows 98 2000 XP SP2 and earlier and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow as demonstrated using a \ms-its:\ URL in Internet Explorer.


Integer overflow in the Binary File Descriptor (BFD) library for gdb before 6.3 binutils elfutils and possibly other packages allows user-assisted attackers to execute arbitrary code via a crafted object file that specifies a large number of section headers leading to a heap-based buffer overflow.


Integer overflow in the fetch_io function of the imap4d server in GNU Mailutils 0.5 and 0.6 and other versions before 0.6.90 allows remote attackers to execute arbitrary code via a partial message request with a large value in the END parameter which leads to a heap-based buffer overflow.


Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values which causes an integer wrap and leads to a buffer overflow as demonstrated using format string vulnerabilities in Perl applications.


Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated which leads to a heap-based buffer overflow.


Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2 as used in multiple products such as Python Ethereal and PHP allows attackers to execute arbitrary code via quantifier values in regular expressions which leads to a heap-based buffer overflow.


Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4 XP SP1 and SP2 and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows as demonstrated using MRBP16::bCheckRecord.


Integer overflow in RealNetworks RealPlayer 8 10 and 10.5 RealOne Player 1 and 2 and Helix Player 10.0.0 allows remote attackers to execute arbitrary code via an .rm movie file with a large value in the length field of the first data packet which leads to a stack-based buffer overflow a different vulnerability than CVE-2004-1481.


Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that facilitates a buffer overflow attack a different vulnerability than CVE-2002-1347.


Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file which triggers a heap-based buffer overflow.


Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.


Multiple integer overflows in dhost.exe in Novell eDirectory 8.8 before 8.8.3 and 8.73 before 8.7.3.10 ftf1 allow remote attackers to execute arbitrary code via a crafted (1) Content-Length header in a SOAP request or (2) Netware Core Protocol opcode 0x0F message which triggers a heap-based buffer overflow.


Integer overflow in Microsoft Office Word 2000 SP3 2002 SP3 2003 SP3 and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via (1) an RTF file or (2) a rich text e-mail message containing an invalid number of points for a polyline or polygon which triggers a heap-based buffer overflow aka \Word RTF Object Parsing Vulnerability.\


Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function leading to a buffer overflow a different vulnerability than CVE-2007-4965 and CVE-2008-1679.


Integer overflow in multiple F-Secure anti-virus products including Internet Security 2006 through 2008 Anti-Virus 2006 through 2008 and others when configured to scan inside compressed archives allows remote attackers to execute arbitrary code via a crafted RPM compressed archive file which triggers a buffer overflow.


Integer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request that triggers a heap-based buffer overflow related to improper memory allocation.


Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3 Office 2003 SP2 and SP3 2007 Microsoft Office System Gold and SP1 Visio 2002 SP2 PowerPoint Viewer 2003 Works 8 Digital Image Suite 2006 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 Report Viewer 2005 SP1 and 2008 and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a BMP image file with a malformed BitMapInfoHeader that triggers a buffer overflow aka \GDI+ BMP Integer Overflow Vulnerability.\


Integer overflow in ds.dlm as used by dhost.exe in Novell eDirectory 8.7.3.10 before 8.7.3 SP10b and 8.8 before 8.8.2 ftf2 allows remote attackers to execute arbitrary code via unspecified vectors that trigger a stack-based buffer overflow related to \flawed arithmetic.\


Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execute arbitrary code via a crafted mmst link with a negative size value which bypasses a size check and triggers an integer overflow followed by a heap-based buffer overflow.


Integer overflow in Borland Interbase 2007 SP2 (8.1.0.256) allows remote attackers to execute arbitrary code via a malformed packet to TCP port 3050 which triggers a stack-based buffer overflow. NOTE: this issue might be related to CVE-2008-0467.


Integer overflow in ovalarmsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allows remote attackers to execute arbitrary code via a crafted command to TCP port 2954 which triggers a heap-based buffer overflow.


Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size which triggers a heap-based buffer overflow.


Integer overflow in GDI in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 allows remote attackers to execute arbitrary code via a malformed header in a crafted WMF file which triggers a buffer overflow aka \GDI Integer Overflow Vulnerability.\


Integer overflow in Orb Networks Orb 2.00.1014 and Winamp Remote BETA allows remote attackers to execute arbitrary code via an RPC request that specifies a large number of array dimensions which triggers a heap-based buffer overflow.


Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file which triggers a heap-based buffer overflow.


Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4 XP SP2 Server 2003 SP1 and SP2 Vista and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow aka \GDI Heap Overflow Vulnerability.\


Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file which triggers an overflow in demuxers/demux_qt.c; (3) a crafted .RM file which triggers an overflow in demuxers/demux_real.c; (4) a crafted .MVE file which triggers an overflow in demuxers/demux_wc3movie.c; (5) a crafted .MKV file which triggers an overflow in demuxers/ebml.c; or (6) a crafted .CAK file which triggers an overflow in demuxers/demux_film.c.


The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7 SILC Client before 1.1.4 and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message which triggers an integer underflow signedness error and a buffer overflow. NOTE: the researcher describes this as an integer overflow but CVE uses the \underflow\ term in cases of wraparound from unsigned subtraction.


Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre_compile.cpp) in Apple WebKit as used in Safari before 3.1.1 allows remote attackers to execute arbitrary code via a regular expression with large nested repetition counts which triggers a heap-based buffer overflow.


Integer overflow in img.exe in HP Intelligent Management Center (IMC) allows remote attackers to execute arbitrary code via a crafted length value in an a packet that triggers a heap-based buffer overflow possibly related to an \recv\ field.


Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP header which triggers a heap-based buffer overflow.


Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk leading to a heap-based buffer overflow.


Multiple integer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitrary code via crafted (1) On_FC_MISC_FCS_MSGBROADCAST and (2) On_FC_MISC_FCS_MSGSEND packets which trigger a heap-based buffer overflow.


Multiple integer overflows in vxsvc.exe in the Veritas Enterprise Administrator service in Symantec Veritas Storage Foundation 5.1 and earlier Veritas Storage Foundation Cluster File System (SFCFS) 5.1 and earlier Veritas Storage Foundation Cluster File System Enterprise for Oracle RAC (SFCFSORAC) 5.1 and earlier Veritas Dynamic Multi-Pathing (DMP) 5.1 and NetBackup PureDisk 6.5.x through 6.6.1.x allow remote attackers to execute arbitrary code via (1) a crafted Unicode string related to the vxveautil.value_binary_unpack function; (2) a crafted ASCII string related to the vxveautil.value_binary_unpack function; or (3) a crafted value related to the vxveautil.kv_binary_unpack function leading to a buffer overflow.


Integer overflow in Foxit Reader before 4.3.1.0218 and Foxit Phantom before 2.3.3.1112 allows remote attackers to execute arbitrary code via crafted ICC chunks in a PDF file which triggers a heap-based buffer overflow.


Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0 FrontVue and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter leading to a buffer overflow.


Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm (2) .dib (3) .xbm (4) .xcf or (5) .xwd image file which triggers a heap-based buffer overflow.


Multiple integer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary code via unspecified CsAgent service commands that trigger a heap-based buffer overflow.


Multiple integer overflows in in_nsv.dll in the in_nsv plugin in Winamp before 5.6 allow remote attackers to execute arbitrary code via a crafted Table of Contents (TOC) in a (1) NSV stream or (2) NSV file that triggers a heap-based buffer overflow.


Multiple integer overflows in glpng.c in glpng 1.45 allow context-dependent attackers to execute arbitrary code via a crafted PNG image related to (1) the pngLoadRawF function and (2) the pngLoadF function leading to heap-based buffer overflows.


Multiple integer overflows in the in_midi plugin in Winamp before 5.6 allow remote attackers to execute arbitrary code via a crafted MIDI file that triggers a buffer overflow.


Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows.


Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing large width and height values that trigger heap-based buffer overflows.


Multiple integer overflows in (1) xviris.c (2) xvpcx.c and (3) xvpm.c in XV allow remote attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow.


Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun Rasterfile (bitmap) images that trigger heap-based buffer overflows.


Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.


Multiple integer overflows in OpenOffice.org (OOo) 2.x before 2.4.2 allow remote attackers to execute arbitrary code via crafted EMR records in an EMF file associated with a StarOffice/StarSuite document which trigger a heap-based buffer overflow.


Integer overflow in Apple QuickTime (QuickTime.qts) before 6.5.1 allows attackers to execute arbitrary code via a large \number of entries\ field in the sample-to-chunk table data for a .mov movie file which leads to a heap-based buffer overflow.


Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image which triggers a heap-based buffer overflow.


Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified vectors related to \phase one 0x412 tag \ which triggers a heap-based buffer overflow.


Integer overflow in Novell eDirectory 8.7.3.x before 8.7.3.10 ftf2 and 8.8.x before 8.8.5.2 allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value that triggers a heap-based buffer overflow.


Integer overflow in RealNetworks RealPlayer 10 and 10.5 RealOne Player 1 and RealPlayer Enterprise for Windows allows remote attackers to execute arbitrary code via a crafted Lyrics3 2.00 tag in an MP3 file resulting in a heap-based buffer overflow.


Integer overflow in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows might allow remote attackers to execute arbitrary code via a crafted QCP file that triggers a heap-based buffer overflow.


Integer overflow in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted AppleTalk Session Protocol (ASP) message on an AppleTalk socket which triggers a heap-based buffer overflow.


Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file resulting in a heap-based buffer overflow.


Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.


Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request which triggers a heap-based buffer overflow.


Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to execute arbitrary code via a crafted XPM file that triggers a heap-based buffer overflow.


Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4 and Poppler 0.x as used in kdegraphics KPDF might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.


Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.


Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a BMP file with crafted width and height values that trigger a heap-based buffer overflow.


Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets which enable a heap-based buffer overflow.


Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release Mozilla before 1.7.3 and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows.


Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary code via crafted template string specifiers in a serialized object which triggers a heap-based buffer overflow.


Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.


Integer overflow in the mach_msg_send function in the kernel for Mac OS X might allow local users to execute arbitrary code via unknown attack vectors related to a large message header size which leads to a heap-based buffer overflow.


Integer overflow in the (a) OLE2 and (b) CHM parsers for ESET NOD32 Antivirus before 1.1743 allows remote attackers to execute arbitrary code via a crafted (1) .DOC or (2) .CAB file that triggers a heap-based buffer overflow.


Integer overflow in the IDE_ACDStd.apl module for ACDSee 14.1 Build 137 allows remote attackers to execute arbitrary code via crafted \image dimension values\ in a BMP file which triggers a heap-based buffer overflow.


Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155 when photo sharing is enabled might allow remote attackers to execute arbitrary code via a crafted JPG image that triggers a heap-based buffer overflow.


Integer overflow in the main function in util/lpci_main.c in Csound before 5.17.2 when converting a file allows user-assisted remote attackers to execute arbitrary code via a crafted file which triggers a heap-based buffer overflow.


Integer overflow in the pv_import function in util/pv_import.c in Csound 5.16.6 when converting a file allows remote attackers to execute arbitrary code via a crafted file which triggers a heap-based buffer overflow.


Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long (1) username or (2) password which triggers a heap-based buffer overflow.


Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable which triggers a buffer overflow.


Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point which triggers a heap-based buffer overflow.


Integer overflow in the ELF parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted ELF file which leads to a heap-based buffer overflow.


Integer overflow in the readpgm function in pnm.c for GOCR 0.40 when using the netpbm library allows remote attackers to execute arbitrary code via a PNM file with large width and height values which leads to a heap-based buffer overflow.


Integer overflow in the openpsfile function in gsinterf.c for Jan Kybic BitMap Viewer (BMV) 1.2 allows local users to execute arbitrary code via a PostScript (PS) file containing a large number of pages value which leads to a resultant buffer overflow.


Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value which bypasses a validation check and triggers a buffer overflow.


Integer overflow in the WriteProlog function in texttops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow.


Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in OpenOffice.org (OOo) 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow.


Integer overflow in the Shockwave 3D Asset x32 component in Adobe Shockwave Player before 11.6.0.626 allows remote attackers to execute arbitrary code via a crafted subrecord in a DEMX chunk which triggers a heap-based buffer overflow.


Integer overflow in the GatewayService component in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to execute arbitrary code via a large size value in the packet header which triggers a heap-based buffer overflow.


Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier related to buffer overflows and integer overflows allow remote attackers to execute arbitrary code via TIFF files.


Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object which causes an integer overflow that leads to a buffer overflow.


Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

integer overflow
buffer overflow
arbitrary code execution
dos


Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string which triggers a heap-based buffer overflow and an out-of-bounds read.

integer overflow
buffer overflow
arbitrary code execution
out of bound read


In TrustZone access control policy may potentially be bypassed in all Android releases from CAF using the Linux kernel due to improper input validation an integer overflow vulnerability leading to a buffer overflow could potentially occur and a buffer over-read vulnerability could potentially occur.

integer overflow
buffer overflow
buffer overread


Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.

integer overflow
buffer overflow
buffer underflow
arbitrary code execution


Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.


Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.


Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.

integer overflow
buffer overflow
memory corruption


Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. After validating the number of ranges at 41 the library will multiply the count by the size of the GF_SubsegmentRangeInfo structure. On a 32-bit platform this multiplication can result in an integer overflow causing the space of the array being allocated to be less than expected. An attacker can convince a user to open a video to trigger this vulnerability.


Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.


An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow when processing an atom using the 'ssix' FOURCC code due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.


An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when reading an atom using the 'sbgp' FOURCC code can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.


Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function CJBig2Image::expand() and results in a memory corruption that leads to code execution when parsing a crafted PDF book.


Multiple integer overflows in Adobe Shockwave Player before 11.5.6.606 allow remote attackers to execute arbitrary code via (1) an unspecified block type in a Shockwave file leading to a heap-based buffer overflow; and might allow remote attackers to execute arbitrary code via (2) an unspecified 3D block in a Shockwave file leading to memory corruption; or (3) a crafted 3D model in a Shockwave file leading to heap memory corruption.

integer overflow
buffer overflow
memory corruption
arbitrary code execution


Microsoft Excel 2000 SP3 2002 SP3 and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office document with an embedded object which allows remote attackers to execute arbitrary code via an Excel file containing a crafted value leading to heap-based buffer overflows integer overflows array index errors and memory corruption aka \Calendar Object Validation Vulnerability.\


NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop) or possibly cause an out-of-bounds write by sending a crafted MQTT protocol packet.


An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1 MB3280 and MB3480 devices before 3.1 MB3660 devices before 2.3 and MB3180 devices before 2.1. An Integer overflow in the built-in web server allows remote attackers to initiate DoS.


An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.


An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1 tvOS 14.6 iOS 12.5.3 Safari 14.1.1 macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.


An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2 macOS Monterey 12.1 Safari 15.2 iOS 15.2 and iPadOS 15.2 watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.


An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina iOS 14.8 and iPadOS 14.8 macOS Big Sur 11.6 watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.


An integer overflow was addressed through improved input validation. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 iOS 14.8.1 and iPadOS 14.8.1 tvOS 15.1 watchOS 8.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. A malicious application may be able to elevate privileges.


Huawei DP300 V500R002C00 have an integer overflow vulnerability due to the lack of validation. An authenticated local attacker can craft specific XML files to the affected products and parse this file which result in DoS attacks.


Godot

Engine

version

All

versions

prior

to

all

versions

prior

to

contains

a

Signed/unsigned

comparison

wrong

buffer

size

chackes

integer

overflow

missing

padding

initialization

vulnerability

in

(De)Serialization

functions

(core/io/marshalls.cpp)

that

can

result

in

DoS

(packet

of

death)

possible

leak

of

uninitialized

memory.

This

attack

appear

to

be

exploitable

via

A

malformed

packet

is

received

over

the

network

by

a

Godot

application

that

uses

built-in

serialization

(e.g.

game

server

or

game

client).

Could

be

triggered

by

multiplayer

opponent.

This

vulnerability

appears

to

have

been

fixed

in

master

branch

after

commit


An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.


An integer overflow was addressed through improved input validation. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 14.2 and iPadOS 14.2 iCloud for Windows 11.5 tvOS 14.2 iTunes 12.11 for Windows. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


Integer overflow in PDFium in Google Chrome prior to 55.0.2883.75 for Mac Windows and Linux and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption or DoS via a crafted PDF file.


In rw_i93_sm_read_ndef of rw_i93.cc there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege in the NFC process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-122035770.


In binder_transaction of binder.c in the Android kernel there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.


Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.


In libexif there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774


In Bluetooth there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-113572342


In ion_buffer_kmap_get of ion.c there is a possible use-after-free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205573273References: Upstream kernel


In lwis_top_register_io of lwis_device_top.c there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205995178References: N/A


In prepare_io_entry and prepare_response of lwis_ioctl.c and lwis_periodic_io.c there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205995773References: N/A


In copy_io_entries of lwis_ioctl.c there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205992503References: N/A


In libstagefright there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-180200830


In ged there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1 Android-9 Android-10 Android-11; Patch ID: ALPS05431161.


In kisd there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05425581.


In memory management driver there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-183461318


In decrypt_1_2 of CryptoPlugin.cpp there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-176444622


In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-169258743


In ion there is a possible use after free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06371108; Issue ID: ALPS06371108.


In preloader (usb) there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160425; Issue ID: ALPS06160425.


In ged there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838808; Issue ID: ALPS05838808.


In Android before the 2018-06-05 security patch level NVIDIA TLK TrustZone contains a possible out of bounds write due to an integer overflow which could lead to local escalation of privilege with no additional execution privileges needed. User interaction not needed for exploitation. This issue is rated as high. Version: N/A. Android: A-69559414. Reference: N-CVE-2017-6290.


In Android before the 2018-06-05 security patch level NVIDIA TLZ TrustZone contains a possible out of bounds write due to integer overflow which could lead to local escalation of privilege in the TrustZone with no additional execution privileges needed. User interaction is not needed for exploitation. This issue is rated as high. Version: N/A. Android: A-69480285. Reference: N-CVE-2017-6292.


In ParsePayloadHeader of payload_metadata.cc there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113118184.


Integer overflow in subsystem for Intel(R) AMT versions before 11.8.80 11.12.80 11.22.80 12.0.70 14.0.45 may allow a privileged user to potentially enable escalation of privilege via local access.


In NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157650338


In skb_to_mamac of networking.c there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143560807


In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-126204073


In the Bluetooth server there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System privileges and a Firmware compromise needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-147227320


In Mediaserver there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if integer sanitization were not enabled (which it is by default) with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-147002762


In libavb there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-130231426


In remove of String16.cpp there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-156999009


In multiple locations of Parcel.cpp there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-120078455


In create of FileMap.cpp there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.0 Android-8.1 Android-9Android ID: A-156997193


Integer overflow in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable an escalation of privilege via local access.


Integer overflow in some Intel(R) Graphics Drivers before version 26.20.100.8476 may allow a privileged user to potentially enable an escalation of privilege via local access.


Integer overflow in the Safestring library maintained by Intel(R) may allow an authenticated user to potentially enable escalation of privilege via local access.


Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access.


In memory management driver there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05403499; Issue ID: ALPS05411456.

integer overflow
escalated privilege
memory corruption


In OMA DRM there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05722434; Issue ID: ALPS05722434.


In ccu driver there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06183345; Issue ID: ALPS06183345.


In mdp driver there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05836478; Issue ID: ALPS05836478.


Possible

Integer

overflow

because

of

subtracting

two

integers

without

checking

if

the

result

would

overflow

or

not

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking in IPQ4019 IPQ8064 IPQ8074 MDM9607 MSM8917 MSM8920 MSM8937 MSM8940 QCN7605 QCS405 QCS605 SDA845 SDM660 SDM845 SDX24 SDX55 SM6150 SM7150 SM8150 SXR1130


Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows man-in-the-middle attackers to spoof arbitrary SSL servers and other entities via an X.509 certificate that has a malformed ASN.1 Object Identifier (OID) and was issued by a legitimate Certification Authority aka \Integer Overflow in X.509 Object Identifiers Vulnerability.\


An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.


u'Lack

of

integer

overflow

check

for

addition

of

fragment

size

and

remaining

size

that

are

read

from

shared

memory

can

lead

to

memory

corruption

and

potential

information

leakage'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Bitra

Kamorta

Nicobar

Rennell

Saipan


u'Lack

of

check

for

integer

overflow

for

round

up

and

addition

operations

result

into

memory

corruption

and

potential

information

leakage'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Kamorta

Nicobar

Rennell


u'Possibility

of

integer

overflow

in

keymaster

while

allocating

memory

due

to

multiplication

of

large

numcerts

value

and

size

of

keymaster

bob

which

can

lead

to

memory

corruption'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Kamorta

Nicobar

Rennell


sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.


OpenSSH 7.7 through 7.9 and 8.x before 8.1 when compiled with an experimental key type has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions and there is no supported way to enable it when building portable OpenSSH.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 6 through Update 38 5.0 through Update 38 and 1.4.2_40 and earlier and OpenJDK 6 and 7 allows remote attackers to affect confidentiality integrity and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to \insufficient validation of raster parameters\ that can trigger an integer overflow and memory corruption.


An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.


In MediaTek LinkIt SDK before 4.6.1 there is a possible memory corruption due to an integer overflow during mishandled memory allocation by pvPortCalloc and pvPortRealloc.


Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21 5.0 Update 25 and 1.4.2_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image related to JPEGImageWriter.writeImage in the imageio API.


Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions.


Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.


yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data) which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl` which practically prevents the issue from triggering on 64bit platforms however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround avoid passing large inputs to YAJL.


Because of an integer overflow in sam2p 0.49.3 a loop executes 0xffffffff times ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However this also causes memory corruption because of an attempted write to the invalid d0xfffffffe array element.


Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution


An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. There is an Integer Overflow in process_M_SetTokenTUIPasswd during handling of a trusted application leading to memory corruption. The Samsung IDs are SVE-2017-9008 and SVE-2017-9009 (October 2017).


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

and

SD

if

size

is

too

large

in

boot_clobber_check_local_address_range()

an

integer

overflow

occurs

resulting

in

clobber

protection

check

being

bypassed

and

SBL

memory

corruption.


A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5 as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the \DestPos\ variable which allows the attacker to write out of bounds when setting MemDestPos.


A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml payload. This is due to an integer overflow in memory allocation for this string. The Samsung ID is SVE-2018-11463.


network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.


utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.


utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.


An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result the actual memory allocated is smaller than the buffer size specified by the arguments leading to memory corruption.


All versions of HoRNDIS are affected by an integer overflow in the RNDIS packet parsing routines. A malicious USB device can trigger disclosure of unrelated kernel memory to userspace applications on the host or can cause the kernel to crash. Kernel memory disclosure is especially likely on 32-bit kernels; 64-bit kernels are more likely to crash on attempted exploitation. It is not believed that kernel memory corruption is possible or that unattended kernel memory disclosure without the collaboration of a userspace program running on the host is possible. The vulnerability is in `HoRNDIS::receivePacket`. `msg_len` `data_ofs` and `data_len` can be controlled by an attached USB device and a negative value of `data_ofs` can bypass the check for `(data_ofs + data_len + 8) > msg_len` and subsequently can cause a wild pointer copy in the `mbuf_copyback` call. The software is not maintained and no patches are planned. Users of multi-tenant systems with HoRNDIS installed should only connect trusted USB devices to their system.


In Botan 1.8.0 through 1.11.33 when decoding BER data an integer overflow could occur which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

possible

memory

corruption

due

to

invalid

integer

overflow

checks

in

exif

parsing.


Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier 1.8.5 before 1.8.5-p231 1.8.6 before 1.8.6-p230 1.8.7 before 1.8.7-p22 and 1.9.0 before 1.9.0-2; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption aka the \beg + rlen\ issue. NOTE: as of 20080624 there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative although it is likely to change.


Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier 1.8.5 before 1.8.5-p231 1.8.6 before 1.8.6-p230 and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors aka the \REALLOC_N\ variant a different issue than CVE-2008-2662 CVE-2008-2663 and CVE-2008-2664. NOTE: as of 20080624 there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative although it is likely to change.


Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags which triggers an out-of-bounds write.


A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested possibly allowing memory corruption.


Integer overflow in ALLOCATE_LOCAL in the ProcXCMiscGetXIDList function in the XC-MISC extension in the X.Org X11 server (xserver) 7.1-1.1.0 and other versions before 20070403 allows remote authenticated users to execute arbitrary code via a large expression which results in memory corruption.

integer overflow
memory corruption
arbitrary code execution


Integer overflow in GDI+ in Microsoft Office XP SP3 allows remote attackers to execute arbitrary code via an Office document with a bitmap (aka BMP) image that triggers memory corruption aka \Office BMP Integer Overflow Vulnerability.\


Integer overflow in the Verifier::parseExceptionHandlers function in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via an SWF file with a large exception_count value that triggers memory corruption related to \generation of ActionScript exception handlers.\


Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2 6.9.0 7.0 and 7.1 and XFree86 X server allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.


Integer overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2 6.9.0 7.0 and 7.1 and XFree86 X server allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.


Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2 6.9.0 7.0 and 7.1 and XFree86 X server allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of glyph management data structures.


In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5 an integer overflow error when handling opcodes can cause memory corruption by sending a specially crafted NFSv4 request. Unprivileged remote users with access to the NFS server may be able to execute arbitrary code.


Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient (2) SProcRenderCreateRadialGradient or (3) SProcRenderCreateConicalGradient request with an invalid field specifying the number of bytes to swap in the request data which triggers heap memory corruption.


Integer overflow in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with a malformed picture index that triggers memory corruption related to handling of CString objects aka \Memory Allocation Vulnerability.\


Integer

overflow

in

Firebird

SQL

and

earlier

before

before

and

before

might

allow

remote

attackers

to

execute

arbitrary

code

via

crafted

and

XDR

requests

which

triggers

memory

corruption.


Integer overflow in Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via crafted arguments to the printSepsWithParams which triggers memory corruption.


Integer overflow in Adobe Shockwave Player before 11.5.9.620 allows remote attackers to execute arbitrary code via a Director movie with a large count value in 3D assets type 0xFFFFFF45 record which triggers a \faulty allocation\ and memory corruption.


Integer overflow in X MultiMedia System (xmms) 1.2.10 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image which triggers memory corruption.


An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function) there is an integer overflow on the result of integer addition (wraparound to 0) fed into the lsx_calloc macro that wraps malloc. When a NULL pointer is returned it is used without a prior check that it is a valid pointer leading to a NULL pointer dereference on lsx_readbuf in formats_i.c.

integer overflow
null pointer dereference


An issue was discovered in klibc before 2.0.9. An integer overflow in the cpio command may result in a NULL pointer dereference on 64-bit systems.


The image_alloc function in bpgenc.c in libbpg 0.9.7 has an integer overflow with a resultant invalid malloc and NULL pointer dereference.


In the Linux kernel before 5.2.3 set_geometry in drivers/block/floppy.c does not validate the sect and head fields as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.


There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application availability.


An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19 2.93.8 and 3.1.


An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by an integer overflow in the PNG filter.


TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.


Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.


Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.


libdxfrw 0.6.3 has an Integer Overflow in dwgCompressor::decompress18 in dwgutil.cpp leading to an out-of-bounds read and application crash.


libcurl

versions

from

to

before

is

vulnerable

to

a

heap

buffer

out-of-bounds

read.

The

function

handling

incoming

NTLM

messages

(`lib/vauth/ntlm.c:ntlm_decode_type2_target`)

does

not

validate

incoming

data

correctly

and

is

subject

to

an

integer

overflow

vulnerability.

Using

that

overflow

a

malicious

or

broken

NTLM

server

could

trick

libcurl

to

accept

a

bad

length

offset

combination

that

would

lead

to

a

buffer

read

out-of-bounds.


** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h contains multiple boundary checks that are performed to prevent out-of-bounds memory read/write. However two of these boundary checks contain an integer overflow that leads to a bypass of these checks and out-of-bounds read/write. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resultant invalid memory allocations and out-of-bounds reads) via an icon with many colors in its color map.


The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.


In all Qualcomm products with Android releases from CAF using the Linux kernel a race condition exists in an IOCTL handler potentially leading to an integer overflow and then an out-of-bounds write.


Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass (Peripheral Image Loader) PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR#1023638.


Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory locations via a negative maximum length value to the I_PEEK ioctl.


Integer signedness error in the cpufreq proc handler (cpufreq_procctl) in Linux kernel 2.6 allows local users to gain privileges.


Integer signedness error in the osf_sysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call.


Integer signedness error in the osf_getdomainname function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call.


Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper memory allocation aka \Publisher Signed Integer Vulnerability.\

integer signedness error
arbitrary code execution


Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.


Integer signedness error in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 allows remote attackers to execute arbitrary code via a crafted embedded Compact Font Format (CFF) font in a document.


Integer signedness error in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a signed integer value in the Content-Type header.


Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.


Integer signedness error in the myFseek function of samplein.c for Blade encoder (BladeEnc) 0.94.2 and earlier allows remote attackers to execute arbitrary code via a negative offset value following a \fmt\ wave chunk.


Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings.


Integer signedness error in vserver in SAP MaxDB 7.6.0.37 and possibly other versions allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption.


Integer signedness error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a negative BYWEEKNO property in a weekly RRULE variable in a VCALENDAR attachment in an e-mail message.


Integer signedness error in Apple Type Services (ATS) in Apple Mac OS X 10.7 before 10.7.2 allows remote attackers to execute arbitrary code via a crafted embedded Type 1 font in a document.


Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image which triggers a buffer overflow.

integer signedness error
buffer overflow
arbitrary code execution


Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier and 3.9.15 and earlier allows local users to execute arbitrary code via a large number of \;\ (semicolon) characters in escape sequences which leads to a buffer overflow.


Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen parameter which leads to a buffer overflow.


Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file leading to a heap-based buffer overflow as demonstrated using a BMP image.


Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values which lead to a heap-based buffer overflow.


Integer signedness error in DivX Web Player 1.4.2.7 and possibly earlier versions allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk which triggers a heap-based buffer overflow.


Integer signedness error in BOM in Apple Mac OS X before 10.5.6 allows remote attackers to execute arbitrary code via the headers in a crafted CPIO archive leading to a stack-based buffer overflow.


Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer which triggers insufficient memory allocation and a buffer overflow.


Integer signedness error in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP client request leading to a heap-based buffer overflow.


Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers a buffer underflow aka \Publisher Buffer Underflow Vulnerability.\

integer signedness error
buffer underflow
arbitrary code execution


Integer signedness error in the add_bytes_l2_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted PNG data.

integer signedness error
denial of service


Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted packet.


Integer signedness error in the dissect_headers function in epan/dissectors/packet-btobex.c in the Bluetooth OBEX dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Integer signedness error in the kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a crafted tty read operation.


Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request.


Integer signedness error in the DNP3 dissector in Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows remote attackers to cause a denial of service (long loop) via a malformed DNP3 packet.


Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local users to cause a denial of service (kernel panic) and possibly gain privileges via a certain argument related to ACE_SETACL.


Integer signedness error in the DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service (oops) via a negative optlen value.


Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password which triggers a large memory allocation.


Integer signedness error in the ax25_setsockopt function in net/ax25/af_ax25.c in the ax25 subsystem in the Linux kernel before 2.6.31.2 allows local users to cause a denial of service (OOPS) via a crafted optlen value in an SO_BINDTODEVICE operation.


Integer signedness error in the find_ie function in net/wireless/scan.c in the cfg80211 subsystem in the Linux kernel before 2.6.31.1-rc1 allows remote attackers to cause a denial of service (soft lockup) via malformed packets.


Integer signedness error in the decode_fh function of nfs3xdr.c in Linux kernel before 2.4.21 allows remote attackers to cause a denial of service (kernel panic) via a negative size value within XDR data of an NFSv3 procedure call.


Integer signedness error in the Linux Socket Filter implementation (filter.c) in Linux 2.4.3-pre3 to 2.4.22-pre10 allows attackers to cause a denial of service (crash).


Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact.


Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before 1.0.16 allows context-dependent attackers to cause a denial of service (crash) via a negative length value to the memset function.


Integer signedness error in Apple File Service (AFP Server) allows remote attackers to cause a denial of service (application crash) via a negative UAM string length in a FPLoginExt packet.


Integer signedness error in MIT Kerberos V5 ASN.1 decoder before krb5 1.2.5 allows remote attackers to cause a denial of service via a large unsigned data element length which is later used as a negative value.


Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.


Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font.

integer signedness error
denial of service
arbitrary code execution


Integer signedness error in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted stsz atom in a movie file.


Integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (write to kernel memory) via a crafted app.


Integer signedness error in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG movie file.


Integer signedness error in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTVR movie file.


Integer signedness error in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font table in a QuickTime movie file.


Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

integer signedness error
denial of service
buffer overflow


Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to cause a denial of service via a crafted packet that triggers a heap-based buffer overflow.


Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted slot value.


Integer signedness error in bspatch.c in bspatch in bsdiff as used in Apple OS X before 10.11.6 and other products allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

integer signedness error
denial of service
buffer overflow
arbitrary code execution


Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data which triggers a heap-based buffer overflow.


Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file that triggers a stack-based buffer overflow.


Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value which triggers an integer overflow and a buffer overflow.

integer signedness error
denial of service
integer overflow
buffer overflow


Integer signedness error in the AV engine before DAT 8145 as used in McAfee LiveSafe 14.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted packed executable.

integer signedness error
denial of service
memory corruption


Integer signedness error in Apple QuickTime before 7.6.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted panorama atom in a QuickTime Virtual Reality (QTVR) movie file.

integer signedness error
denial of service
memory corruption
arbitrary code execution


Integer signedness error in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a length value associated with the tSAC chunk in a Director movie.


Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value which leads to an integer overflow and heap-based buffer overflow.

integer signedness error
integer overflow
buffer overflow
arbitrary code execution


Multiple integer signedness errors in factory.cc in Google V8 before r3560 as used in Google Chrome before 4.0.249.89 allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.

integer signedness errors
arbitrary code execution


Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14 with SP4 allow remote attackers to execute arbitrary code via a long NTLMSSP argument that triggers a stack-based buffer overflow.

integer signedness errors
buffer overflow
arbitrary code execution


Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.

integer signedness errors
denial of service


Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.


Multiple integer signedness errors in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (infinite loop) via malformed messages.


Multiple integer signedness errors in libgadu as used in ekg before 1.6rc2 and other packages may allow remote attackers to cause a denial of service or execute arbitrary code.

integer signedness errors
denial of service
arbitrary code execution


In all Android releases from CAF using the Linux kernel an integer underflow vulnerability exists while processing the boot image.


Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel possibility of invalid memory access while processing driver command in WLAN function.


An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3.


An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.


An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dump_od_to_saf.isra function which causes a segmentation fault and application crash.


An invalid memory address dereference vulnerability exists in gpac 1.1.0 via the svg_node_start function which causes a segmentation fault and application crash.


An invalid memory address dereference was discovered in decompileSingleArgBuiltInFunctionCall in libming 0.4.8 before 2018-03-12. The vulnerability causes a segmentation fault and application crash which leads to denial of service.

invalid memory address
denial of service


An invalid memory address dereference was discovered in decompileGETVARIABLE in libming 0.4.8 before 2018-03-12. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


An invalid memory address dereference was discovered in the function getName in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


An invalid memory address dereference was discovered in strlenext in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


An invalid memory address dereference was discovered in getString in util/decompile.c in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


Anviz access control devices allow remote attackers to issue commands without a password.


The

wp-support-plus-responsive-ticket-system

plugin

before

for

WordPress

has

JavaScript

injection.


Windows Kernel Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-27093.


Windows Kernel Information Disclosure Vulnerability


Windows Kernel Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-28309.


Windows Kernel Information Disclosure Vulnerability.


In all Qualcomm products with Android releases from CAF using the Linux kernel using a debugfs node a write to a PCIe register can cause corruption of kernel memory.


In all Qualcomm products with Android releases from CAF using the Linux kernel in a camera driver ioctl a kernel overwrite can potentially occur.


An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. The MALI GPU Driver allows a kernel panic. The Samsung ID is SVE-2019-14372 (August 2019).


Foris before 101.1.1 as used in Turris OS lacks certain HTML escaping in the login template.


In Eigen NLP 3.10.1 a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest standard or admin) to view and modify information.


NETGEAR MR1100 devices before 12.06.08.00 are affected by lack of access control at the function level.


In WordPress before 4.7.5 there is a lack of capability checks for post meta data in the XML-RPC API.


A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated local attacker with physical access to view sensitive information on an affected device. The vulnerability is due to a lack of proper data-protection mechanisms for disk encryption keys that are used within the partitions on an affected device hard drive. An attacker could exploit this vulnerability by obtaining physical access to the affected device to view certain cleartext keys. A successful exploit could allow the attacker to execute a custom boot process or conduct further attacks on an affected device.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of check on input received to calculate the buffer length can lead to out of bound write to kernel stack.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of check of input received from userspace before copying into buffer can lead to potential array overflow in WLAN.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of input size validation before copying to buffer in PMIC function can lead to heap overflow.


Possible assertion due to lack of input validation in PUSCH configuration in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of check on the length of array while accessing can lead to an out of bound read in WLAN HOST function.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel lack of length validation check for value received from firmware can lead to OOB access in WLAN HOST.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9650 SD 650/52 SD 808 SD 810 SD 820 and SDX20 lack of proper bounds checking may lead to a buffer overread.


A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated local attacker to run arbitrary commands at system boot time with the privileges of root. The vulnerability is due to a lack of proper validation of system files when the persistent configuration information is read from the file system. An attacker could exploit this vulnerability by authenticating to the device and overwriting the persistent configuration storage with malicious executable files. An exploit could allow the attacker to run arbitrary commands at system startup and those commands will run as the root user. The attacker must have valid administrative credentials for the device.


Trendnet

version

lacks

proper

authentication

to

the

bittorrent

functionality.

If

enabled

anyone

is

able

to

visit

and

modify

settings

and

files

via

the

Bittorent

web

client

by

visiting:


In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker after sending a very large number of messages to be decrypted can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).


In Eclipse Mosquitto 1.4.14 a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.


IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to conduct link injection attacks via unspecified vectors.


A

Local

File

Inclusion

vulnerability

in

the

Nevma

Adaptive

Images

plugin

before

for

WordPress

allows

remote

attackers

to

retrieve

arbitrary

files

via

the

$REQUEST'adaptive-images-settings''source_file'

parameter

in

adaptive-images-script.php.


A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.


PHP local file inclusion vulnerability in index.php in IDevspot iSupport 1.8 allows remote attackers to include local files via the include_file parameter.


PHP local file inclusion vulnerability in gpg_pop_init.php in the G/PGP (GPG) Plugin before 20070707 for Squirrelmail allows remote attackers to include and execute arbitrary local files related to the MOD parameter.


A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files (execute PHP code) or read non-PHP files by replacing a helper.json file.


A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system.


A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2 exploitable by a low privileged user.


A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the running ExpertPDF process has access to read.


A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.


A local file inclusion vulnerability in B&R SiteManager versions <9.2.620236042 allows authenticated users to read sensitive files from SiteManager instances.


The local file inclusion vulnerability present in B&R SiteManager versions <9.2.620236042 allows authenticated users to impact availability of SiteManager instances.


A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1.


PHP local file inclusion vulnerability in (1) view.php and (2) open.php in osTicket 1.3.1 beta and earlier allows remote attackers to include and possibly execute arbitrary local files via the inc parameter.


A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

local file inclusion
arbitrary code execution


A local file inclusion vulnerability in ILIAS before 5.3.19 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data.


A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the \Accept-Language\ HTTP header. A remote attacker could use this flaw to cause a denial of service via specially-crafted request.


A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal as demonstrated by reading /etc/shadow.

local file inclusion
directory traversal


A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.


A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which if exploited would allow an attacker to manipulate a specific product feature to load a malicious service.


A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacker with local privileges could execute code with administrative privileges.


A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthorized code or commands via the parsing of the file.


A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attackers to execute unauthorized code or commands via the named pipe responsible for Forticlient updates.


A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over-permissive configuration settings and a SUID binary an attacker is able to execute arbitrary binaries as root.


A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to execute arbitrary programs with SYSTEM privileges.


A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4 which could allow an attacker to execute arbitrary code as a local administrator.

local privilege escalation
arbitrary code execution


A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthorized code or commands via the command injection.

local privilege escalation
command injection


A lock screen issue allowed access to photos and contacts on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.0.1.


A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.1.


A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.0.1.


A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 12.1.1. A local attacker may be able to share items from the lock screen.


A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1.


A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.


A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 15.1 and iPadOS 15.1. A local attacker may be able to view contacts from the lock screen.


A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. A local attacker may be able to view contacts from the lock screen.