The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.


Google Chrome before 21.0.1180.89 does not properly perform line breaking which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.


The exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.


Google Chrome before 20.0.1132.43 does not properly implement texture conversion which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The Broadcom BCM4325 and BCM4329 Wi-Fi chips as used in certain Acer Apple Asus Ford HTC Kyocera LG Malata Motorola Nokia Pantech Samsung and Sony products allow remote attackers to cause a denial of service (out-of-bounds read and Wi-Fi outage) via an RSN 802.11i information element.


Google Chrome before 20.0.1132.43 does not properly implement SVG filters which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain* API calls with typed parameters which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero which triggers an out-of-bounds read or a free of an invalid pointer.


The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.


pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.


Pro-face WinGP PC Runtime 3.1.00 and earlier and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier allows remote attackers to cause a denial of service (out-of-bounds read operation) via a crafted packet that triggers a certain Find Node check attempt.


Fetchmail 5.0.8 through 6.3.21 when using NTLM authentication in debug mode allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure which triggers an out-of-bounds read.


The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58 1.2.x before 1.2.48 1.4.x before 1.4.10 and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.


The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 data.


The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.


iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of \0xffff\ to the iconv function when converting IBM930 encoded data to UTF-8.


The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read but it might not trigger a crash.


The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service (Xen crash) via a crafted pirq value that triggers an out-of-bounds read.


Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving seek operations on video data.


The International Components for Unicode (ICU) functionality in Google Chrome before 22.0.1229.92 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a regular expression.


The compositor in Google Chrome before 22.0.1229.92 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 24.0.1312.52 does not properly handle image data in PDF documents which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.


The

plugin

(aka

in

FoxitReader.exe

in

Foxit

Reader

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

or

obtain

sensitive

information

via

a

sample

because

of

a

\Read

Access

Violation

near

starting

at

U3DBrowser!PlugInMain+0x0000000000053f8b\

issue.


The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a \Read Access Violation near NULL starting at FoxitReader!std::basic_ostream >::operator<<+0x0000000000087906\ issue.


The

plugin

(aka

in

FoxitReader.exe

in

Foxit

Reader

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

or

obtain

sensitive

information

via

a

sample

because

of

a

\Data

from

Faulting

Address

may

be

used

as

a

return

value

starting

at

U3DBrowser!PlugInMain+0x0000000000031a75\

issue.


The

plugin

(aka

in

FoxitReader.exe

in

Foxit

Reader

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

or

obtain

sensitive

information

via

a

sample

because

of

a

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

U3DBrowser!PlugInMain+0x000000000012dff5\

issue.


FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read access violation and application crash) via TIFF data because of a ConvertToPDF_x86!ReleaseFXURLToHtml issue.


The

plugin

(aka

in

FoxitReader.exe

in

Foxit

Reader

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

or

obtain

sensitive

information

via

a

sample

because

of

a

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

U3DBrowser!PlugInMain+0x00000000000d11ea\

issue.


The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a \Read Access Violation starting at U3DBrowser+0x000000000000347a\ issue.


An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc will lead to denial of service as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.


The ansilove_ansi function in loaders/ansi.c in libansilove 1.0.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


The

plugin

(aka

in

FoxitReader.exe

in

Foxit

Reader

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

or

obtain

sensitive

information

via

a

sample

because

of

a

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

U3DBrowser!PlugInMain+0x00000000000d11bb\

issue.


The

plugin

(aka

in

FoxitReader.exe

in

Foxit

Reader

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

obtain

sensitive

information

or

possibly

have

unspecified

other

impact

via

a

sample

because

of

a

\Data

from

Faulting

Address

controls

Code

Flow

starting

at

U3DBrowser!PlugInMain+0x00000000000f43ff\

issue.


In getstring of ID3.cpp there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-78656554.


The

plugin

(aka

in

FoxitReader.exe

in

Foxit

Reader

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

or

obtain

sensitive

information

via

a

sample

because

of

a

\Read

Access

Violation

near

starting

at

FoxitReader!safe_vsnprintf+0x00000000002c4330\

issue.


An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set in an inode.


An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image leading to a denial of service (BUG).


The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.


An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.


An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfs_make_data_run in tsk/fs/ntfs.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.


Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via an Out-of-bounds Read during syntax parsing in which certain height validation is missing in libs/graphics/jswrap_graphics.c.


An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function raw_read in tsk/img/raw.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.


The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.


The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.


The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file.


An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.


The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.


The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.


An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfs_fix_idxrec in tsk/fs/ntfs_dent.cpp which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.


An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.


The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted Mach-O file.


The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.


An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function tsk_UTF16toUTF8 in tsk/base/tsk_unicode.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.


The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.


soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.


The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers.


exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37 7.0.x before 7.0.31 7.1.x before 7.1.20 and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.


The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.


An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the \AMD\ component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (out-of-bounds read of kernel memory) via a crafted app.


An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of the file length before a file magic comparison allowing attackers to cause a Denial of Service (application crash caused by out-of-bounds read) by crafting a file that has fewer than 4 bytes.


The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.


The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.30 allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.


The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.


An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack.


The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service (remote). The component is: DNS response processing in function: dns_upcall(). The attack vector is: a specific DNS response packet. The code does not check whether the number of queries/responses specified in the DNS packet header corresponds to the query/response data available in the DNS packet.


An exploitable out-of-bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trigger an out-of-bounds memory read which can result in the disclosure of sensitive information and denial of service. To trigger this vulnerability an attacker needs to send a specially crafted packet to the vulnerable server.


An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages the implementation does not properly keep track of the available data in the message possibly leading to an out-of-bounds read that would result in a denial of service. An attacker can send an mDNS message to trigger this vulnerability.


An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf4096' in the do_token_in do_token_out routines. This flaw allows a guest user to crash the QEMU process resulting in a denial of service or the potential execution of arbitrary code with the privileges of the QEMU process on the host.


An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where gethostname() does not have '\\0' termination of the returned string if the hostname is larger than the supplied buffer. (Linux systems are not affected because the buffer is always large enough. OpenBSD systems are not affected because the returned hostname always has '\\0' termination.) Under some conditions this issue can lead to the writing of one '\\0' byte out-of-bounds on the stack causing a denial of service or possibly arbitrary code execution.


VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG) Workstation (15.x before 15.5.5) and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in the Shader functionality. A malicious actor with non-administrative local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to crash the virtual machine's vmx process leading to a partial denial of service condition.


A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash resulting in a denial of service condition.


A denial of service vulnerability exists in the D3DKMTCreateAllocation handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A specially crafted D3DKMTCreateAllocation API request can cause an out-of-bounds read and denial of service (BSOD). This vulnerability can be triggered from a non-privileged account.


A denial of service vulnerability exists in the D3DKMTEscape handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A specially crafted D3DKMTEscape API request can cause an out-of-bounds read in Windows OS kernel memory area. This vulnerability can be triggered from a non-privileged account.


An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds read resulting in disclosure of memory within the process the same vulnerability can also be used to trigger a denial of service. An attacker can simply connect to the port and send the packet to trigger this vulnerability.


The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2 when G_SLICE is set to always-malloc allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.


The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds read and system crash) via a large counter value in an 0x62430028 IOCTL call.


libxml2 as used in Red Hat JBoss Core Services allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.


The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).


The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tag values.


The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0 when built for Windows CE using the schannel TLS backend allows remote attackers to obtain sensitive information cause a denial of service (crash) or possibly have unspecified other impact via a wildcard certificate name which triggers an out-of-bounds read.


tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file related to changing td_nstrips in TIFF_STRIPCHOP mode.


cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read invalid pointer dereference and application crash) by leveraging access to the NetMon named pipe.


The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.


The

ConvertToPDF

plugin

in

Foxit

Reader

and

PhantomPDF

before

on

Windows

when

the

gflags

app

is

enabled

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read

and

application

crash)

via

a

crafted

TIFF

image

aka

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at


The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.


The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.


The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.


The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size.


The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.


The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file. NOTE: the vendor says \This is a Q64 issue and we do not support Q64.\


The _dwarf_get_size_of_val function in libdwarf/dwarf_util.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.


The read_line_table_program function in dwarf_line_table_reader_common.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted input.


The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.


The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.


coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file.


The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SUN file.


The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input.


The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability.


The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels.


The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors related to \0/3 line wrapping equalization.\


coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.


The hid_input_field function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device as demonstrated by a Logitech DJ receiver.


The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PICT file.


The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures as demonstrated by the keyutils test suite.


The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted VIFF file.


coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file.


MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


An

out-of-bounds

read

vulnerability

was

observed

in

function

of

Artifex

Software

Inc.

MuJS

before

A

successful

exploitation

of

this

issue

can

lead

to

code

execution

or

denial

of

service

condition.


epan/dissectors/packet-qnet6.c in the QNX6 QNET dissector in Wireshark 2.x before 2.0.6 mishandles MAC address data which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \ImageIO\ component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) via a crafted web site.


The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document leading to mishandling in a wddx_deserialize call.


coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.


JavaScriptCore in WebKit as distributed in Safari Technology Preview Release 18 allows remote attackers to cause a denial of service (bitfield out-of-bounds read and application crash) via crafted JavaScript code that is mishandled in the operatorString function related to assembler/MacroAssemblerARM64.h assembler/MacroAssemblerX86Common.h and wasm/WasmB3IRGenerator.cpp.


The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.


The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.


The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image.


The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.


The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.


The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.


The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file.


The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.


The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file related to the decompression buffer.


The setup_imginfo_jpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg file.


The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38 5.6.x before 5.6.24 and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.


The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations related to s3_clnt.c and s3_srvr.c.


The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\\0' character at the end of a certain temporary array which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.


The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.


TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted message.


The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.


gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.


The write_ujpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service (out-of-bounds read) via a crafted jpeg file.


The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.


The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.


The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.


MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in an X.509 certificate.


An issue was discovered in certain Apple products. macOS before 10.12 is affected. macOS before 10.12.1 is affected. The issue involves the \ImageIO\ component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted SGI file.


Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors related to the \returned length of the object from _ksba_ber_parse_tl.\


The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 does not validate TIFF start data which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.


The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.


The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.


Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356.


The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.


The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.


The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.


The kernel in Apple iOS before 10 OS X before 10.12 tvOS before 10 and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app a different vulnerability than CVE-2016-4773 and CVE-2016-4776.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the \FontParser\ component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted font.


The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 7.3.4 on Windows when the gflags app is enabled allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted (1) JPEG (2) GIF or (3) BMP image.


The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 does not validate IFD sizes which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.


The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of-bounds read) by clearing the high bit of the byte after invalid utf-8 encoded data.


epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 misparses timestamp fields which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


The kernel in Apple iOS before 10 OS X before 10.12 tvOS before 10 and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app a different vulnerability than CVE-2016-4773 and CVE-2016-4774.


The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command which triggers an out-of-bounds read.


The kernel in Apple iOS before 10 OS X before 10.12 tvOS before 10 and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app a different vulnerability than CVE-2016-4774 and CVE-2016-4776.


The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.


The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 does not properly construct spprintf arguments which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.


The dwarf_get_macro_startend_file function in dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.


The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.


The megasas_lookup_frame function in QEMU when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors.


The _dwarf_read_line_table_header function in dwarf_line_table_reader.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36 5.6.x before 5.6.22 and 7.x before 7.0.7 does not ensure the presence of a '\\0' character which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.


The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted object with all-bits on.


The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted DWARF section.


coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file.


The print_exprloc_content function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


The avcodec_decode_audio4 function in libavcodec in libavformat 57.34.103 as used in MPlayer allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mp3 file.


libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a large length value in a compilation unit header.


The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec Data Center Security: Server; Symantec Endpoint Protection (SEP) for Windows before 12.1.6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1.6 MP6; Symantec Endpoint Protection for Small Business Enterprise (SEP SBE/SEP.Cloud); Symantec Endpoint Protection Cloud (SEPC) for Windows/Mac; Symantec Endpoint Protection Small Business Edition 12.1; CSAPI before 10.0.4 HF02; Symantec Protection Engine (SPE) before 7.0.5 HF02 7.5.x before 7.5.4 HF02 7.5.5 before 7.5.5 HF01 and 7.8.x before 7.8.0 HF03; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF2.1 8.1.x before 8.1.2 HF2.3 and 8.1.3 before 8.1.3 HF2.2; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 6.5.8_3968140 HF2.3 7.x before 7.0_3966002 HF2.1 and 7.5.x before 7.5_3966008 VHF2.2; Symantec Protection for SharePoint Servers (SPSS) before SPSS_6.0.3_To_6.0.5_HF_2.5 update 6.0.6 before 6.0.6 HF_2.6 and 6.0.7 before 6.0.7_HF_2.7; Symantec Messaging Gateway (SMG) before 10.6.2; Symantec Messaging Gateway for Service Providers (SMG-SP) before 10.5 patch 260 and 10.6 before patch 259; Symantec Web Gateway; and Symantec Web Security.Cloud allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted RAR file that is mishandled during decompression.


The dump_block function in print_sections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.


The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conjunction with a \display: contents\ Cascading Style Sheets (CSS) property.


core/fxge/ge/fx_ge_text.cpp in PDFium as used in Google Chrome before 51.0.2704.63 miscalculates certain index values which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.


fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium as used in Google Chrome before 50.0.2661.75 does not properly implement the sycc420_to_rgb and sycc422_to_rgb functions which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted JPEG 2000 data in a PDF document.


The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40 as used in Google Chrome before 51.0.2704.63 mishandles external string sizes which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted JavaScript code.


The opj_pi_update_decode_poc function in pi.c in OpenJPEG as used in PDFium in Google Chrome before 48.0.2564.109 miscalculates a certain layer index value which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.


The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.


The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.


The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31 5.6.x before 5.6.17 and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function.


The DBD::mysql module before 4.039 for Perl when using server-side prepared statement support allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.


The opj_tgt_reset function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.


The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4 as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1 incorrectly validates a size value which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.


The

function

in

in

PDFium

as

used

in

Google

Chrome

before

mishandles

decoder-initialization

failure

which

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

via

a

crafted

PDF

document.


The Array.prototype.concat implementation in builtins.cc in Google V8 as used in Google Chrome before 49.0.2623.108 does not properly consider element data types which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.


The SkRegion::readFromMemory function in core/SkRegion.cpp in Skia as used in Google Chrome before 51.0.2704.79 does not validate the interval count which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted serialized data.


The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string as demonstrated by a large amount of ASN.1 data a different vulnerability than CVE-2016-2842.


The internal DNS server in Samba 4.x before 4.1.23 4.2.x before 4.2.9 4.3.x before 4.3.6 and 4.4.x before 4.4.0rc4 when an AD DC is configured allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.


A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability.


The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the \OBJECT PROTOCOL\ substring which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.


Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value a different vulnerability than CVE-2016-2530.


The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet a different vulnerability than CVE-2016-2531.


A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.


The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted ELF object file.


The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.


The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a Content Security Policy (CSP) referrer directive with zero values.


The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the \openssl ts\ command.


The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document.


The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable.


The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file.


The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image which triggers an out-of-bounds read.


The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\\x05\\x06 signature at an invalid location.


The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the src variable.


tif_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.


The (1) cpStrips and (2) cpTiles functions in the thumbnail tool in LibTIFF 4.0.6 and earlier allow remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the bytecounts array variable.


The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.


decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted application aka internal bug 28168413.


The tagCompare function in tif_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to field_tag matching.


The gaim_markup_strip_html function in Gaim 1.2.0 and possibly earlier versions allows remote attackers to cause a denial of service (application crash) via a string that contains malformed HTML which causes an out-of-bounds read.


The ZCom_BitStream::Deserialize function in Zoidcom 1.0 beta 4 and earlier allows remote attackers to cause a denial of service via a crafted UDP packet with a large size value which causes a memory allocation error or an out-of-bounds read.


MultiTheftAuto 0.5 patch 1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted command 40 that causes a -1 length to be used and triggers an out-of-bounds read.


The listening daemon in Blue Coat Systems Inc. WinProxy before 6.1a allows remote attackers to cause a denial of service (crash) via a long HTTP request that causes an out-of-bounds read.


The HTBoundary_put_block function in HTBound.c for W3C libwww (w3c-libwww) allows remote servers to cause a denial of service (segmentation fault) via a crafted multipart/byteranges MIME message that triggers an out-of-bounds read.


pamperspective in Netpbm before 10.35.48 does not properly calculate a window height which allows context-dependent attackers to cause a denial of service (crash) via a crafted image file that triggers an out-of-bounds read.


Off-by-one

error

in

the

_web_drawInRect:withFont:ellipsis:alignment:measureOnly

function

in

WebKit

in

Safari

in

Apple

iPhone

and

and

iPod

touch

and

allows

remote

attackers

to

cause

a

denial

of

service

(browser

crash)

via

a

JavaScript

alert

call

with

an

argument

that

lacks

breakable

characters

and

has

a

length

that

is

a

multiple

of

the

memory

page

size

leading

to

an

out-of-bounds

read.


The scanning engine before 4.4.4 in F-Prot Antivirus before 6.0.9.0 allows remote attackers to cause a denial of service (engine crash) via a CHM file with a large nb_dir value that triggers an out-of-bounds read.


Apple QuickTime before 7.5.5 allows remote attackers to cause a denial of service (application crash) via a crafted PICT image that triggers an out-of-bounds read.


libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.


client/NmdcHub.cpp in Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a denial of service (crash) via an empty private message which triggers an out-of-bounds read.


in

Mozilla

Firefox

before

Thunderbird

before

and

SeaMonkey

before

does

not

properly

perform

certain

calculations

related

to

the

mColors

table

which

allows

remote

attackers

to

read

portions

of

memory

uninitialized

via

a

crafted

bitmap

(BMP)

file

that

triggers

an

out-of-bounds

read

within

the

heap

as

demonstrated

using

a

CANVAS

element;

or

cause

a

denial

of

service

(application

crash)

via

a

crafted

bitmap

file

that

triggers

an

out-of-bounds

read.

NOTE:

the

initial

public

reports

stated

that

this

affected

Firefox

in

Ubuntu

through


ExtremeZ-IP.exe in ExtremeZ-IP File and Print Server 5.1.2x15 and earlier does not verify that a certain \number of URLs\ field is consistent with the packet length which allows remote attackers to cause a denial of service (daemon crash) via a large integer in this field in a packet to the Service Location Protocol (SLP) service on UDP port 427 triggering an out-of-bounds read.


Acronis True Image Group Server 1.5.19.191 and earlier included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages allows remote attackers to cause a denial of service (crash) via a packet with an invalid length field which causes an out-of-bounds read.


oowriter in OpenOffice.org 3.3.0 and LibreOffice before 3.4.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers an out-of-bounds read in the DOC sprm parser.


The NPAPI implementation in Google Chrome before 12.0.742.112 does not properly handle strings which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55 1.2.x before 1.2.45 1.4.x before 1.4.8 and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.


Google Chrome before 18.0.1025.142 does not properly handle text fragments which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


nsvdec.c in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.5 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted NSV file that triggers \use of uninitialized streams.\


The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9 0.6.x before 0.6.6 0.7.x before 0.7.5 and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DV file.


Google Chrome before 18.0.1025.142 does not properly handle SVG text elements which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 16.0.912.63 does not properly perform regex matching which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 15.0.874.120 does not properly implement the MKV and Vorbis media handlers which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 17.0.963.65 does not properly handle text which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.


RnaUtility.dll in RsvcHost.exe 2.30.0.23 in Rockwell RSLogix 19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted rna packet with a long string to TCP port 4446 that triggers (1) \a memset zero overflow\ or (2) an out-of-bounds read related to improper handling of a 32-bit size field.


Google Chrome before 16.0.912.63 does not properly handle PDF cross references which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The shader translator implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted date-time string in a .ics attachment.


Google Chrome before 16.0.912.63 does not properly parse SVG documents which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 16.0.912.63 does not properly handle YUV video frames which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Beckhoff TwinCAT 2.11.0.2004 and earlier allows remote attackers to cause a denial of service via a crafted request to UDP port 48899 which triggers an out-of-bounds read.


Google Chrome before 16.0.912.63 does not properly handle PDF documents which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 17.0.963.56 does not properly parse H.264 data which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier as used in Pidgin and possibly other products allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read related to interactions with certain versions of glib2.


Google Chrome before 10.0.648.127 on Linux does not properly handle Unicode ranges which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 9.0.597.107 on 64-bit Linux platforms does not properly perform pickle deserialization which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Google Chrome before 9.0.597.94 does not properly handle plug-ins which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3 2.32.x before 2.32.2 3.0.x before 3.0.2 and 3.1.x before 3.1.1 when tight encoding is used allows remote authenticated users to cause a denial of service (daemon crash) via crafted dimensions in a framebuffer update request that triggers an out-of-bounds read operation.


The

and

functions

in

FFmpeg

before

before

before

and

before

and

in

Libav

before

before

and

before

allow

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

read)

via

a

crafted

or

stream.


Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.


The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket.


In Exiv2 0.26 jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.


A flaw was discovered in the HPACK decoder of HAProxy before 1.8.14 that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.


A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling resulting in denial of service (double free and out-of-bounds read).


Ming 0.4.8 has an out-of-bounds read vulnerability in the function decompileIF() in the decompile.c file that causes a direct segmentation fault and leads to denial of service.


CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted PDF document.


IOAcceleratorFamily in Apple iOS before 9.3.3 and watchOS before 2.2.2 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via unspecified vectors.


AirPort in Apple Mac OS X 10.5.8 allows remote attackers to cause a denial of service (out-of-bounds read and reboot) via Wi-Fi frames on the local wireless network.


IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a crafted application.


Audio in Apple OS X before 10.11.6 mishandles a size value which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted audio file.


CoreGraphics in Apple OS X before 10.11.6 allows local users to obtain sensitive information from kernel memory and consequently gain privileges or cause a denial of service (out-of-bounds read) via unspecified vectors.


Audio in Apple OS X before 10.11.6 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read) via unspecified vectors.


AppleRAID in Apple OS X before 10.11.4 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read) via unspecified vectors.


CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.


Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function lexer_getchar (jsiLexer.c:9). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.


The kernel in Apple Mac OS X before 10.9 allows local users to obtain sensitive information or cause a denial of service (out-of-bounds read and system crash) via a crafted Mach-O file.


The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app.


Out-of-bounds read in the firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow an unauthenticated user to potentially enable denial of service via adjacent access.


Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial of service via local access.


Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a denial of service attack.


Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 14.0.33 may allow an unauthenticated user to potentially enable denial of service via network access.


The PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of Service (segfault).


coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.


Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file.


Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6 as used in GnuTLS allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.


Google V8 as used in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault).


rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of Service (segfault).


rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial of Service (segfault).


rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault).


rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).


Unspecified vulnerability in Google Chrome before 5.0.375.99 when WebGL is used allows remote attackers to cause a denial of service (out-of-bounds read) via unknown vectors.


The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors aka Issue 71717.


The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors aka Issue 71960.


The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read.


Certain

Huawei

products

Module;NGFW

Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace

have

a

DoS

vulnerability.

An

attacker

may

send

crafted

messages

from

a

FTP

client

to

exploit

this

vulnerability.

Due

to

insufficient

validation

of

the

message

successful

exploit

may

cause

the

system

out-of-bounds

read

and

result

in

a

denial

of

service

condition

of

the

affected

service.


UltraVNC revision 1210 has out-of-bounds read vulnerability in VNC client code inside Ultra decoder which results in a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1211.


UltraVNC revision 1207 has out-of-bounds read vulnerability in VNC client code inside TextChat module which results in a denial of service (DoS) condition. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1208.


An out-of-bounds read issue existed in the curl. This issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to a denial of service.


There is an out-of-bounds read vulnerability in eSE620X vESS V100R001C10SPC200 V100R001C20SPC200 V200R001C00SPC300. The vulnerability is due to a function that handles an internal message contains an out-of-bounds read vulnerability. An attacker could crafted messages between system process successful exploit could cause Denial of Service (DoS).


There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200 V100R001C20SPC200 V200R001C00SPC300. The vulnerability is due to a message-handling function that contains an out-of-bounds read vulnerability. An attacker can exploit this vulnerability by sending a specific message to the target device which could cause a Denial of Service (DoS).


clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380 CSCvh91400.


An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5 iTunes 12.10.7 for Windows iCloud for Windows 11.2 iCloud for Windows 7.19. A malicious application may cause a denial of service or potentially disclose memory contents.


An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 7.2 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave iOS 14.3 and iPadOS 14.3 tvOS 14.3. Processing a maliciously crafted image may lead to a denial of service.


Out-of-bounds Read in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.


An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user server or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file resulting in an information leak if the avatar is sent to another user.

denial of service
out of bound read
man in the middle


An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user server or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file resulting in an information leak if the file is sent to another user.


A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability.


Vulnerability

in

the

Java

VM

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Procedure

privilege

with

network

access

via

Oracle

Net

to

compromise

Java

VM.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

VM.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

denial of service
privileged network access compromise
dos


Vulnerability

in

the

Hyperion

Financial

Management

product

of

Oracle

Hyperion

(component:

Task

Automation).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

Financial

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Hyperion

Financial

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Hyperion

Financial

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Hyperion

Financial

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Memcached).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Table

privilege

with

network

access

via

Oracle

Net

to

compromise

Core

RDBMS.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Core

RDBMS.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Text

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

Oracle

Net

to

compromise

Oracle

Text.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Text.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Optimizer).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Table

privilege

with

network

access

via

Oracle

Net

to

compromise

Core

RDBMS.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Core

RDBMS.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Logging).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Java

VM

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Procedure

privilege

with

network

access

via

Oracle

Net

to

compromise

Java

VM.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Java

VM.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Communications

Operations

Monitor

product

of

Oracle

Communications

(component:

Mediation

Engine).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Operations

Monitor.

While

the

vulnerability

is

in

Oracle

Communications

Operations

Monitor

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Communications

Operations

Monitor

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Communications

Operations

Monitor

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Operations

Monitor.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

DDL).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Security:

Encryption).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

InnoDB).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Optimizer).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Communications

Operations

Monitor

product

of

Oracle

Communications

(component:

Mediation

Engine).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Communications

Operations

Monitor.

While

the

vulnerability

is

in

Oracle

Communications

Operations

Monitor

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Communications

Operations

Monitor

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Communications

Operations

Monitor

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Communications

Operations

Monitor.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Components

Services).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

MySQL

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

MySQL

Enterprise

Monitor

component

of

Oracle

MySQL

(subcomponent:

Monitoring:

Server).

Supported

versions

that

are

affected

are

and

earlier

and

earlier

and

and

earlier.

Easily

\exploitable\

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Enterprise

Monitor.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

MySQL

Enterprise

Monitor

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

MySQL

Enterprise

Monitor

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

MySQL

Enterprise

Monitor

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Enterprise

Monitor.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L).


Vulnerability

in

the

MySQL

Enterprise

Monitor

component

of

Oracle

MySQL

(subcomponent:

Monitoring:

Server).

Supported

versions

that

are

affected

are

and

earlier

and

earlier

and

and

earlier.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Enterprise

Monitor.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Enterprise

Monitor

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Enterprise

Monitor.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

InnoDB).

Supported

versions

that

are

affected

are

and

earlier.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Oracle

Retail

Customer

Engagement

component

of

Oracle

Retail

Applications

(subcomponent:

Segment).

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Retail

Customer

Engagement.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Retail

Customer

Engagement

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Retail

Customer

Engagement

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Retail

Customer

Engagement.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L).


Vulnerability

in

the

Hyperion

BI+

component

of

Oracle

Hyperion

(subcomponent:

Foundation

UI

Servlets).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

BI+.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Hyperion

BI+

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Hyperion

BI+

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Hyperion

BI+.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Hyperion

BI+

component

of

Oracle

Hyperion

(subcomponent:

Foundation

UI

Servlets).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

BI+.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Hyperion

BI+

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Hyperion

BI+

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Hyperion

BI+.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

API

frameworks).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Sun

ZFS

Storage

Appliance

Kit

(AK).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

Server:

Security:

LDAP

Auth).

Supported

versions

that

are

affected

are

and

prior

and

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

MySQL

Server

product

of

Oracle

MySQL

(component:

InnoDB).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure Identity and Access Management. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of Oracle Cloud Infrastructure Identity and Access Management accessible data as well as unauthorized read access to a subset of Oracle Cloud Infrastructure Identity and Access Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Cloud Infrastructure Identity and Access Management.


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Cloud

Control

Manager

OMS).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L).


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Discovery

Framework).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Oracle

Management

Service).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Global

EM

Framework).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector: