Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value larger than is readable by PMSoft's fixed-length stack buffer. This can cause the buffer to be overwritten which may allow arbitrary code execution or cause the application to crash. CVSS v3 base score: 7.1; CVSS vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. Delta Electronics recommends affected users update to at least PMSoft v2.11 which was made available as of March 22 2018 or the latest available version.


An

issue

was

discovered

on

EDIMAX

through

through

and

through

devices.

The

binary

contains

a

stack-based

buffer

overflow

that

is

possible

to

trigger

from

a

remote

unauthenticated

/camera-cgi/public/getsysyeminfo.cgi?action=VALUE_HERE

HTTP

request:

if

the

length

is

more

than

it

is

possible

to

overwrite

other

values

located

on

the

stack

due

to

an

incorrect

use

of

the

strcpy()

function.


GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a.


Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an out-of-bounds write of an '{' or '' character.


An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parse_req_queries function in wanduck.c via a long string over UDP which may lead to an information leak.


LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.


Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.


WellinTech KingSCADA before 3.7.0.0.1 contains a stack-based buffer overflow. The vulnerability is triggered when sending a specially crafted packet to the AlarmServer (AEserver.exe) service listening on TCP port 12401.


A buffer overflow exists in HelpSystems tcpcrypt on Linux used for BoKS encrypted telnet through BoKS version 6.7.1. Since tcpcrypt is setuid exploitation leads to privilege escalation.


ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_wav_decode_ms_adpcm_data function in ok_wav.c.


In Mini-XML (aka mxml) v2.12 there is stack-based buffer overflow in the scan_file function in mxmldoc.c.


In radare2 prior to 3.1.2 the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.


GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.


An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface because there is a buffer overflow in the RCP+ parser of the web server.


In QEMU 3.1.0 load_device_tree in device_tree.c calls the deprecated load_image function which has a buffer overflow risk.


ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_csv_decode2 function in ok_csv.c.


DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file a related issue to CVE-2007-3068.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the \page\ parameter of the function \fromDhcpListClient\ for a request it is directly used in a sprintf to a local variable placed on the stack which overrides the return address of the function.


DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traffic is mishandled. Also local exploitation can occur via a crafted kernel image.


Info-ZIP UnZip 6.0 has a buffer overflow in list.c when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value because a buffer size is 10 and is supposed to be 12.


Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceList' parameter for a post request the value is directly used in a strcpy to a local variable placed on the stack which overrides the return address of the function.


Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.


A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4 Firefox ESR < 60.4 and Firefox < 64.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'ntpServer' parameter for a post request the value is directly used in a strcpy to a local variable placed on the stack which overrides the return address of the function.


Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the \ssid\ parameter for a post request the value is directly used in a strcpy to a local variable placed on the stack which overrides the return address of the function.


There exists a heap-based buffer overflow in vc1_decode_p_mb_intfi in vc1_block.c in Libav 12.3 which allows attackers to cause a denial-of-service via a crafted aac file.


The TK_set_deviceModel_req_handle function in the cloud communication component in Guardzilla GZ621W devices with firmware 0.5.1.4 has a Buffer Overflow.


There exists a heap-based buffer overflow in vc1_decode_i_block_adv in vc1_block.c in Libav 12.3 which allows attackers to cause a denial-of-service via a crafted aac file.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the \firewallEn\ parameter for a post request the value is directly used in a strcpy to a local variable placed on the stack which overrides the return address of the function.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request each value is directly used in a sprintf to a local variable placed on the stack which overrides the return address of the function.


Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.


DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled.


Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008.


Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceMac' parameter for a post request the value is directly used in a sprintf to a local variable placed on the stack which overrides the return address of the function.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. There is a heap-based buffer overflow vulnerability in the router's web server -- httpd. While processing the 'mac' parameter for a post request the value is directly used in a strcpy to a variable placed on the heap which can leak sensitive information or even hijack program control flow.


Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


M2SOFT Report Designer Viewer 5.0 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via a crafted MRD file.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the \page\ parameter of the function \fromAddressNat\ for a post request the value is directly used in a sprintf to a local variable placed on the stack which overrides the return address of the function.


An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly handles the answer received from a smart camera leading to a buffer overflow on the stack. An attacker can send a series of HTTP requests to trigger this vulnerability.


On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17 the video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The memcpy call overflows the destination buffer which has a size of 512 bytes. An attacker can send an arbitrarily long \url\ value in order to overwrite the saved-PC with 0x42424242.


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 a buffer overflow vulnerability exists in WLAN while processing the HTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP messages.


An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer which has a size of 52 bytes. An attacker can send an arbitrarily long \correlationId\ value in order to exploit this vulnerability.


On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17 the video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. A strcpy overflows the destination buffer which has a size of 40 bytes. An attacker can send an arbitrarily long \user\ value in order to exploit this vulnerability.


An exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted packet can cause a buffer overflow resulting in code execution. An attacker can intercept and alter network traffic to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer which has a size of 160 bytes. An attacker can send an arbitrarily long \directory\ value in order to exploit this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer which has a size of 32 bytes. An attacker can send an arbitrarily long \accessKey\ value in order to exploit this vulnerability.


In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42 specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


An exploitable heap-based buffer overflow vulnerability exists in the Windows enhanced metafile parser of Atlantis Word Processor version 3.2.5.0. A specially crafted image embedded within a document can cause an undersized allocation resulting in an overflow when the application tries to copy data into it. An attacker must convince a victim to open a document in order to trigger this vulnerability.


An exploitable uninitialized length vulnerability exists within the Word document-parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5. A specially crafted document can cause Atlantis to skip initializing a value representing the number of columns of a table. Later the application will use this as a length within a loop that will write to a pointer on the heap. Due to this value being controlled a buffer overflow will occur which can lead to code execution under the context of the application. An attacker must convince a victim to open a document in order to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer which has a size of 128 bytes. An attacker can send an arbitrarily long \secretKey\ value in order to exploit this vulnerability.


On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17 the video-core process insecurely extracts the fields from the \shard\ table of its SQLite database leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The strcpy call overflows the destination buffer which has a size of 16 bytes. An attacker can send an arbitrarily long \region\ value in order to exploit this vulnerability.


Buffer overflow can occur due to improper input validation in multiple WMA event handler functions in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer which has a size of 64 bytes. An attacker can send an arbitrarily long \bucket\ value in order to exploit this vulnerability.


On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17 the video-core process insecurely extracts the fields from the \shard\ table of its SQLite database leading to a buffer overflow on the stack. The strcpy call overflows the destination buffer which has a size of 128 bytes. An attacker can send an arbitrarily long \secretKey\ value in order to exploit this vulnerability.


Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


An exploitable stack-based buffer overflow vulnerability exists in the JPEG parser of Atlantis Word Processor version 3.2.5.0. A specially crafted image embedded within a document can cause a length to be miscalculated and underflow. This length is then treated as unsigned and then used in a copying operation. Due to the length underflow the application will then write outside the bounds of a stack buffer resulting in a buffer overflow. An attacker must convince a victim to open a document in order to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts the videoHostUrl field from a user-controlled JSON payload leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer which has a size of 136 bytes. An attacker can send an arbitrarily long 'directory' value in order to exploit this vulnerability. An attacker can send an HTTP request to trigger this vulnerability.


A

buffer

overflow

can

occur

while

processing

an

extscan

hotlist

event

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in

SD

SD

SD

SD

SD

SD


An exploitable buffer overflow vulnerability exists in the samsungWifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. The strcpy at 8 overflows the destination buffer which has a size of 40 bytes. An attacker can send an arbitrarily long 'callbackUrl' value in order to exploit this vulnerability.


An exploitable buffer overflow vulnerability exists in the camera \replace\ feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable out-of-bounds write vulnerability exists in the Word Document parser of the Atlantis Word Processor 3.0.2.3 3.0.2.5. A specially crafted document can cause Atlantis to write a value outside the bounds of a heap allocation resulting in a buffer overflow. An attacker must convince a victim to open a document in order to trigger this vulnerability.


An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. The vulnerability is present in the reading of a file without proper parameter checking. The value read in is not verified to be valid and its use can lead to a buffer overflow potentially resulting in code execution.


An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer which has a size of 52 bytes. An attacker can send an arbitrarily long \callbackUrl\ value in order to exploit this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer which has a size of 32 bytes. An attacker can send an arbitrarily long \accessKey\ value in order to exploit this vulnerability.


Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.


An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely parses the AWSELB cookie while communicating with remote video-host servers leading to a buffer overflow on the heap. An attacker able to impersonate the remote HTTP servers could trigger this vulnerability.


An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow resulting in code execution. The trans_info call can overwrite a buffer of size 0x104 which is more than enough to overflow the return address from the password_dst field


An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer which has a size of 2000 bytes. An attacker can send an arbitrarily long \sessionToken\ value in order to exploit this vulnerability.


An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer which has a size of 40 bytes. An attacker can send an arbitrarily long \password\ value in order to exploit this vulnerability.


An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow resulting in code execution. An attacker can make the camera scan a QR code to trigger this vulnerability. Alternatively a user could be convinced to display a QR code from the internet to their camera which could exploit this vulnerability.


An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 Firmware version 0.20.17. The strncpy call overflows the destination buffer which has a size of 52 bytes. An attacker can send an arbitrarily long 'endTime' value in order to exploit this vulnerability. An attacker can send an HTTP request to trigger this vulnerability.


In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux an exploitable stack-based buffer overflow exists in the DOC-to-HTML conversion functionality of the Hyland Perceptive Document Filters version 11.4.0.2647. A crafted .doc document can lead to a resulting in direct code execution.


An exploitable buffer overflow vulnerability exists in the camera 'update' feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.


Type mismatch for ie_len can cause the WLAN driver to allocate less memory on the heap due to implicit casting leading to a heap buffer overflow in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


In the ffghtb function in NASA CFITSIO 3.42 specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650 MDM9655 SD 835 SD 845 SD 850 the vswr capture size is larger than the maximum size of a diag logPacket which can lead to a buffer overflow when the sample buffer is copied to the logPacket buffer.


Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. A strncpy overflows the destination buffer which has a size of 16 bytes. An attacker can send an arbitrarily long \region\ value in order to exploit this vulnerability.


An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer which has a size of 40 bytes. An attacker can send an arbitrarily long \cameraIp\ value in order to exploit this vulnerability.


An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy call overflows the destination buffer which has a size of 52 bytes. An attacker can send an arbitrarily long \startTime\ value in order to exploit this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely extracts the fields from the \clips\ table of its SQLite database leading to a buffer overflow on the stack. An attacker can send a series of HTTP requests to trigger this vulnerability.


While sending a probe request indication in lim_send_sme_probe_req_ind() in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel a buffer overflow can occur.


An exploitable buffer overflow vulnerability exists in the camera \create\ feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the \state\ field from a user-controlled JSON payload leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.


In the ffghbn function in NASA CFITSIO 3.42 specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload leading to a buffer overflow on the stack. The strncpy overflows the destination buffer which has a size of 2 000 bytes. An attacker can send an arbitrarily long \sessionToken\ value in order to exploit this vulnerability.


An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow resulting in code execution. The trans_info call can overwrite a buffer of size 0x104 which is more than enough to overflow the return address from the ssid_dst field.


An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer which has a size of 64 bytes. An attacker can send an arbitrarily long \bucket\ value in order to exploit this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the database 'find-by-cameraId' functionality of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles existing records inside its SQLite database leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.


Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.


Buffer overflow in input handling in Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potentially deny service to the application via local access.


A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60 Thunderbird < 52.9 Firefox ESR < 60.1 Firefox ESR < 52.9 and Firefox < 61.


An issue was discovered in CCN-lite 2.0.1. There is a heap-based buffer overflow in mkAddToRelayCacheRequest and in ccnl_populate_cache for an array lacking '\\0' termination when reading a binary CCNx or NDN file. This can result in Heap Corruption. This was addressed by fixing the memory management in mkAddToRelayCacheRequest in ccn-lite-ctrl.c.


Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.


DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.


Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with for example a -h (aka hostname) argument from an untrusted source.


SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.


DISPUTED

in

Evolution-Data-Server

in

GNOME

Evolution

through

might

allow

attackers

to

trigger

a

Buffer

Overflow

via

a

long

query

that

is

processed

by

the

strcat

function.

NOTE:

the

software

maintainer

disputes

this

because

\the

code

had

computed

the

required

string

length

first

and

then

allocated

a

large-enough

buffer

on

the

heap.\


The webService binary on Insteon HD IP Camera White 2864-222 devices has a Buffer Overflow via a crafted pid pwd or usr key in a GET request on port 34100.


A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library used for WebGL content when working with the VertexBuffer11 module. This results in a potentially exploitable crash. This vulnerability affects Firefox < 64.


A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4 5.6.0 through 5.6.10 5.4.0 through 5.4.12 5.2.14 and earlier and FortiProxy 2.0.0 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.


While

deserializing

any

key

blob

during

key

operations

buffer

overflow

could

occur

exposing

partial

key

information

if

any

key

operations

are

invoked

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer overflow in the function H5FD_sec2_read in H5FDsec2.c related to HDread.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer overflow in the function H5G_ent_decode in H5Gent.c.


kernel could return a received message length higher than expected which leads to buffer overflow in a subsequent operation and stops normal operation in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables in MDM9150 MDM9206 MDM9607 MDM9650 MSM8909W QCS605 Qualcomm 215 SD 425 SD 439 / SD 429 SD 450 SD 625 SD 632 SD 675 SD 712 / SD 710 / SD 670 SD 820A SD 835 SD 845 / SD 850 SD 855 SDM439 SDX24 SM7150


EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer overflow in the function H5FD_sec2_read in H5FDsec2.c related to HDmemset.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer overflow in the function H5FL_blk_malloc in H5FL.c.


A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4 5.6.0 through 5.6.7 5.4 and earlier versions and FortiProxy 2.0.0 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service attack via special craft message payloads.


Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier STARDOM VDS R7.50 and earlier STARDOM FCN/FCJ Simulator R4.20 and earlier ASTPLANNER R15.01 and earlier TriFellows V5.04 and earlier) allows remote attackers to stop the license management function or execute an arbitrary program via unspecified vectors.


Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.


Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e. use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).


When

a

fake

broadcast/multicast

rmf

without

mmie

received

since

no

proper

length

check

in

buffer

overflow

will

happen

in

both

and

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

in


In

Snapdragon

(Automobile

Mobile

Wear)

in

version

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

a

potential

buffer

overflow

exists

when

parsing

TFTP

options.


Data

truncation

during

higher

to

lower

type

conversion

which

causes

less

memory

allocation

than

desired

can

lead

to

a

buffer

overflow

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Lack of buffer length check before copying in WLAN function while processing FIPS event can lead to a buffer overflow in Snapdragon Mobile in version SD 845.


Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear in versions MDM9206 MDM9607 MDM9650 MSM8996AU SD 210/SD 212/SD 205 SD 410/12 SD 425 SD 430 SD 450 SD 625 SD 650/52 SD 820 SD 820A SD 835 SDA660.


SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys function.


An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.


Lack

of

check

of

input

size

can

make

device

memory

get

corrupted

because

of

buffer

overflow

in

snapdragon

automobile

snapdragon

mobile

and

snapdragon

wear

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel possible buffer overflow while incrementing the log_buf of type uint64_t in memcpy function since the log_buf pointer can access the memory beyond the size to store the data after pointer increment.


Buffer overflow can happen in WLAN module due to lack of validation of the input length in Snapdragon Mobile in version SD 845 SD 850 SDA660.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing SET_PASSPOINT_LIST vendor command HDD does not make sure that the realm string that gets passed by upper-layer is NULL terminated. This may lead to buffer overflow as strlen is used to get realm string length to construct the PASSPOINT WMA command.


Lack of input validation while copying to buffer in WLAN will lead to a buffer overflow in Snapdragon Mobile in version SD 835 SD 845 SD 850 SDA660.


m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.


A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.


Improper check while accessing the local memory stack on MQTT connection request can lead to buffer overflow in snapdragon wear in versions MDM9206 MDM9607


If an end user makes use of SCP11 sample OCE code without modification it could lead to a buffer overflow when transmitting a CAPDU in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT and Snapdragon Mobile in versions MDM9607 MDM9650 MDM9655 MSM8996AU SD 210/SD 212/SD 205 SD 410/12 SD 636 SD 820 SD 820A SD 835 SD 8CX SDA660 SDM630 SDM660.


The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.


md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely of backslash escapes.


Buffer overflow if the length of passphrase is more than 32 when setting up secure NDP connection in Snapdragon Mobile in version SD 835 SD 845 SD 850 SDA660.


Data

length

received

from

firmware

is

not

validated

against

the

max

allowed

size

which

can

result

in

buffer

overflow.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wired

Infrastructure

and

Networking

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0


ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.


Improper input validation leads to buffer overflow while processing network list offload command in WLAN function in Snapdragon Mobile in version SD 835 SD 845 SD 850 SDA660


Improper

input

validation

for

argument

received

from

HLOS

can

lead

to

buffer

overflows

and

unexpected

behavior

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Lack of check of buffer size before copying in a WLAN function can lead to a buffer overflow in Snapdragon Mobile in version SD 845 SD 850.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Possible buffer overflow in TX and RX FIFOs of microcontroller in camera subsystem used to exchange commands and messages between Micro FW and CPP driver.


Lack

of

check

on

length

parameter

may

cause

buffer

overflow

while

processing

WMI

commands

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.


A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions) SINUMERIK 808D V4.8 (All versions) SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1) SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5) SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A buffer overflow in the service command application could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.


Buffer overflow can happen in WLAN function due to lack of validation of the input length in Snapdragon Mobile in version SD 845 SD 850 SDA660.


The GDASPAMLib.AntiSpam ActiveX control ASK\\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument.


Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.


An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However the same functionality allows an attacker to execute commands on the device. The POST parameter \iw_serverip\ is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters it is possible for an attacker to execute the attack.


A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16 4.7.9 and 4.8.4 are vulnerable.


AVEVA InduSoft Web Studio v8.1 and v8.1SP1 and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag alarm or event related actions such as read and write with potential for code to be executed.


An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However the same functionality allows an attacker to execute commands on the device. The POST parameter \srvName\ is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters it is possible for an attacker to execute the attack.


bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. The affected component is bacserv BACnet/IP BVLC forwarded NPDU. The function bvlc_bdt_forward_npdu() calls bvlc_encode_forwarded_npdu() which copies the content from the request into a local in the bvlc_bdt_forward_npdu() stack frame and clobbers the canary. The attack vector is: A BACnet/IP device with BBMD enabled based on this library connected to IP network. The fixed version is: 0.8.6.


blktrace (aka Block IO Tracing) 1.2.0 as used with the Linux kernel and Android has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small as demonstrated by an invalid free when using the btt program with a crafted file.


Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors a different vulnerability than CVE-2017-16725.


WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple stack-based buffer overflow vulnerabilities that can be exploited when the application processes specially crafted project files.


All Phoenix Contact managed FL SWITCH 3xxx 4xxx 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies (a different vulnerability than CVE-2018-10728).


DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH).


WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple heap-based buffer overflow vulnerabilities that can be exploited when the application processes specially crafted project files.


An issue was discovered on Moxa AWK-3121 1.14 devices. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. However the same functionality allows an attacker to execute commands on the device. The POST parameters \to1 to2 to3 to4\ are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters it is possible for an attacker to execute the attack.


An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However the same functionality allows an attacker to execute commands on the device. The POST parameter \iw_filename\ is susceptible to buffer overflow. By crafting a packet that contains a string of 162 characters it is possible for an attacker to execute the attack.


All Phoenix Contact managed FL SWITCH 3xxx 4xxx 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows (a different vulnerability than CVE-2018-10731).


Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.


It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.


An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function in libraw_cxx.cpp.


pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative replaying a specially crafted PCAP file can trigger a stack-based buffer overflow leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.


IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe. IBM X-force ID: 148687.


Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged this leads to privilege escalation.


The IBM Power 9 OP910 OP920 and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large malicious replacement it could cause the bootloader during the load of that image to overwrite its own instruction memory and circumvent secure boot protections install trojans etc. IBM X-Force ID: 154345.


procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora) the impact is limited to a crash.


IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that would result in a kernel panic. IBM X-Force ID: 154207.


RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the authentication agent and cause a denial-of-service situation.


nasm version 2.14.01rc5 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that can result in Stack-overflow caused by triggering endless macro generation crash the program. This attack appear to be exploitable via a crafted nasm input file.


soundtouch

version

up

to

and

including

contains

a

Buffer

Overflow

vulnerability

in

SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock()

that

can

result

in

arbitrary

code

execution.

This

attack

appear

to

be

exploitable

via

victim

must

open

maliocius

file

in

soundstretch

utility.


GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified this could lead to RCE. This attack appear to be exploitable via an attacker supplied MP4 file that when run by the victim may result in RCE.


Rust

Programming

Language

Rust

standard

library

version

Commit

and

later;

stable

release

and

later

contains

a

Buffer

Overflow

vulnerability

in

std::collections::vec_deque::VecDeque::reserve()

function

that

can

result

in

Arbitrary

code

execution

but

no

proof-of-concept

exploit

is

currently

published..

This

vulnerability

appears

to

have

been

fixed

in

after

commit

stable

release

and

later.


Marlin Firmware Marlin version 1.1.x and earlier contains a Buffer Overflow vulnerability in cardreader.cpp (Depending on branch/version) that can result in Arbitrary code execution. This attack appear to be exploitable via Crafted G-Code instruction/file is sent to the printer.


jsish version 2.4.70 2.047 contains a Buffer Overflow vulnerability in function _jsi_evalcode from jsiEval.c that can result in Crash due to segmentation fault. This attack appear to be exploitable via The victim must execute crafted javascript code.


pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0 leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.


BusyBox

project

BusyBox

wget

version

prior

to

commit

contains

a

Buffer

Overflow

vulnerability

in

Busybox

wget

that

can

result

in

heap

buffer

overflow.

This

attack

appear

to

be

exploitable

via

network

connectivity.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75 function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..


An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data.


A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `ykpiv_transfer_data()`: {% highlight c %} if(*out_len + recv_len - 2 > max_out) { fprintf(stderr \Output buffer to small wanted to write %lu max was %lu.\ *out_len + recv_len - 2 max_out); } if(out_data) { memcpy(out_data data recv_len - 2); out_data += recv_len - 2; *out_len += recv_len - 2; } {% endhighlight %} -- it is clearly checked whether the buffer is big enough to hold the data copied using `memcpy()` but no error handling happens to avoid the `memcpy()` in such cases. This code path can be triggered with malicious data coming from a smartcard.


Tenda AC7 through V15.03.06.44_CN AC9 through V15.03.05.19(6318)_CN and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.


Buffer

overflow

in

in

in

the

Wi-Fi

driver

on

the

Samsung

Galaxy

allow

an

attacker

(who

has

obtained

code

execution

on

the

Wi-Fi

chip)

to

cause

the

device

driver

to

perform

invalid

memory

accesses.

The

Samsung

ID

is


An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image because a length value may be negative.


The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().


An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.


Buffer overflow in prot_get_ring_space in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (who has obtained code execution on the Wi-Fi chip) to overwrite kernel memory due to improper validation of the ring buffer read pointer. The Samsung ID is SVE-2018-12029.


An issue was discovered in libgig 4.1.0. There is a heap-based buffer overflow in pData1 access in the function store16 in helper.h.


In Philips PageWriter TC10 TC20 TC30 TC50 TC70 Cardiographs all versions prior to May 2018 the PageWriter device does not sanitize data entered by user. This can lead to buffer overflow or format string vulnerabilities.


An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.


Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the \hook\ URL parameter.


An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.


An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7) AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9) and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the list parameters for a post request the value is directly written with sprintf to a local variable placed on the stack which overrides the return address of the function causing a buffer overflow.


An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7) AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9) and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the page parameters for a post request the value is directly written with sprintf to a local variable placed on the stack which overrides the return address of the function a causing buffer overflow.


An issue was discovered in libgig 4.1.0. There is a heap-based buffer overflow in the function RIFF::Chunk::Read in RIFF.cpp.


An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters leading to a stack-based buffer overflow.


A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw privilege escalation cannot be fully ruled out although we believe it is highly unlikely. Kernel versions 4.18.x 4.14.x and 3.10.x are believed to be vulnerable.


GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).


DeltaV Versions 11.3.1 12.3.1 13.3.0 13.3.1 and R5 is vulnerable to a buffer overflow exploit through an open communication port to allow arbitrary code execution.


samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used possibly leading to a buffer overflow.


An issue was discovered in libgig 4.1.0. There is a heap-based buffer overflow in pData1 access in the function store32 in helper.h.


Buffer

overflow

in

in

in

the

Wi-Fi

driver

on

the

Samsung

Galaxy

allow

an

attacker

(who

has

obtained

code

execution

on

the

Wi-Fi)

chip

to

cause

the

device

driver

to

perform

invalid

memory

accesses.

The

Samsung

ID

is


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 while processing HTT_T2H_MSG_TYPE_RX_FLUSH or HTT_T2H_MSG_TYPE_RX_PN_IND messages a buffer overflow can occur if the tid value obtained from the firmware is out of range.


If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie() a buffer overflow occurs in all Android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the Linux kernel.


While processing the HTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND message a buffer overflow can potentially occur in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


Lack

of

checking

input

size

can

lead

to

buffer

overflow

In

WideVine

in

snapdragon

automobile

snapdragon

mobile

and

snapdragon

wear

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


A boundary error within the \quicktake_100_load_raw()\ function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash.


Stack-based

buffer

overflow

in

the

function

in

on

ASUS

routers

(when

using

software

from

allows

web

authenticated

attackers

to

execute

code

via

a

request

that

updates

a

setting.

In

the

length

of

the

variable

is

not

checked

as

long

as

it

includes

a

substring.


If the seq_len is greater then CSR_MAX_RSC_LEN a buffer overflow in __wlan_hdd_cfg80211_add_key() may occur when copying keyRSC in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


Buffer overflow in WLAN driver event handlers due to improper validation of array index in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in MDM9206 MDM9607 MDM9640 MDM9650 MSM8996AU QCS405 QCS605 SD 636 SD 675 SD 730 SD 820A SD 835 SD 855 SDA660 SDM630 SDM660 SDX20 SDX24


While parsing an mp4 file a buffer overflow can occur in Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear.


While processing a compressed kernel image a buffer overflow can occur in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


While sending the response to a RIL_REQUEST_GET_SMSC_ADDRESS message a buffer overflow can occur in Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear.


Possible

buffer

overflow

in

DRM

Trusted

application

due

to

lack

of

check

function

return

values

in

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 improper buffer length validation in extscan hotlist event can lead to potential buffer overflow.


Lack of checking input size can lead to buffer overflow In WideVine in snapdragon automobile and snapdragon mobile in versions MSM8996AU SD 425 SD 430 SD 450 SD 625 SD 712 / SD 710 / SD 670 SD 820 SD 820A SD 835 SD 845 / SD 850 SDA660 SDX24 SXR1130


Improper validation of buffer length checks in the lwm2m device management protocol can leads to a buffer overflow in snapdragon mobile and snapdragon wear in versions MDM9206 MDM9607 SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 450 SD 625 SD 636 SD 835 SDA660 SDM630 SDM660


While parsing an mp4 file a stack-based buffer overflow can occur in Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear.


** DISPUTED ** Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName SqlPswd Database UserName or Password field in a SilentInstall XML document. NOTE: the vendor disputes this issue because neither a buffer overflow nor a crash can be reproduced; also reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework.


Dokan versions between 1.0.0.5000 and 1.2.0.1000 are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.


While loading dynamic fonts a buffer overflow may occur if the number of segments in the font file is out of range in Snapdragon Mobile and Snapdragon Wear.


Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15 4.2.0 -> 4.2.8 4.3.0 -> 4.3.6 4.4.0


The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buffer Overflow.


A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8 Thunderbird < 52.8 and Firefox ESR < 52.8.


Improper data length check while processing an event report indication can lead to a buffer overflow in snapdragon mobile and snapdragon wear in versions MDM9206 MDM9607 SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 450 SD 625 SD 636 SD 835 SDA660 SDM630 SDM660


Buffer

overflow

in

WLAN

function

due

to

improper

check

of

buffer

size

before

copying

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

in

SD

SD

SD

SD

SD

SD

SD

SD

SD


In the function csr_update_fils_params_rso() insufficient validation on a key length can result in an integer underflow leading to a buffer overflow in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro ProConOS v.4.01.280 firmware: CWM v.05.78.00 and prior. A stack-based buffer overflow vulnerability caused by sending crafted packets on Port 20547 could force the PLC to change its state into halt mode.


A buffer overflow can occur when manipulating the SVG \animatedPathSegList\ through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.7 Firefox ESR < 52.7 and Firefox < 59.


An exploitable code execution vulnerability exists in Wi-Fi Command 9999 of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow resulting in code execution. An attacker can send a packet to trigger this vulnerability.


An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow resulting in code execution. An attacker can send a packet to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bc_http_read_header incorrectly handles overlong headers leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud server to trigger this vulnerability.


An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow resulting in code execution.


An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow resulting in code execution. An attacker can send a packet to trigger this vulnerability.


D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.


Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability by sending a crafted HTTP request to broadweb/system/opcImg.asp.


Various Lexmark devices have a Buffer Overflow (issue 1 of 2).


TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header.


Various Lexmark devices have a Buffer Overflow (issue 2 of 2).


The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.


The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate.


An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically this issue occurs while converting an HDF5 file to a GIF file.


An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwrite the return address.


Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.


InduSoft Web Studio versions prior to 8.1 SP2 and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote attacker could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag alarm or event related actions such as read and write with potential for code to be executed. If InduSoft Web Studio remote communication security was not enabled or a password was left blank a remote user could send a carefully crafted packet to invoke an arbitrary process with potential for code to be executed. The code would be executed under the privileges of the InduSoft Web Studio or InTouch Edge HMI runtime and could lead to a compromise of the InduSoft Web Studio or InTouch Edge HMI server machine.


An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route a very long password could lead to a stack-based buffer overflow and overwrite the return address.


An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex pdftex dvips or luatex.


Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.


An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow with control over the bytes written.


A buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within processing of IOCTL 0x22205C by the tmnciesc.sys driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


In CCN-lite 2 the function ccnl_prefix_to_str_detailed can cause a buffer overflow when writing a prefix to the buffer buf. The maximal size of the prefix is CCNL_MAX_PREFIX_SIZE; the buffer has the size CCNL_MAX_PREFIX_SIZE. However when NFN is enabled additional characters are written to the buffer (e.g. the \NFN\ and \R2C\ tags). Therefore sending an NFN-R2C packet with a prefix of size CCNL_MAX_PREFIX_SIZE can cause an overflow of buf inside ccnl_prefix_to_str_detailed.


A buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within processing of IOCTL 0x222060 by the tmnciesc.sys driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.


An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the \CloudMe Sync\ client application listening on port 8888 can send a malicious payload causing a buffer overflow condition. This will result in an attacker controlling the program's execution flow and allowing arbitrary code execution.


Buffer overflow in Hanwha Techwin Smartcams


The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.


Some NVIDIA Tegra mobile processors released prior to 2016 contain a buffer overflow vulnerability in BootROM Recovery Mode (RCM). An attacker with physical access to the device's USB and the ability to force the device to reboot into RCM could exploit the vulnerability to execute unverified code.


An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message a buffer overflow may happen. This can be used to execute code remotely.


HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code execution. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.


An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the \CloudMe Sync\ client application listening on 127.0.0.1 port 8888 can send a malicious payload causing a buffer overflow condition. This will result in code execution as demonstrated by a TCP reverse shell or a crash. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-6892.


GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c a different vulnerability than CVE-2018-1000100.


In Eaton ELCSoft versions 2.04.02 and prior there are multiple cases where specially crafted files could cause a buffer overflow which in turn may allow remote execution of arbitrary code.


Parsing malformed project files in Omron CX-One versions 4.42 and prior including the following applications: CX-FLnet versions 1.00 and prior CX-Protocol versions 1.992 and prior CX-Programmer versions 9.65 and prior CX-Server versions 5.0.22 and prior Network Configurator versions 3.63 and prior and Switch Box Utility versions 1.68 and prior may cause a stack-based buffer overflow.


A Buffer Overflow issue was discovered in Asterisk through 13.19.1 14.x through 14.7.5 and 15.x through 15.2.1 and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed despite having a fixed limit of 32. If more than 32 Accept headers were present the code would write outside of its memory and cause a crash.


A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.


The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user.


HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001 on Windows. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.


Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to execute code remotely via a specially crafted GET request without a leading \/\ and without authentication.


A buffer overflow can be triggered in LeviStudio HMI Editor Version 1.10 part of Wecon LeviStudioU 1.8.29 and PI Studio HMI Project Programmer Build: November 11 2017 and prior by opening a specially crafted file.


The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.


A buffer overflow vulnerability exists in Schneider Electric's Modicon M340 Modicon Premium Modicon Quantum PLC BMXNOR0200. The buffer overflow vulnerability is caused by the length of the source string specified (instead of the buffer size) as the number of bytes to be copied.


In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69 a buffer overflow vulnerability exist in cgi program \set\.


Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.


An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow.


An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in next_string in os/storage/antelope/aql-lexer.c while parsing AQL (parsing next string).


An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c the mail_to parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it.


The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices has a Buffer Overflow.


An issue was discovered on Tenda AC7 V15.03.06.44_CN AC9 V15.03.05.19(6318)_CN AC10 V15.03.06.23_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server. While processing the ssid parameter for a POST request the value is directly used in a sprintf call to a local variable placed on the stack which overrides the return address of the function causing a buffer overflow.


MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file.


An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/storage/antelope/aql-parser.c while parsing AQL (storage of relations).


An issue was discovered in mgetty before 1.2.1. In contrib/scrts.c a stack-based buffer overflow can be triggered via a command-line parameter.


libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmpr_read_rle_internal function in imagew-bmp.c.


An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operator in os/storage/antelope/lvm.c.


stb stb_image.h 2.19 as used in catimg Emscripten and other products has a heap-based buffer overflow in the stbi__out_gif_code function.


An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow in lvm_set_type in os/storage/antelope/lvm.c while parsing AQL (lvm_set_op lvm_set_relation lvm_set_operand).


An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c the command-line parameter username is passed unsanitized to strcpy() which can cause a stack-based buffer overflow.


The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in the arr crate through 2020-08-25 for Rust. There is a buffer overflow in Index and IndexMut.


In Pillow before 8.1.0 TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.


A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web panel) allows an attacker to inject IP addresses into the whitelist via the checkedList parameter to the delete command.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c.


NETGEAR WAC104 devices before 1.0.4.13 are affected by a buffer overflow by an authenticated user.


A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example by convincing a user to open a file in an application using cairo or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality integrity as well as system availability.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


** DISPUTED ** DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020 not the 20.12.1 release. In this situation it should NOT be considered a Poppler vulnerability. However several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times and therefore the CVE remains useful to users of those projects.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Export/Import function. This vulnerability allows attackers to escalate local process privileges via a crafted ef2 file.


pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream.


pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.


An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service Memory Disclosure and Possible Code Execution.


pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch.


When uploading a file in Sysax Multi Server 6.90 an authenticated user can modify the filename=\\ parameter in the uploadfile_name1.htm form to a length of 368 or more bytes. This will create a buffer overflow condition causing the application to crash.


pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.


Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.


Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.


Buffer overflow in Core FTP LE v2.2 allows local attackers to cause a denial or service (crash) via a long string in the Setup->Users->Username editbox.


Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.


A heab based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:46.


A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function of the httpd module that can cause code execution when an attacker constructs malicious data.


** DISPUTED ** uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor's position is that this is \a minor issue or not even an issue at all\ because the developer of an application (that uses uWebSockets) should not be allowing the large number of triggered topics to accumulate.


Incorrect handling of input data in mysofa_resampler_reset_mem function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and overwriting large memory block.


matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4).


libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.


ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read a different vulnerability than CVE-2021-20235.


Incorrect handling of input data in loudness function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and access to unallocated memory block.


A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \one-shot\ decompression request to a script can trigger a crash which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update we recommend to use the \streaming\ API as opposed to the \one-shot\ API and impose chunk size limits.


eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.


An issue was discovered in Squid before 4.10. Due to incorrect buffer management a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy.


opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case a different issue than CVE-2020-6851.


In OSSEC-HIDS 2.7 through 3.5.0 the server component responsible for log analysis (ossec-analysisd) is vulnerable to a heap-based buffer overflow in the rootcheck decoder component via an authenticated client.


In OSSEC-HIDS 2.7 through 3.5.0 the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow during the cleaning of crafted syslog msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).


The implementation of realpath in libuv < 10.22.1 < 12.18.4 and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.


DISPUTED

A

heap-based

buffer

overflow

in

the

libexe_io_handle_read_coff_optional_header

function

of

libyal

libexe

before

NOTE:

the

vendor

has

disputed

this

as

described

in

libyal/libexe

issue

on

GitHub.


An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes a buffer overflow and possibly a crash can happen when a new mode is set for a nick.


Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. A function in a module does not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device.


HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02) versions earlier than 10.1.0.126(C10E11R5P1) and versions earlier than 10.1.0.160(C00E160R2P8) have a buffer overflow vulnerability. The software access data past the end or before the beginning of the intended buffer when handling certain operations of certificate the attacker should trick the user into installing a malicious application successful exploit may cause code execution.


HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) and versions earlier than 10.1.0.160(C01E160R2P8) have a buffer overflow vulnerability. An attacker induces users to install malicious applications and sends specially constructed packets to affected devices after obtaining the root permission. Successful exploit may cause code execution.


An issue was discovered on Realtek RTL8195AM RTL8711AM RTL8711AF and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.


There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflow. The attacker should trick the user into installing and running a malicious application with a high privilege successful exploit may cause code execution. Affected product include Huawei HONOR 20 PRO Mate 20 Mate 20 Pro Mate 20 X P30 P30 Pro Hima-L29C Laya-AL00EP Princeton-AL10B Tony-AL00B Yale-L61A Yale-TL00B and YaleP-AL10B.


An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi() which processes cgi requests supplied to the device's web servers is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with CVE-2020-9277.


Adobe Bridge versions 10.0 have a heap-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution.


fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup webpage parameter when f_radius_ip1 is malformed.


Adobe Character Animator versions 3.2 and earlier have a buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution.


Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account the attacker sends a specific DDNS test command which may cause the device to go down.


fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup_Wizard webpage parameter when f_radius_ip1 is malformed.


IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr.


The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data resulting in a buffer overflow.


In Live Networks Inc. liblivemedia version 20200625 there is a potential buffer overflow bug in the server handling of a RTSP \PLAY\ command when the command specifies seeking by absolute time.


Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23 and V4320_FW_0_31 units feature an autodiscovery service implemented in the binary executable '/usr/sbin/DM' that listens on port TCP 6666. The service is vulnerable to a stack buffer overflow. It is worth noting that this service does not require any authentication.


Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.


Acrobat Reader DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file in Acrobat Reader.


An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore when copying an address of an arbitrary length a buffer overflow can occur. This bug can be exploited whenever NAT64 is enabled.


An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute until it automatically reboots. Attackers can send malicious requests once a minute effectively disabling the device.


An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated heap-based buffer overflow in the function CNetClientTalk::OprMsg during incoming message handling.


Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger.


An issue was discovered on Samsung mobile devices with O(8.x) P(9.0) and Q(10.0) (Exynos chipsets) software. The baseband component has a buffer overflow via an abnormal SETUP message leading to execution of arbitrary code. The Samsung ID is SVE-2020-18098 (September 2020).


WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution.


A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network who can forge DNS replies such as that they are accepted as valid could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5) SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). The web server of the affected devices contains a vulnerability that may lead to a buffer overflow condition. An attacker could cause this condition on the webserver by sending a specially crafted request. The webserver could stop and not recover anymore.


** DISPUTED ** A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated \this will not happen in practice.\


An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientManage::ServerIP_Proto_Set during incoming message handling.


A heap-based buffer overflow vulnerability exists within the WECON LeviStudioU Release Build 2019-09-21 and prior when processing project files. Opening a specially crafted project file could allow an attacker to exploit and execute code under the privileges of the application.


WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution.


499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.


An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientGuard::SubOprMsg during incoming message handling.


A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network who can create valid DNS replies could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However in some code execution paths it is possible extract_name() gets passed an offset from the base buffer thus reducing in practice the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CFtpProtocol::FtpLogin during the update procedure.