usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.


In the Lustre file system before 2.12.3 the ptlrpc module has an out-of-bounds read and panic due to the lack of validation for specific fields of packets sent by a client. The ldl_request_cancel function mishandles a large lock_count parameter.


The

library

in

npdf.dll

in

Nitro

Free

PDF

Reader

has

a

Out-of-Bounds

Read

via

crafted

Unicode

content.


In Libarchive 3.4.0 archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example bsdtar crashes via a crafted archive.


An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However this is not true when dealing with small images leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.


In libIEC61850 1.4.0 getNumberOfElements in mms/iso_mms/server/mms_access_result.c has an out-of-bounds read vulnerability related to bufPos and elementLength.


In the Linux kernel 5.0.21 mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).


typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern for example in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)


In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com) mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttm_put_pages in drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related to the vmwgfx or ttm module.


In libIEC61850 1.4.0 BerDecoder_decodeUint32 in mms/asn1/ber_decode.c has an out-of-bounds read related to intLen and bufPos.


typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern for example in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)


An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Read in Indexing or a Heap Overflow and crash during handling of certain PDF files that embed specifically crafted 3D content due to an array access violation.


Delta Industrial Automation CNCSoft CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the software to crash due to lacking user input validation for processing project files.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. A malicious application may be able to determine kernel memory layout.


An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost the return code is used as an address leading to an Access Violation because of an out-of-bounds read.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2 watchOS 5.1.3. A malicious application may be able to determine kernel memory layout.


An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver version 26.20.13001.29010. A specially crafted pixel shader can cause out-of-bounds memory read. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest affecting VMware host.


VMware ESXi (6.7 before ESXi670-201903001 6.5 before ESXi650-201903001 6.0 before ESXi600-201903001) Workstation (15.x before 15.0.4 14.x before 14.1.7) Fusion (11.x before 11.0.3 10.x before 10.1.6) contain an out-of-bounds read/write vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual machine with a virtual USB controller present. This issue may allow a guest to execute code on the host.


There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database to crash.


Gauss100 OLTP database in ManageOne with versions of 6.5.0 have an out-of-bounds read vulnerability due to the insufficient checks of the specific packet length. Attackers can construct invalid packets to attack the active and standby communication channels. Successful exploit of this vulnerability could allow the attacker to crash the database on the standby node.


In FreeBSD 12.0-STABLE before r350246 12.0-RELEASE before 12.0-RELEASE-p8 11.3-STABLE before r350247 11.3-RELEASE before 11.3-RELEASE-p1 and 11.2-RELEASE before 11.2-RELEASE-p12 the emulated XHCI device included with the bhyve hypervisor did not properly validate data provided by the guest allowing an out-of-bounds read. This provides a malicious guest the possibility to crash the system or access system memory.


In FreeBSD 12.0-STABLE before r350648 12.0-RELEASE before 12.0-RELEASE-p9 11.3-STABLE before r350650 11.3-RELEASE before 11.3-RELEASE-p2 and 11.2-RELEASE before 11.2-RELEASE-p13 the ICMPv6 input path incorrectly handles cases where an MLDv2 listener query packet is internally fragmented across multiple mbufs. A remote attacker may be able to cause an out-of-bounds read or write that may cause the kernel to attempt to access an unmapped page and subsequently panic.


Mate20 Huawei smartphones versions earlier than HMA-AL00C00B175 have an out-of-bounds read vulnerability. An attacker with a high permission runs some specific commands on the smartphone. Due to insufficient input verification successful exploit may cause out-of-bounds read of the memory and the system abnormal.


There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2.


MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.


Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability which may allow an attacker to read limited information from the device.


An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.


An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.


Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).


In WebAccess/SCADA Versions 8.3.5 and prior an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation of this vulnerability may allow disclosure of information.


Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00.


in

the

Linux

kernel

through

has

an

out-of-bounds

read

via

crafted

USB

device

traffic

(which

may

be

remote

via

usbip

or

usbredir).


GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV in GPMF_Next in GPMF_parser.c.


The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file a different vulnerability than CVE-2019-11472.


An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions there is an out-of-bounds read.


An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation leading to an out-of-bounds read that can be used as part of a chain to escalate privileges (issue 2 of 2).


An issue was discovered in the Linux kernel before 5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an out-of-bounds read because data structures are incompletely updated after a change from smb30 to smb21.


DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h.


An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page boundary.


An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation leading to an out-of-bounds read that can be used as part of a chain to escalate privileges (issue 1 of 2).


libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.


An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case aka VD-1302.


An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case aka VD-1301.


When

attempting

to

create

a

new

XFRM

policy

a

stack

out-of-bounds

read

will

occur

if

the

user

provides

a

template

where

the

mode

is

set

to

a

value

that

does

not

resolve

to

a

valid

XFRM

mode

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in


In

the

Linux

kernel

before

in

the

SNMP

NAT

module

has

insufficient

length

checks

(aka

an

array

index

error)

making

out-of-bounds

read

and

write

operations

possible

leading

to

an

OOPS

or

local

privilege

escalation.

This

affects

and


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c when called from pex64_get_runtime_function in pei-x86_64.c.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds read problem with a SEGV in the function ReadNextCell() in mat5.c.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function bit_read_B at bits.c.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds read with a SEGV in the function Mat_VarReadNextInfo5() in mat5.c.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function dwg_dxf_BLOCK_CONTROL at dwg.spec.


Symonics libmysofa 0.7 has an out-of-bounds read in directblockRead in hdf/fractalhead.c.


Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.


do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.


UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. A malicious application may be able to determine kernel memory layout.


An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.5 Security Update 2019-003 High Sierra Security Update 2019-003 Sierra watchOS 5.2 macOS Mojave 10.14.4 Security Update 2019-002 High Sierra Security Update 2019-002 Sierra iOS 12.2. A remote attacker may be able to leak memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iCloud for Windows 7.12 tvOS 12.3 iTunes 12.9.5 for Windows macOS Mojave 10.14.5 Security Update 2019-003 High Sierra Security Update 2019-003 Sierra iOS 12.3. Processing a maliciously crafted font may result in the disclosure of process memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1 Safari 12.1.1 iTunes for Windows 12.9.5 iCloud for Windows 7.12. Processing maliciously crafted web content may result in the disclosure of process memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15 iOS 13 iCloud for Windows 7.14 iCloud for Windows 10.7 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6 iTunes 12.10.1 for Windows. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 macOS Catalina 10.15. A local user may be able to cause unexpected system termination or read kernel memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4 macOS Mojave 10.14.6 tvOS 12.4 watchOS 5.3. Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution.


A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.


An out-of-bounds read flaw was found in the CLARRV DLARRV SLARRV and ZLARRV functions in lapack through version 3.10.0 as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.


An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.


Adobe InDesign versions 16.3 (and earlier) and 16.3.1 (and earlier) are affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.


Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.


Wasmtime

is

an

open

source

runtime

for

WebAssembly

WASI.

In

Wasmtime

from

version

and

before

version

is

affected

by

a

memory

unsoundness

vulnerability.

There

was

an

invalid

free

and

out-of-bounds

read

and

write

bug

when

running

Wasm

that

uses

`externref`s

in

Wasmtime.

To

trigger

this

bug

Wasmtime

needs

to

be

running

Wasm

that

uses

`externref`s

the

host

creates

non-null

`externrefs`

Wasmtime

performs

a

garbage

collection

(GC)

and

there

has

to

be

a

Wasm

frame

on

the

stack

that

is

at

a

GC

safepoint

where

there

are

no

live

references

at

this

safepoint

and

there

is

a

safepoint

with

live

references

earlier

in

this

frame's

function.

Under

this

scenario

Wasmtime

would

incorrectly

use

the

GC

stack

map

for

the

safepoint

from

earlier

in

the

function

instead

of

the

empty

safepoint.

This

would

result

in

Wasmtime

treating

arbitrary

stack

slots

as

`externref`s

that

needed

to

be

rooted

for

GC.

At

the

*next*

GC

it

would

be

determined

that

nothing

was

referencing

these

bogus

`externref`s

(because

nothing

could

ever

reference

them

because

they

are

not

really

`externref`s)

and

then

Wasmtime

would

deallocate

them

and

run

`<ExternRef

as

Drop>::drop`

on

them.

This

results

in

a

free

of

memory

that

is

not

necessarily

on

the

heap

(and

shouldn't

be

freed

at

this

moment

even

if

it

was)

as

well

as

potential

out-of-bounds

reads

and

writes.

Even

though

support

for

`externref`s

(via

the

reference

types

proposal)

is

enabled

by

default

unless

you

are

creating

non-null

`externref`s

in

your

host

code

or

explicitly

triggering

GCs

you

cannot

be

affected

by

this

bug.

We

have

reason

to

believe

that

the

effective

impact

of

this

bug

is

relatively

small

because

usage

of

`externref`

is

currently

quite

rare.

This

bug

has

been

patched

and

users

should

upgrade

to

Wasmtime

version

If

you

cannot

upgrade

Wasmtime

at

this

time

you

can

avoid

this

bug

by

disabling

the

reference

types

proposal

by

passing

`false`

to

`wasmtime::Config::wasm_reference_types`.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file.


IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38102.


FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read which may allow an attacker to read unauthorized information.


IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file.


Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file.


IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38105.


Certain NETGEAR devices are affected by out-of-bounds reads and writes. This affects R6400 before 1.0.1.70 RAX75 before 1.0.4.120 RAX80 before 1.0.4.120 and XR300 before 1.0.3.50.


UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file.


An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand.


CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file.


An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited this vulnerability allows attackers to read sensitive information on the system. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.2 build 20210122 on QSW-M2108-2C; versions prior to 1.0.2 build 20210122 on QSW-M2108-2S; versions prior to 1.0.2 build 20210122 on QSW-M2108R-2C.


Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


After Effects versions 18.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an out-of-bounds read vulnerability. An unauthenticated attacker could leverage this vulnerability achieve arbitrary read / write system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to leak sensitive system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe After Effects version 18.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to get access to sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20155 (and earlier) 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Out-of-bounds read vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20155 (and earlier) 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bounds Read vulnerability in the PDFLibTool component. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose potential sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Media Encoder version 15.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11 Firefox < 89 and Firefox ESR < 78.11.


An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.


There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.


GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.


There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.


There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.


An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.


An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.


An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. A crafted HTTP request can lead to an out-of-bounds read that crashes the application.


Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious RGB file.


Adobe Audition versions 14.4 (and earlier) and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MOV file.


An out-of-bounds read vulnerability exists when reading a TGA file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after loading TGA files. An unchecked input data from a crafted TGA file leads to an out-of-bounds read. An attacker can leverage this vulnerability to execute code in the context of the current process.


An out-of-bounds read vulnerability exists when reading a TIF file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after loading TIF files. An unchecked input data from a crafted TIF file leads to an out-of-bounds read. An attacker can leverage this vulnerability to execute code in the context of the current process.


Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specific project file which may allow an attacker to disclose information.


An out-of-bounds read vulnerability exists when reading a BMP file using Open Design Alliance (ODA) Drawings Explorer before 2022.12. The specific issue exists after loading BMP files. Unchecked input data from a crafted BMP file leads to an out-of-bounds read. An attacker can leverage this vulnerability to execute code in the context of the current process.


Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SGI file.


Adobe Audition versions 14.4 (and earlier) and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file.


Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.


A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 resulting in a denial-of-service condition or local memory overwrite.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.


Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files allowing an attacker to craft a special project file that may permit arbitrary code execution.


Cscape (All versions prior to 9.90 SP3.5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.


Multiple out-of-bounds read issues have been identified in the way the application processes project files allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).


A CWE-125:Out-of-Bounds Read vulnerability exists that could cause unintended data disclosure when a malicious *.gd1 configuration file is loaded into the GUIcon tool. Affected Product: Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) and prior


A vulnerability has been identified in NX 1980 Series (All versions < V1984) Solid Edge SE2021 (All versions < SE2021MP8). The plmxmlAdapterIFC.dll contains an out-of-bounds read while parsing user supplied IFC files which could result in a read past the end of an allocated buffer. This could allow an attacker to cause a denial-of-service condition or read sensitive information from memory locations.


MediaTek microchips as used in NETGEAR devices through 2021-11-11 and other devices mishandle the WPS (Wi-Fi Protected Setup) protocol. (Affected Chipsets MT7603E MT7610 MT7612 MT7613 MT7615 MT7620 MT7622 MT7628 MT7629 MT7915; Affected Software Versions 7.4.0.0; Out-of-bounds read).


Adobe Bridge versions 11.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted .SGI file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Audition version 14.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe After Effects version 18.2.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


libfetch before 2021-07-26 as used in apk-tools xbps and other products mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does the for-loop condition checks for the '\\0' terminator one byte too late.


Adobe Illustrator version 25.2.3 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe After Effects version 18.2.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Character Animator version 4.2 (and earlier) is affected by an out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Animate version 21.0.3 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi may be able to trigger a heap out-of-bounds read in OpenSLP service resulting in a denial-of-service condition.


Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to locally escalate privileges in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to arbitrary disclosure of information in the memory stack. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Contiki-NG is an open-source cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (uncompress_hdr_iphc) does not perform proper boundary checks when reading from the packet buffer. Hence it is possible to construct a compressed 6LoWPAN packet that will read more bytes than what is available from the packet buffer. As of time of publication there is not a release with a patch available. Users can apply the patch for this vulnerability out-of-band as a workaround.


Adobe Framemaker version 2020.0.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to locally elevate privileges in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


MediaTek microchips as used in NETGEAR devices through 2021-11-11 and other devices mishandle the WPS (Wi-Fi Protected Setup) protocol. (Affected Chipsets MT7603E MT7610 MT7612 MT7613 MT7615 MT7620 MT7622 MT7628 MT7629 MT7915 Affected Software Versions 7.4.0.0; Out-of-bounds read).


An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or read sensitive information from memory locations.


An

Out-of-Bounds

Read

was

discovered

in

in

the

Linux

kernel

through

because

of

the

lack

of

a

check

for

a

value

that

shouldn't

be

negative

e.g.

access

to

element

of

an

array

aka


Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.


Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.


An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of-service condition or read sensitive information from memory locations.


MediaTek microchips as used in NETGEAR devices through 2021-11-11 and other devices mishandle the WPS (Wi-Fi Protected Setup) protocol. (Affected Chipsets MT7603E MT7610 MT7612 MT7613 MT7615 MT7620 MT7622 MT7628 MT7629 MT7915; Affected Software Versions 7.4.0.0; Out-of-bounds read).


Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of service condition or read sensitive information from memory.


abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.


Acrobat Animate versions 21.0.9 (and earlier)is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.


Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation without checking the upper bounds of the source of the copy operation.


Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted .jpe file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation without checking the lower bounds of the source of the copy operation.


Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted SGI file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.


An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode in j2ku_gray_i.


An issue was discovered in Pillow before 8.1.1. In TiffDecode.c there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.


An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode in j2ku_graya_la.


An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.


An Out-of-bounds Read vulnerability exists in the OBJ file reading procedure in Open Design Alliance Drawings SDK before 2022.11. The lack of validating the input length can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Dimension versions 3.4.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.


An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file (an invalid dash counter in line types) can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exists within the parsing of U3D files. Incorrect use of the LibJpeg source manager inside the U3D library and crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.


kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory leading to local privilege escalation to root. In particular there is a corner case where the off reg causes a masking direction change which then results in an incorrect final aux->alu_limit.


An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure).


An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property() as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.


Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project files which may allow an attacker to disclose information.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.0.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.7 macOS Big Sur 11.5 watchOS 7.6 tvOS 14.7 Security Update 2021-004 Catalina. Processing a maliciously crafted font file may lead to arbitrary code execution.


A local user may be able to cause unexpected system termination or read kernel memory. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina. An out-of-bounds read issue was addressed by removing the vulnerable code.


Adobe Acrobat Reader DC version 21.007.20095 (and earlier) 21.007.20096 (and earlier) 20.004.30015 (and earlier) and 17.011.30202 (and earlier) is affected by a out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.


Adobe Character Animator version 4.4 (and earlier versions) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


There is an out-of-bounds read vulnerability in the IFAA module. Successful exploitation of this vulnerability may cause stack overflow.


XMP Toolkit SDK versions 2021.07 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.


Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker which triggers an out-of-bounds read.


The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters which triggers an out-of-bounds read.


sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36 5.5.x through 5.5.20 and 5.6.x through 5.6.4 when mmap is used to read a .php file does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.


wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-of-bounds read when an error occurs related to not checking the return code and MAC verification failure.


The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails which allows remote attackers to have unspecified impact via a crafted HMAC which triggers an out-of-bounds read.


The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0 when running with the CURLOPT_COPYPOSTFIELDS option does not properly copy HTTP POST data for an easy handle which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.


** DISPUTED ** In kernel/compat.c in the Linux kernel before 3.17 as used in Google Chrome OS and other products there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable.


Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length possibly related to an out-of-bounds read.


Moddable

commit

before

was

discovered

to

contain

an

out-of-bounds

read

via

the

function

at


ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.


An integer underflow in the DDS loader of Blender leads to an out-of-bounds read possibly allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19 2.93.8 and 3.1.


Out-of-bounds

Read

in

function

in

GitHub

repository

prior

to

The

bug

causes

the

program

reads

data

past

the

end

the

intented

buffer.

Typically

this

can

allow

attackers

to

read

sensitive

information

from

other

memory

locations

or

cause

a

crash.

More

details

see

Out-of-bounds


ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file allowing a possible out-of-bounds read condition.


LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624 allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit b4e79bfa.


LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619 allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit b4e79bfa.


An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.


Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC version 22.001.2011x (and earlier) 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC version 22.001.2011x (and earlier) 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Framemaker versions 2029u8 (and earlier) and 2020u4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by an out-of-bounds read vulnerability when processing a doc object which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 23.1.1 (and earlier) and 22.5.5 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.


An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files leading to a heap out-of-bounds read.


Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.5 macOS Monterey 12.3 Security Update 2022-003 Catalina. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Logic Pro 10.7.3 GarageBand 10.4.6 macOS Monterey 12.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.6.5 macOS Monterey 12.3 Security Update 2022-003 Catalina. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.


Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


swtpm is a libtpms-based TPM emulator with socket character device and Linux CUSE interface. Versions prior to 0.5.3 0.6.2 and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state where the blobheader's hdrsize indicator has an invalid value may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3 v0.6.2 or v0.7.1 to receive a patch. There are currently no known workarounds.


In Wind River VxWorks 6.9 and 7 a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario.


Adobe Premiere Rush versions 2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call leading to an out-of-bounds read.


An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data leading to an out-of-bounds read.


elfspirit is an ELF static analysis and injection framework that parses manipulates and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1 there is an out-of-bounds read bug which can lead to application crashes or information leakage. By constructing a special format ELF file the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.


The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.


The ecryptfs_write_metadata_to_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory.


An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Version 1.1 1.5 and 1.6. A third-party component used in the pump reads memory out of bounds causing the communications module to crash. Smiths Medical assesses that the crash of the communications module would not impact the operation of the therapeutic module.


OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread as demonstrated by the 8-opencv-invalid-read-fread test case.


libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.


libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.


In The Sleuth Kit (TSK) 4.4.2 opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a as demonstrated by fls.


In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.


An out-of-bounds read and write flaw was found in the way SIPcrack 0.2 processed SIP traffic because 0x00 termination of a payload array was mishandled. A remote attacker could potentially use this flaw to crash the sipdump process by generating specially crafted SIP traffic.


An out-of-bounds read flaw related to the assess_packet function in eapmd5pass.c:211 was found in the way eapmd5pass 1.4 handled processing of network packets. A remote attacker could potentially use this flaw to crash the eapmd5pass process under certain circumstances by generating specially crafted network traffic.


A length validation (leading to out-of-bounds read and write) flaw was found in the way eapmd5pass 1.4 handled network traffic in the extract_eapusername function. A remote attacker could potentially use this flaw to crash the eapmd5pass process by generating specially crafted network traffic.


Adobe Acrobat and Reader versions 2017.012.20098 and earlier 2017.011.30066 and earlier 2015.006.30355 and earlier 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


An out-of-bounds read flaw related to the assess_packet function in eapmd5pass.c:134 was found in the way eapmd5pass 1.4 handled processing of network packets. A remote attacker could potentially use this flaw to crash the eapmd5pass process under certain circumstances by generating specially crafted network traffic.


In

PHP

before

before

and

before

an

error

in

the

date

extension's

parsing

code

could

be

used

by

attackers

able

to

supply

date

strings

to

leak

information

from

the

interpreter

related

to

out-of-bounds

reads

affecting

the

function.

NOTE:

the

correct

fix

is

in

the

commit

not

the

gist.


If an SSL/TLS server or client is running on a 32-bit host and a specific cipher is being used then a truncated packet can cause that server or client to perform an out-of-bounds read usually resulting in a crash. For OpenSSL 1.1.0 the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2 the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.


libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive related to lha_crc16.


read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives leading to an out-of-bounds read in archive_read_format_rar_read_header.


The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file which triggers an out-of-bounds read.


Huawei

IPS

Module

MAX

PRESENCE

NGFW

Module

Secospace

Secospace

ViewPoint

have

an

out-of-bounds

read

vulnerability

in

protocol.

An

unauthenticated

remote

attacker

may

send

crafted

packets

to

the

affected

products.

Due

to

insufficient

verification

of

the

packets

successful

exploit

will

cause

process

reboot.


SFTP

module

in

Huawei

has

an

out-of-bounds

read

vulnerability.

A

remote

authenticated

attacker

could

exploit

this

vulnerability

by

sending

specially

crafted

messages

to

a

target

device.

Successful

exploit

may

cause

some

information

leak.


Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability. An unauthenticated remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets successful exploitation may cause process reboot.


function

in

Huawei

Quidway

Quidway

Quidway

has

an

out-of-bounds

read

vulnerability.

An

unauthenticated

attacker

may

send

crafted

malformed

packets

to

the

affected

products.

Due

to

insufficient

verification

of

the

packets

successful

exploit

will

cause

device

to

reset.


Some Huawei Smartphones with software of VNS-L21AUTC555B141 have an out-of-bounds read vulnerability. Due to the lack string terminator of string an attacker tricks a user into installing a malicious application and the application can exploit the vulnerability and make attacker to read out of bounds and possibly cause the device abnormal.


Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

ViewPoint

has

an

out-of-bounds

read

vulnerability

in

protocol.

An

unauthenticated

remote

attacker

could

craft

malformed

packets

with

specific

parameters

and

send

the

packets

to

the

affected

products.

Due

to

insufficient

validation

of

packets

which

could

be

exploited

to

cause

process

crash.


The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory aka a write_mmio stack-based out-of-bounds read related to arch/x86/kvm/x86.c and include/trace/events/kvm.h.


Some Huawei Smartphones with software of VNS-L21AUTC555B141 VNS-L21C10B160 VNS-L21C66B160 VNS-L21C703B140 have an array out-of-bounds read vulnerability. Due to the lack verification of array an attacker tricks a user into installing a malicious application and the application can exploit the vulnerability and make attacker to read out of bounds of array and possibly cause the device abnormal.


SCCPX

module

in

Huawei

has

an

out-of-bounds

read

vulnerability.

An

unauthenticated

remote

attacker

crafts

malformed

packets

with

specific

parameter

to

the

affected

products.

Due

to

insufficient

validation

of

packets

successful

exploitation

may

impact

availability

of

product

service.


Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability due to the improper processing of malformed H323 messages. A remote attacker that controls a server could exploit this vulnerability by sending malformed H323 reply messages to a target device. Successful exploit could make the device read out of bounds and probably make a service unavailable.


In PHP before 5.6.32 7.x before 7.0.25 and 7.1.x before 7.1.11 an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.


An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.


An out-of-bounds read when an HTTP/2 connection to a servers sends \DATA\ frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipsets allows attackers to have unspecified impact via unknown vectors which trigger an out-of-bounds read aka SVE-2016-6362.


An out-of-bounds read while processing SVG content in \ConvolvePixel\. This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content which could then displayed. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc.


An issue was discovered in Oniguruma 6.2.0 as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference as an out-of-bounds read from a stack buffer.


An issue was discovered in Oniguruma 6.2.0 as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.


Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.


MAX PRESENCE V100R001C00 TP3106 V100R002C00 TP3206 V100R002C00 have an out-of-bounds read vulnerability in H323 protocol. An attacker logs in to the system as a user and send crafted packets to the affected products. Due to insufficient verification of the packets successful exploit will cause process reboot.


The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64 1.2.x before 1.2.54 and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file which triggers an out-of-bounds read.


mini_httpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long protocol string which triggers an incorrect response size calculation and an out-of-bounds read.


The stringprep_utf8_to_ucs4 function in libin before 1.31 as used in jabberd2 allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string which triggers an out-of-bounds read.


Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99 1.0.x before 1.0.66 1.1.x and 1.2.x before 1.2.56 1.3.x and 1.4.x before 1.4.19 and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image which triggers an out-of-bounds read.


idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input which triggers an out-of-bounds read.


The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message which triggers an out-of-bounds read.


The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read.


The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation in Mozilla Firefox 4.x through 13.0 Thunderbird 5.0 through 13.0 and SeaMonkey before 2.11 might allow remote attackers to obtain sensitive information from process memory via a crafted color profile that triggers an out-of-bounds read operation.


The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0 Firefox ESR 10.x before 10.0.3 Thunderbird before 3.1.20 and 5.0 through 10.0 Thunderbird ESR 10.x before 10.0.3 and SeaMonkey before 2.8 might allow remote attackers to obtain sensitive information from process memory via vectors that trigger an out-of-bounds read.


An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call as demonstrated by sadf.


The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file as demonstrated by wvunpack.


An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call as demonstrated by sadf.


An issue was discovered on Samsung mobile devices with M(6.0) N(7.x) and O(8.0) (Exynos chipsets) software. A kernel driver allows out-of-bounds Read/Write operations and possibly arbitrary code execution. The Samsung ID is SVE-2018-11358 (May 2018).


Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).


An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer possibly accessing anything that was left on the stack or even past the end of the 8193-byte buffer depending on the value of accepted_payload_size.


An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes and while these bytes are skipped the total frame length was not re-checked to make sure they were present in the frame.


GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_extractor.c related to EXTRACTOR_common_convert_to_utf8 in common/convert.c.


An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds read.


In radare2 through 3.1.3 the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-service (application crash via an r_num_calc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c a related issue to CVE-2018-20459.


URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address such as a \//::44.1\ address.


In radare2 through 3.1.3 the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c a related issue to CVE-2018-20457.


In radare2 prior to 3.1.1 r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting an input file.


In radare2 prior to 3.1.1 core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.


Xfce Thunar 1.6.15 when Xfce 4.12 is used mishandles the IBus-Unikey input method for file searches within File Manager leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.


There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPDF 1.14.0 as demonstrated by mutool.


A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. This vulnerability affects Firefox < 65.


An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read which can disclose sensitive memory content and aid in exploitation when coupled with another vulnerability. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60 Thunderbird < 52.9 Firefox ESR < 60.1 Firefox ESR < 52.9 and Firefox < 61.


An issue was discovered in the HDF HDF5 1.8.20 library. There is an out-of-bounds read in the function H5VM_memcpyvv in H5VM.c.


An issue was discovered in PHP before 5.6.36 7.0.x before 7.0.30 7.1.x before 7.1.17 and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\\0' character.


An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in libraw_x3f.cpp and libraw_cxx.cpp.


jsish version 2.4.70 2.047 contains a CWE-125: Out-of-bounds Read vulnerability in function jsi_ObjArrayLookup (jsiObj.c:274) that can result in Crash due to segmentation fault. This attack appear to be exploitable via The victim must execute crafted javascript code. This vulnerability appears to have been fixed in 2.4.71.


CopyData in AxmlParser.c in AXML Parser through 2018-01-04 has an out-of-bounds read.


An issue was discovered in libgig 4.1.0. There is an out-of-bounds read in the \always assign the sample of the first dimension region of this region\ feature of the function gig::Region::UpdateChunks in gig.cpp.


An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1 &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data data + 1 + offs outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.


trim_whitespace in lexer.l in libConfuse v3.2.1 has an out-of-bounds read.


Delta Electronics Delta Industrial Automation PMSoft v2.11 or prior has an out-of-bounds read vulnerability that can be executed when processing project files which may allow an attacker to read confidential information.


An issue was discovered in libgig 4.1.0. There is an out-of-bounds read in the \update dimension region's chunks\ feature of the function gig::Region::UpdateChunks in gig.cpp.


An issue was discovered in libgig 4.1.0. There is an out-of-bounds read in the function RIFF::Chunk::Read in RIFF.cpp.


If websocket data is sent with mixed text and binary in a single message the binary data can be corrupted. This can result in an out-of-bounds read with the read memory sent to the originating server in response. This vulnerability affects Firefox < 60.


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 in function wma_wow_wakeup_host_event() wake_info->vdev_id is received from FW and is used directly as array index to access wma->interfaces whose max index should be (max_bssid-1). If wake_info->vdev_id is greater than or equal to max_bssid an out-of-bounds read occurs.


In iOS before 11.4 iCloud for Windows before 7.5 watchOS before 4.3.1 iTunes before 12.7.5 for Windows and macOS High Sierra before 10.13.5 an out-of-bounds read was addressed with improved input validation.


An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.


Adobe Acrobat and Reader versions 2018.009.20050 and earlier 2017.011.30070 and earlier and 2015.006.30394 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.


cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.


VMware Horizon 6 (6.x.x before 6.2.7) Horizon 7 (7.x.x before 7.5.1) and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privileged process running on a system where Horizon Connection Server Horizon Agent or Horizon Client are installed. Note: This issue doesn't apply to Horizon 6 7 Agents installed on Linux systems or Horizon Clients installed on non-Windows systems.


VMware ESXi (6.7 before ESXi670-201810101-SG 6.5 before ESXi650-201808401-BG and 6.0 before ESXi600-201808401-BG) Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds read vulnerability in SVGA device. This issue may allow a guest to execute code on the host.


soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00 and libopenmpt before 0.3.6 has an out-of-bounds read via a malformed STP file.


The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).


An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276 WhatsApp Business for Android prior to 2.18.99 WhatsApp for iOS prior to 2.18.100.6 WhatsApp Business for iOS prior to 2.18.100.2 and WhatsApp for Windows Phone prior to 2.18.224.


A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580 Modicon M340 Modicon Quantum and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus.


GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c related to utf8_str().


GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.


A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() store_sm_boundary_item() Edge_of.A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.


A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume() OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_objects Edge_of.


An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.


A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->boundary_entry_objects Sloop_of. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() sfh->center_vertex().


A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() store_sm_boundary_item() Sloop_of OOB read. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger this vulnerability.


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sface() SD.link_as_face_cycle().


Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sloop() slh->facet().


An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt aka CID-51c19bf3d5cf.