The kernel in Apple iOS before 8.3 Apple OS X before 10.10.3 and Apple TV before 7.2 does not properly handle TCP headers which allows man-in-the-middle attackers to cause a denial of service via unspecified vectors.


Skia as used in Google Chrome before 27.0.1453.110 does not properly handle GPU acceleration which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Skia as used in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement.


kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.


kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations.


kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars.


kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling.


Google Chrome before 10.0.648.127 does not properly handle counter nodes which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 7.0.517.41 does not properly handle animated GIF images which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted image.


Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow could cause memory corruption which might lead to denial of service or code execution.


Memory corruption due to invalid value of total dimension in the non-histogram type KPI could lead to a denial of service in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Mobile


An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.


fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2 when GCC 9 is used allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64 aka CID-59c4bd853abc.


Memory corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.


udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload because of mishandling of padded packets aka the \GRO packet of death\ issue.


Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service will cause a vulnerable device to crash. A memory corruption has been identified in the way of how the embedded device parsed the IPP packets


Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044 0x80102050 and 0x80102054 which allows local users to cause a denial of service (system crash) or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.


Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted AVI file.


goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products does not properly synchronize updates to a global variable which allows local users to bypass intended access restrictions or cause a denial of service (memory corruption) via crafted arguments to the procfs write handler.


Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice_engine/channel.cc in libjingle in WebRTC as used in Google Chrome before 31.0.1650.48 and other products allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger the absence of certain statistics initialization leading to the skipping of a required DeRegisterExternalTransport call.


The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16 as used in Google Chrome before 32.0.1700.102 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of \popular pages.\


The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations a different vulnerability than CVE-2013-4511.


net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.


The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted comment in a GIF image.


The Linux kernel before 3.12 when UDP Fragmentation Offload (UFO) is enabled does not properly initialize certain data structures which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.


Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.


ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.


Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries. NOTE: this issue is due to an incomplete fix for CVE-2013-4466.


The xenDaemonListDefinedDomains function in xen/xend_internal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service (memory corruption and crash) via vectors involving the virConnectListDefinedDomains API function.


Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS share mount operation that triggers use of an unexpected DFS referral name length.


goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products relies on user-space length values for kernel-memory copies of procfs file content which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that provides crafted values.


Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.


Mozilla Firefox before 20.0 and SeaMonkey before 2.17 when gfx.color_management.enablev4 is used do not properly handle color profiles during PNG rendering which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a grayscale PNG image.


The IndexedDB implementation in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


in

Google

Chrome

before

on

Mac

OS

X

does

not

use

an

appropriate

buffer

size

for

the

kHz

sampling

rate

which

allows

remote

attackers

to

cause

a

denial

of

service

(memory

corruption

and

application

crash)

or

possibly

have

unspecified

other

impact

via

a

web

site

that

provides

WebRTC

audio.


The USB Apps API in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.


The Web Audio implementation in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X does not properly implement web audio nodes which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.


Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.


The Developer Tools API in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The Web Audio implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The sandbox protection mechanism in Microsoft Internet Explorer 9 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors as demonstrated against Adobe Flash Player by VUPEN during a Pwn2Own competition at CanSecWest 2013.


The OSIsoft PI Interface for IEEE C37.118 before 1.0.6.158 allows remote attackers to cause a denial of service (memory consumption or memory corruption instance shutdown and data-collection outage) via crafted C37.118 configuration packets.


Cisco Aironet 3600 access points allow remote attackers to cause a denial of service (memory corruption and device crash) by disrupting Cisco Wireless LAN Controller communication and consequently forcing many transitions from FlexConnect mode to Standalone mode aka Bug ID CSCuh71210.


Cisco IOS XR allows local users to cause a denial of service (Silicon Packet Processor memory corruption improper mutex handling and device reload) by starting an outbound flood of large ICMP Echo Request packets and stopping this with a CTRL-C sequence aka Bug ID CSCui60347.


The Windows NAT Driver (aka winnat) service in Microsoft Windows Server 2012 does not properly validate memory addresses during the processing of ICMP packets which allows remote attackers to cause a denial of service (memory corruption and system hang) via crafted packets aka \Windows NAT Denial of Service Vulnerability.\


The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r28p0 before r29p0 Valhall r19p0 through r28p0 before r29p0 and Midgard r8p0 through r30p0.


In RT regmap driver there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10 Android-11; Patch ID: ALPS05453809.


Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service in BlueCore


In PHP versions 7.3.x below 7.3.29 7.4.x below 7.4.21 and 8.0.x below 8.0.8 when using Firebird PDO driver extension a malicious database server could cause crashes in various database functions such as getAttribute() execute() fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes denial of service or potentially memory corruption.


Small HTTP Server ver 3.06 contains a memory corruption bug causing a memory overflow. The overflowed buffer crashes into a Structured Exception Handler resulting in a Denial of Service.


Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service via (1) a malformed MGCP packet which causes a device hang aka CSCsf08998; a malformed H.323 packet which causes a device crash as identified by (2) CSCsi60004 with Proxy Unregistration and (3) CSCsg70474; and a malformed Real-time Transport Protocol (RTP) packet which causes a device crash as identified by (4) CSCse68138 related to VOIP RTP Lib and (5) CSCse05642 related to I/O memory corruption.


Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8 Thunderbird before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption or assert errors.


IBM DB2 UDB 9.1 before Fixpak 4 does not properly manage storage of a list containing authentication information which might allow attackers to cause a denial of service (instance crash) or trigger memory corruption. NOTE: the vendor description of this issue is too vague to be certain that it is security-related.


Apple Safari Beta 3.0.1 for Windows public beta allows remote attackers to cause a denial of service (crash) via unspecified DHTML manipulations that trigger memory corruption as demonstrated using Hamachi.


Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR and possibly other versions and platforms allows remote attackers to cause a denial of service (memory corruption and crash) via an Office file with crafted document summary information which causes an error in Ole32.dll.


The Adobe PDF specification 1.3 as implemented by Apple Mac OS X Preview allows remote attackers to have an unknown impact possibly including denial of service (infinite loop) arbitrary code execution or memory corruption via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.


The shared_region_map_file_np function in Apple Mac OS X 10.4.8 and earlier kernel allows local users to cause a denial of service (memory corruption) via a large mappingCount value.


The Intel 2200BG 802.11 Wireless Mini-PCI driver 9.0.3.9 (w29n51.sys) allows remote attackers to cause a denial of service (system crash) via crafted disassociation packets which triggers memory corruption of \internal kernel structures \ a different vulnerability than CVE-2006-6651. NOTE: this issue might overlap CVE-2006-3992.


The Adobe PDF specification 1.3 as implemented by Adobe Acrobat before 8.0.0 allows remote attackers to have an unknown impact possibly including denial of service (infinite loop) arbitrary code execution or memory corruption via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.


The Adobe PDF specification 1.3 as implemented by (a) xpdf 3.0.1 patch 2 (b) kpdf in KDE before 3.5.5 (c) poppler before 0.5.4 and other products allows remote attackers to have an unknown impact possibly including denial of service (infinite loop) arbitrary code execution or memory corruption via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.


The

function

in

in

the

driver

for

the

Linux

kernel

as

used

in

Qualcomm

Innovation

Center

(QuIC)

Android

contributions

for

MSM

devices

and

other

products

does

not

validate

a

certain

id

value

which

allows

attackers

to

gain

privileges

or

cause

a

denial

of

service

(memory

corruption)

via

an

application

that

makes

a

crafted

ioctl

call.


The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.


pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a crafted string as demonstrated by packets encountered by Suricata during use of a regular expression in an Emerging Threats Open ruleset.


The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03 as used in Google Chrome before 40.0.2214.91 calculates certain values without ensuring that they can be represented in a 24-bit field which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string a related issue to CVE-2014-7923.


** DISPUTED ** The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable.


The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za 1.0.0 before 1.0.0m and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.


The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet.


libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data.


The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.


The push_ascii function in smbd in Samba 3.6.x before 3.6.24 4.0.x before 4.0.19 and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode leading to a character-set conversion failure that triggers an invalid pointer dereference.


Juniper

Junos

OS

through

before

before

before

before

before

and

before

and

before

before

before

before

before

before

before

before

before

before

before

and

before

when

supporting

AS

numbers

and

a

BGP

peer

does

not

allows

remote

attackers

to

cause

a

denial

of

service

(memory

corruption

and

RDP

routing

process

crash

and

restart)

via

crafted

transitive

attributes

in

a

BGP

UPDATE.


Google V8 as used in Google Chrome before 34.0.1847.116 does not properly implement lazy deoptimization which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (aka smi) range.


The

AsyncPixelTransfersCompletedQuery::End

function

in

in

Google

Chrome

as

used

in

Google

Chrome

OS

before

does

not

check

whether

a

certain

position

is

within

the

bounds

of

a

shared-memory

segment

which

allows

remote

attackers

to

cause

a

denial

of

service

(GPU

command-buffer

memory

corruption)

or

possibly

have

unspecified

other

impact

via

unknown

vectors.


Use-after-free

vulnerability

in

the

WebSharedWorkerStub::OnTerminateWorkerContext

function

in

in

the

Web

Workers

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

(heap

memory

corruption)

or

possibly

have

unspecified

other

impact

via

vectors

that

trigger

a

SharedWorker

termination

during

script

loading.


The hash_buffer function in schnorr.c in OpenSSH through 6.4 when Makefile.inc is modified to enable the J-PAKE protocol does not initialize certain data structures which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.


AppleMNT.sys in Apple Boot Camp 5 before 5.1 allows local users to cause a denial of service (kernel memory corruption) or possibly have unspecified other impact via a malformed header in a Portable Executable (PE) file.


The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes which allows local users to obtain sensitive information from kernel memory cause a denial of service (memory corruption and system crash) or possibly gain privileges via a writev system call with a crafted pointer.


drivers/vhost/net.c in the Linux kernel before 3.13.10 when mergeable buffers are disabled does not properly validate packet lengths which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets related to the handle_rx and get_rx_bufs functions.


drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products does not validate certain offset length and base values within an ioctl call which allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application.


vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro which allows attackers to cause a denial of service (out-of-bounds access infinite loop and memory corruption) and possibly gain privileges via unspecified vectors.


Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.


hydrogen.cc in Google V8 as used Google Chrome before 40.0.2214.91 does not properly handle arrays with holes which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code that triggers an array copy.


The Fonts implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


factory.cc in Google V8 as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of backing-store pointers.


The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944 as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a look-behind expression.


The SimplifiedLowering::DoLoadBuffer function in compiler/simplified-lowering.cc in Google V8 as used in Google Chrome before 40.0.2214.91 does not properly choose an integer data type which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.


The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944 as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier.


Google Chrome before 6.0.472.53 and webkitgtk before 1.2.6 do not properly handle counter nodes which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The X.25 implementation in the Linux kernel before 2.6.36.2 does not properly parse facilities which allows remote attackers to cause a denial of service (heap memory corruption and panic) or possibly have unspecified other impact via malformed (1) X25_FAC_CALLING_AE or (2) X25_FAC_CALLED_AE data related to net/x25/x25_facilities.c and net/x25/x25_in.c a different vulnerability than CVE-2010-4164.


Multiple integer signedness errors in net/rose/af_rose.c in the Linux kernel before 2.6.36-rc5-next-20100923 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a rose_getname function call related to the rose_bind and rose_connect functions.


The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.


Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 6.0.472.59 on Linux does not properly implement the Khmer locale which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 5.0.375.127 does not properly implement the Geolocation feature which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 6.0.472.59 on Mac OS X does not properly implement file dialogs which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. NOTE: this issue exists because of an incorrect fix for CVE-2010-3112 on Mac OS X.


Google Chrome before 5.0.375.127 and webkitgtk before 1.2.5 does not properly handle SVG documents which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors related to state changes when using DeleteButtonController.


Google Chrome before 5.0.375.127 does not properly implement file dialogs which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The implementation of notification permissions in Google Chrome before 6.0.472.53 allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 6.0.472.59 does not properly implement Geolocation which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments as demonstrated by a call to audioop.reverse with a one-byte string a different vulnerability than CVE-2010-1634.


The implementation of the Unicode Bidirectional Algorithm (aka Bidi algorithm or UBA) in Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The SVG implementation in Google Chrome before 5.0.375.125 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The Cascading Style Sheets (CSS) implementation in Google Chrome before 5.0.375.99 does not properly perform style rendering which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


SIPD in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) allows remote attackers to cause a denial of service (stack memory corruption and process failure) via a malformed SIP message aka Bug ID CSCtd14474.


Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an invalid SVG document.


The rendering implementation in Google Chrome before 5.0.375.125 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.6 including 2.6.4 and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed MSNSLP INVITE request in an SLP message a different issue than CVE-2010-0013.


Google Chrome before 4.1.249.1064 does not properly handle fonts which allows remote attackers to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors.


The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format. NOTE: some of these details are obtained from third party information.


Google Chrome before 4.1.249.1064 does not properly handle HTML5 media which allows remote attackers to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors.


Off-by-one

error

in

the

WebSocketHandshake::readServerHandshake

function

in

websockets/WebSocketHandshake.cpp

in

WebCore

in

WebKit

before

as

used

in

Qt

and

other

products

allows

remote

websockets

servers

to

cause

a

denial

of

service

(memory

corruption)

or

possibly

have

unspecified

other

impact

via

an

upgrade

header

that

is

long

and

invalid.


Linux kernel 2.6.18 through 2.6.33 and possibly other versions allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets related to the size of sysfs files in (1) net/bluetooth/l2cap.c (2) net/bluetooth/rfcomm/core.c (3) net/bluetooth/rfcomm/sock.c and (4) net/bluetooth/sco.c.


Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.8 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly have unknown other impact via vectors that might involve compressed data a different vulnerability than CVE-2010-1028.


The Google V8 bindings in Google Chrome before 4.1.249.1059 allow attackers to cause a denial of service (memory corruption) via unknown vectors.


WebKit as used in Google Chrome before 7.0.517.44 webkitgtk before 1.2.6 and other products does not properly handle large text areas which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted HTML document.


Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set __get __isset and __unset methods on objects accessed by a reference.


Google Chrome before 8.0.552.215 does not properly restrict privileged extensions which allows remote attackers to cause a denial of service (memory corruption) via a crafted extension.


Opera before 10.63 allows remote attackers to cause a denial of service (memory corruption) by referencing an SVG document in an IMG element.


A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access allowing an attacker to cause denial of service memory corruption or potentially code execution.


In Bluetooth there is a possible memory corruption due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06142410; Issue ID: ALPS06142410.


The execve function in the Linux kernel possibly 2.6.30-rc6 and earlier does not properly clear the current->clear_child_tid pointer which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled which is not properly handled during thread creation and exit.


IBM Informix Dynamic Server (IDS) 10.00 before 10.00.xC11 11.10 before 11.10.xC4 and 11.50 before 11.50.xC5 allows remote attackers to cause a denial of service (memory corruption assertion failure and daemon crash) by sending a long password over a JDBC connection.


The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer which allows remote attackers to cause a denial of service (memory corruption and application crash) via vectors involving the (1) XMPP or (2) Sametime protocol.


The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4 2.6.25 and possibly earlier versions when the UTF-8 console is used allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters which triggers an \off-by-two memory error.\ NOTE: it is not clear whether this issue crosses privilege boundaries.


The browser engine in Mozilla Firefox before 3.0.9 Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors related to nsSVGElement::BindToTree.


Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4 12.0(32)SY8 through 12.0(32)SY9 12.2(33)SXI1 12.2XNC before 12.2(33)XNC2 12.2XND before 12.2(33)XND1 and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled allows remote attackers to cause a denial of service (memory corruption and device reload) by using an RFC4271 peer to send an update with a long series of AS numbers aka Bug ID CSCsy86021.


The

browser

engine

in

Mozilla

Firefox

before

Thunderbird

before

and

SeaMonkey

before

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

and

possibly

trigger

memory

corruption

via

vectors

related

to

nsAsyncInstantiateEvent::Run

nsStyleContext::Destroy

nsComputedDOMStyle::GetWidth

the

test

case

for

the

XSLT

stylesheet

compiler

nsXULDocument::SynchronizeBroadcastListener

IsBindingAncestor

and

nsEditor::EndUpdateViewBatch

and

gfxSkipCharsIterator::SetOffsets

and

other

vectors.


The JavaScript engine in Mozilla Firefox 3.x before 3.0.9 Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors involving (1) js_FindPropertyHelper related to the definitions of Math and Date; and (2) js_CheckRedeclaration.


Unspecified vulnerability in the Solaris Secure Digital slot driver (aka sdhost) in Sun OpenSolaris snv_105 through snv_108 on the x86 platform allows local users to gain privileges or cause a denial of service (filesystem or memory corruption) via unknown vectors.


The JavaScript engine in Mozilla Firefox before 3.0.9 Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors involving JSOP_DEFVAR and properties that lack the JSPROP_PERMANENT attribute.


Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption) via an XML document composed of a long series of start-tags with no corresponding end-tags. NOTE: it was later reported that 3.0.10 and earlier are also affected.


The DRDA Services component in IBM DB2 9.1 before FP7 and 9.5 before FP4 allows remote attackers to cause a denial of service (memory corruption and application crash) via an IPv6 address in the correlation token in the APPID string as demonstrated by an APPID string sent by the third-party DataDirect JDBC driver 3.7.32.


Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.


Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted GIF image that causes the realloc function to return a new pointer which triggers memory corruption when the old pointer is accessed.


fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption) or possibly have unspecified other impact via a readlink call that results in an error leading to use of a -1 return value as an array index.


The Indeo codec in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted media content.


kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463 and possibly other versions before 9.0.0.736 does not properly validate input to IOCTL 0x0022c008 which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted kernel addresses that trigger memory corruption possibly related to klavemu.kdl.


LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) via unspecified vectors as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11. NOTE: as of 20091229 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Serv-U FTP Server 4.1 (possibly 4.0) allows remote attackers to cause a denial of service (application crash) via a SITE CHMOD command with a \\\\\...\\\ followed by a short string causing partial memory corruption a different vulnerability than CVE-2004-2111.


Cisco Internetwork Operating System (IOS) 12.0S through 12.3T attempts to process SNMP solicited operations on improper ports (UDP 162 and a randomly chosen UDP port) which allows remote attackers to cause a denial of service (device reload and memory corruption).


A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4 and specifically in ImportOldFormatStyles allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.


A vulnerability in OpenOffice's PPT file parser before 4.1.4 and specifically in PPTStyleSheet allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.


An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the \Font Importer\ component. It allows remote attackers to cause a denial of service (memory corruption) or obtain sensitive information from process memory via a crafted font.


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \Kernel\ component. It allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted mach binary.


An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \ATS\ component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted font.


There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.


mpg321.c in mpg321 0.3.2-1 does not properly manage memory for use with libmad 0.15.1b which allows remote attackers to cause a denial of service (memory corruption seen in a crash in the mad_decoder_run function in decoder.c in libmad) via a crafted MP3 file.


Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the \Blip\ open wireless connection provided by the device if a large string is sent as a part of the HTTP request in any part of the HTTP headers the device could become completely unresponsive. Presumably this happens as the memory footprint provided to this device is very small. According to the specs from Rezolt the Wi-Fi module only has 256k of memory. As a result an incorrect string copy operation using either memcpy strcpy or any of their other variants could result in filling up the memory space allocated to the function executing and this would result in memory corruption. To test the theory one can modify the demo application provided by the Cypress WICED SDK and introduce an incorrect \memcpy\ operation and use the compiled application on the evaluation board provided by Cypress semiconductors with exactly the same Wi-Fi SOC. The results were identical where the device would completely stop responding to any of the ping or web requests.


The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \libxslt\ component. It allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted web site.


An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the \Sandbox\ component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \IOFireWireAVC\ component. It allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the \WebKit Web Inspector\ component. It allows attackers to execute arbitrary unsigned code or cause a denial of service (memory corruption) via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the \WebKit Web Inspector\ component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state.


The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_host_map mapping which allows guest OS users to cause a denial of service (count mismanagement and memory corruption) or obtain privileged host OS access aka XSA-224 bug 2.


The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping when followed by only a GNTMAP_host_map unmapping which allows guest OS users to cause a denial of service (count mismanagement and memory corruption) or obtain privileged host OS access aka XSA-224 bug 1.


An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the \Mail MessageUI\ component. It allows attackers to cause a denial of service (memory corruption) via a crafted image.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. tvOS before 10.2.2 is affected. The issue involves the \Wi-Fi\ component. It allows attackers to cause a denial of service (memory corruption on the Wi-Fi chip) by leveraging proximity for 802.11.


An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the \Audio\ component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted audio file.


The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.


An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the \Speech Framework\ component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the \iBooks\ component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.


An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code however did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.


The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations.


The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.


GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted fpx file.


drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact


The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11 and 4.9.x before 4.9.36 allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.


An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.


A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4 and specifically in the WW8Fonts Constructor allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.


drivers/net/usb/rtl8150.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


crypto/ccm.c in the Linux kernel 4.9.x and 4.10.x through 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


in

the

Linux

kernel

and

before

interacts

incorrectly

with

the

option

which

allows

local

users

to

cause

a

denial

of

service

(system

crash

or

memory

corruption)

or

possibly

have

unspecified

other

impact

by

leveraging

use

of

more

than

one

virtual

page

for

a

DMA

scatterlist.


drivers/net/usb/catc.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


drivers/net/usb/pegasus.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


drivers/media/usb/dvb-usb/dw2102.c in the Linux kernel 4.9.x and 4.10.x before 4.10.4 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


drivers/char/virtio_console.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


The VMware Tools HGFS (aka Shared Folders) implementation in VMware Workstation 11.x before 11.1.2 VMware Player 7.x before 7.1.2 VMware Fusion 7.x before 7.1.2 and VMware ESXi 5.0 through 6.0 allows Windows guest OS users to gain guest OS privileges or cause a denial of service (guest OS kernel memory corruption) via unspecified vectors.


Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium as used in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document.


Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service (memory corruption and device crash) via a crafted HTTP request.


The hdbsql client 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors aka SAP Security Note 2140700.


otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file a different vulnerability than CVE-2015-7057.


LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memory corruption and SIGSEGV) via a crafted image file.


The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted disk image.


The Bluetooth HCI interface in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge before G925VVRU4B0G9 allows remote attackers to gain privileges or cause a denial of service (memory corruption) via a crafted BMP image file.


The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.


The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors related to an \overflow.\


The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.


otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file a different vulnerability than CVE-2015-7049.


SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspecified vectors to the EXECUTE_SEARCH_RULE_SET stored procedure aka SAP Security Note 2175928.


The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors related to an \overflow.\


The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.


The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.


The Disk Images component in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


The Audio component in Apple iOS before 9 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted audio file.


The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8 as used in Node.js before 0.12.6 io.js before 1.8.3 and 2.x before 2.3.3 and other products does not verify that there is memory available for a UTF-16 surrogate pair which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.


The SMB implementation in the kernel in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


Integer

signedness

error

in

the

SharedBufferManagerParent::RecvAllocateGrallocBuffer

function

in

the

buffer-management

implementation

in

the

graphics

layer

in

Mozilla

Firefox

OS

before

might

allow

attackers

to

cause

a

denial

of

service

(memory

corruption)

via

a

negative

value

of

a

size

parameter.


GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors a different vulnerability than CVE-2015-5919.


GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors a different vulnerability than CVE-2015-5918.


The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.


The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors related to an \overflow.\


NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.


The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41 5.5.x before 5.5.25 and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \\0 character which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.


The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0 Firefox ESR 38.x before 38.2 and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors related to an \overflow.\


The tzdriver module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users to gain privileges or cause a denial of service (memory corruption) via an unspecified input.


The nsTArray_Impl class in Mozilla Firefox before 40.0 Firefox ESR 38.x before 38.2 and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment.


The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.


Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.


The TEEOS module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service (memory corruption) via a crafted application.


Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.


The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors.


Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 RSA BSAFE Crypto-C Micro Edition (Crypto-C ME) before 4.0.4 and 4.1 and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to cause a denial of service (memory corruption or segmentation fault) or possibly have unspecified other impact via crafted base64 data a similar issue to CVE-2015-0292.


Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.


Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf 1.0.0 before 1.0.0r 1.0.1 before 1.0.1m and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.


The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf 1.0.0 before 1.0.0r 1.0.1 before 1.0.1m and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.


The mmfslinux kernel module in IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32 3.5 before 3.5.0.24 and 4.1 before 4.1.0.7 allows local users to cause a denial of service (memory corruption) via unspecified character-device ioctl calls.


SkPictureShader.cpp in Skia as used in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.


The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (memory corruption) or gain privileges.


Use-after-free

vulnerability

in

in

the

WebAudio

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

(heap

memory

corruption)

or

possibly

have

unspecified

other

impact

by

leveraging

improper

handling

of

a

stop

action

for

an

audio

track.


Use-after-free

vulnerability

in

the

OpenPDFInReaderView::Update

function

in

in

Google

Chrome

before

might

allow

user-assisted

remote

attackers

to

cause

a

denial

of

service

(heap

memory

corruption)

or

possibly

have

unspecified

other

impact

by

triggering

interaction

with

a

PDFium

\Open

PDF

in

Reader\

button

that

has

an

invalid

tab

association.


Apple Mac EFI before 2015-001 as used in OS X before 10.10.4 and other products does not properly set refresh rates for DDR3 RAM which might make it easier for remote attackers to conduct row-hammer attacks and consequently gain privileges or cause a denial of service (memory corruption) by triggering certain patterns of access to memory locations.


PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors related to \javascript rule evaluation.\


The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL.


Foxit Reader Enterprise Reader and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted GIF in a PDF file.


The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC which allows local users to cause a denial of service (memory corruption and kernel panic) via a crafted OSD FS command.


Foxit Reader Enterprise Reader and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via vectors related to digital signatures.


The DiskImages component in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via a malformed DMG image.


The

function

in

in

the

ATN-CPDLC

dissector

in

Wireshark

before

does

not

properly

follow

the

TRY/ENDTRY

code

requirements

which

allows

remote

attackers

to

cause

a

denial

of

service

(stack

memory

corruption

and

application

crash)

via

a

crafted

packet.


The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696.


Foxit Reader Enterprise Reader and PhantomPDF before 7.1 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted (1) Ubyte Size in a DataSubBlock structure or (2) LZWMinimumCodeSize in a GIF image.


The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory corruption and service outage) via crafted requests.


The skb_copy_and_csum_datagram_iovec function in net/core/datagram.c in the Linux kernel 3.14.54 and 3.18.22 does not accept a length argument which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write system call followed by a recvmsg system call.


Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.


The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests aka SAP Security Note 2238619.


Use-after-free vulnerability in the AudioOutputDevice::OnDeviceAuthorized function in media/audio/audio_output_device.cc in Google Chrome before 47.0.2526.73 allows attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering access to an unauthorized audio output device.


The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML element to a long http or https URL which triggers memory corruption.


Unspecified vulnerability in NetworkManager daemon for DHCP (dhcdbd) allows remote attackers to cause a denial of service (crash) via certain invalid DHCP responses that trigger memory corruption.


ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14 and other versions allows remote attackers to cause a denial of service (memory corruption or crash) via an inbound PPTP_IN_CALL_REQUEST packet that causes a null pointer to be used in an offset calculation.


ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14 and other versions allows local users to cause a denial of service (memory corruption or crash) via a crafted outbound packet that causes an incorrect offset to be calculated from pointer arithmetic when non-linear SKBs (socket buffers) are used.


Unspecified vulnerability in the web server code in Xerox CopyCentre and Xerox WorkCentre Pro running software 1.001.02.073 or earlier or 1.001.02.074 before 1.001.02.715 allows remote attackers to cause a denial of service (memory corruption) via unknown vectors.


The zlib_inflate function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via a malformed filesystem that uses zlib compression that triggers memory corruption as demonstrated using cramfs.


alloccgblk in the UFS filesystem in Solaris 10 allows local users to cause a denial of service (memory corruption) by mounting crafted UFS filesystems with malformed data structures.


The Graphics Rendering Engine in Microsoft Windows 2000 through 2000 SP4 and Windows XP through SP2 maps GDI Kernel structures on a global shared memory section that is mapped with read-only permissions but can be remapped by other processes as read-write which allows local users to cause a denial of service (memory corruption and crash) and gain privileges by modifying the kernel structures.


Unspecified vulnerability in QuickDraw Manager in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows context-dependent attackers to cause a denial of service (\memory corruption\ and crash) via a crafted PICT image that is not properly handled by a certain \unsupported QuickDraw operation.\


Integer signedness error in FreeBSD 6.0-RELEASE allows local users to cause a denial of service (memory corruption and kernel panic) via a PT_LWPINFO ptrace command with a large negative data value that satisfies a signed maximum value check but is used in an unsigned copyout function call.


The tr_rx function in ibmtr.c for Linux kernel 2.6.19 assigns the wrong flag to the ip_summed field which allows remote attackers to cause a denial of service (memory corruption) via crafted packets that cause the kernel to interpret another field as an offset.


The ReiserFS functionality in Linux kernel 2.6.18 and possibly other versions allows local users to cause a denial of service via a malformed ReiserFS file system that triggers memory corruption when a sync is performed.


gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record as demonstrated by a crafted GenericBlockCipher structure.


The ProcSetEventMask function in difs/events.c in the xfs font server for X.Org X11R6 through X11R6.6 and XFree86 before 3.3.3 calls the SendErrToClient function with a mask value instead of a pointer which allows local users to cause a denial of service (memory corruption and crash) or obtain potentially sensitive information from memory via a SetEventMask request that triggers an invalid pointer dereference.


mp4fformat.dll in the QuickTime File Format plugin in RealNetworks RealPlayer 15 and earlier and RealPlayer SP 1.1.4 Build 12.0.0.756 and earlier allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP4 file.


Microsoft Internet Explorer 6 through 9 and 10 Consumer Preview allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.


The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12 as used in GnuTLS before 3.0.16 and other products does not properly handle certain large length values which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.


Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function.


The AAC SDK in RealNetworks RealPlayer before 15.0.6.14 RealPlayer SP 1.0 through 1.1.5 and Mac RealPlayer before 12.0.1.1750 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted AAC file that is not properly handled during decoding.


The ff_MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors related to starting \a frame outside SETUP state.\


The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.


Pro-face WinGP PC Runtime 3.1.00 and earlier and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier does not properly check packet sizes before reusing packet memory buffers which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a short crafted packet with a certain opcode.


The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a .IT file.


sensorApp on Cisco IPS 4200 series sensors 6.0 6.2 and 7.0 does not properly allocate memory which allows remote attackers to cause a denial of service (memory corruption and process crash and traffic-inspection outage) via network traffic aka Bug ID CSCtn23051.


The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a .IT file.


The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.


Google Chrome before 23.0.1271.64 does not properly handle textures which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


Cisco IOS before 15.3(1)T when media flow-around is not used allows remote attackers to cause a denial of service (media loops and stack memory corruption) via VoIP traffic aka Bug ID CSCub45809.


Google Chrome before 23.0.1271.97 and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5 do not properly perform AAC decoding which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via vectors related to \an off-by-one overwrite when switching to LTP profile from MAIN.\


Memory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of a \Data from Faulting Address controls Code Flow\ issue.


Potential memory corruption in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059) 10.18.x.5057 (aka 15.36.x.5057) 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to cause a denial of service via local access.


An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format but has more extents than fit in the inode fork.


Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.


On SRX Series and MX Series devices with a Service PIC with any ALG enabled a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in an extended Denial of Service condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX series; 12.3X48 versions prior to 12.3X48-D35 on SRX series; 14.1 versions prior to 14.1R9 on MX series; 14.2 versions prior to 14.2R8 on MX series; 15.1X49 versions prior to 15.1X49-D60 on SRX series; 15.1 versions prior to 15.1R5-S8 15.1F6-S9 15.1R6-S4 15.1R7 on MX series; 16.1 versions prior to 16.1R6 on MX series; 16.2 versions prior to 16.2R3 on MX series; 17.1 versions prior to 17.1R2-S4 17.1R3 on MX series. No other Juniper Networks products or platforms are affected by this issue.


There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sending a crafted command which will result in a code path that calls the UND undefined ARM instruction.


There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from code inside libdbus-send.so shared object or similar.


fmtlib

version

prior

to

version

(before

commit

contains

a

Memory

corruption

(SIGSEGV)

vulnerability

in

fmt::print()

library

function

that

can

result

in

Denial

of

Service.

This

attack

appear

to

be

exploitable

via

Specifying

an

invalid

format

specifier

in

the

fmt::print()

function

results

in

a

SIGSEGV

(memory

corruption

invalid

write).

This

vulnerability

appears

to

have

been

fixed

in

after

commit


MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted MP4 file because access to the data structure has different expectations about layout as a result of this type confusion.


An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to cause a denial of service (memory corruption and Safari crash) or possibly have unspecified other impact via a crafted web site.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the \WebKit\ component. It allows attackers to cause a denial of service (memory corruption) via a crafted web site.


An issue was discovered in certain Apple products. iOS before 11.2.6 is affected. macOS before 10.13.3 Supplemental Update is affected. tvOS before 11.2.6 is affected. watchOS before 4.2.3 is affected. The issue involves the \CoreText\ component. It allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a crafted string containing a certain Telugu character.


UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c allowing attackers to obtain sensitive information (stack contents) cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed filesystem label as demonstrated by %d or %n substrings.


A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. A specially crafted Diameter request can trigger a memory corruption resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.


Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F 6300 6400 8320 8325 and 8400 have been found. Successful exploitation of these vulnerabilities could result in Local Denial of Service of the LLDP (Link Layer Discovery Protocol) process in the switch. This applies to firmware versions prior to 10.04.3021.


meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server because a crafted map is affected by memory corruption.


Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F 6300 6400 8320 8325 and 8400 have been found. Successful exploitation of these vulnerabilities could result in Local Denial of Service of the CDP (Cisco Discovery Protocol) process in the switch. This applies to firmware versions prior to 10.04.1000.


rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server because a crafted map is affected by memory corruption.


A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw privilege escalation cannot be fully ruled out.


Memory corruption in IntLixCrashDumpDmesg IntLixTaskFetchCmdLine IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation may lead to denial of service conditions.


A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.


Pointer variable which is freed is not cleared can result in memory corruption and leads to denial of service in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) and possibly memory corruption via a crafted HTML page.


The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.


An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (memory corruption segmentation fault and crash) via a crafted HTML page.


A memory corruption in the IPsec code path of Brocade NetIron OS on Brocade MLXs 5.8.00 through 5.8.00e 5.9.00 through 5.9.00bd 6.0.00 and 6.0.00a images could allow attackers to cause a denial of service (line card reset) via certain constructed IPsec control packets.


The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \Kernel\ component. It allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.


The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2 when the GNU Compiler Collection (gcc) stack protector is enabled uses an incorrect buffer size for certain timeout data which allows local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file.


The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging reliance on earlier net/ceph/crypto.c code.


The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a scatterlist.


The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38 5.6.x before 5.6.24 and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption) obtain sensitive information from process memory or possibly have unspecified other impact via a crafted JPEG image.


libxslt in Apple iOS before 9.3.3 OS X before 10.11.6 iTunes before 12.4.2 on Windows iCloud before 5.2.1 on Windows tvOS before 9.2.2 and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2016-4607 CVE-2016-4608 CVE-2016-4610 and CVE-2016-4612.


libxml2 in Apple iOS before 9.3.3 OS X before 10.11.6 iTunes before 12.4.2 on Windows iCloud before 5.2.1 on Windows tvOS before 9.2.2 and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2016-4614 CVE-2016-4616 and CVE-2016-4619.


An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the \NVIDIA Graphics Drivers\ component. It allows attackers to cause a denial of service (memory corruption) via a crafted app.


The Graphics Drivers subsystem in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


The kernel in Apple iOS before 9.3.3 OS X before 10.11.6 tvOS before 9.2.2 and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors a different vulnerability than CVE-2016-1863 and CVE-2016-4582.


libxslt in Apple iOS before 9.3.3 OS X before 10.11.6 iTunes before 12.4.2 on Windows iCloud before 5.2.1 on Windows tvOS before 9.2.2 and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2016-4607 CVE-2016-4609 CVE-2016-4610 and CVE-2016-4612.


libxslt in Apple iOS before 9.3.3 OS X before 10.11.6 iTunes before 12.4.2 on Windows iCloud before 5.2.1 on Windows tvOS before 9.2.2 and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2016-4607 CVE-2016-4608 CVE-2016-4609 and CVE-2016-4612.


The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.


libxml2 in Apple iOS before 9.3.3 OS X before 10.11.6 iTunes before 12.4.2 on Windows iCloud before 5.2.1 on Windows tvOS before 9.2.2 and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2016-4615 CVE-2016-4616 and CVE-2016-4619.


otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors a different vulnerability than CVE-2016-4705.


ext/phar/phar_object.c in PHP before 5.5.32 5.6.x before 5.6.18 and 7.x before 7.0.3 mishandles zero-length uncompressed data which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR (2) ZIP or (3) PHAR archive.


An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the \ATS\ component. It allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the \WebKit\ component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption and application crash) via a crafted web site.


libxml2 in Apple iOS before 9.3.3 OS X before 10.11.6 iTunes before 12.4.2 on Windows iCloud before 5.2.1 on Windows tvOS before 9.2.2 and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2016-4614 CVE-2016-4615 and CVE-2016-4619.


Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash or spinlock) or possibly have unspecified other impact by removing a network namespace related to the ppp_register_net_channel and ppp_unregister_channel functions.


otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors a different vulnerability than CVE-2016-4704.


The kernel in Apple iOS before 9.3.3 OS X before 10.11.6 tvOS before 9.2.2 and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors a different vulnerability than CVE-2016-1863 and CVE-2016-4653.


libxslt in Apple iOS before 9.3.3 OS X before 10.11.6 iTunes before 12.4.2 on Windows iCloud before 5.2.1 on Windows tvOS before 9.2.2 and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors a different vulnerability than CVE-2016-4608 CVE-2016-4609 CVE-2016-4610 and CVE-2016-4612.


The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02 7.5.x before 7.5.4 HF02 7.5.5 before 7.5.5 HF01 and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1 8.1.x before 8.1.2 HF2.3 and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3 7.x before 7.0_3966002 HF2.1 and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update 6.0.6 before 6.0.6 HF_2.6 and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (memory corruption) via a crafted RAR file that is mishandled during decompression.


The Client Intrusion Detection System (CIDS) driver before 15.0.6 in Symantec Endpoint Protection (SEP) and before 15.1.2 in Norton Security allows remote attackers to cause a denial of service (memory corruption and system crash) via a malformed Portable Executable (PE) file.


Google V8 before 5.2.361.32 as used in Google Chrome before 52.0.2743.82 does not properly process left-trimmed objects which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.


The IOAcceleratorFamily2 interface in IOAcceleratorFamily in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


Integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The Buffer11::NativeBuffer11::map function in ANGLE as used in Mozilla Firefox before 44.0 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


The IOHIDFamily API in Apple iOS before 9.2.1 OS X before 10.11.3 and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.


The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows omits an unspecified status check which might allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.


Blink as used in Google Chrome before 50.0.2661.94 does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted web site related to BindingSecurity.cpp and DOMWindow.cpp.


The kernel in Apple iOS before 9.3.3 OS X before 10.11.6 tvOS before 9.2.2 and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors a different vulnerability than CVE-2016-4582 and CVE-2016-4653.