IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting \RMRR\) for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown once a device associated with such a region is active the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour ranging from IOMMU faults to memory corruption.


Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption. An attacker can leverage this vulnerability to execute code in the context of the current process.


A certain ActiveX control in the Indexing Service in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 does not properly process URLs which allows remote attackers to execute arbitrary programs via unspecified vectors that cause a \vulnerable binary\ to load and run aka \Memory Corruption in Indexing Service Vulnerability.\


aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034 which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption a different vulnerability than CVE-2008-1625.


The \apetag.c\ file in MP3Gain 1.5.2.r2 has a vulnerability which results in a stack memory corruption when opening a crafted MP3 file.


Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS High Sierra 10.13.1 Security Update 2017-001 Sierra and Security Update 2017-004 El Capitan macOS High Sierra 10.13. A malicious application may be able to elevate privileges.


It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_rebuild_header() function for both IPv4 and IPv6 DCCP connections which could result in memory corruptions. A remote attacker could use this flaw to crash the system.


A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger this vulnerability. This vulnerability only exists in the 64-bit version.


A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.


In Poppler 0.59.0 memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display Gfx::go Gfx::execOp Gfx::opFill Gfx::doPatternFill Gfx::doTilingPatternFill and Gfx::drawForm calls (aka a Gfx.cc infinite loop) a different vulnerability than CVE-2017-14519.


Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57 Firefox ESR < 52.5 and Thunderbird < 52.5.


In the Linux kernel before version 4.12 Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.


Memory safety bugs were reported in Firefox 54 Firefox ESR 52.2 and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.


A boundary error within the \parse_tiff_ifd()\ function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to \DSLR-A100\ and containing multiple sequences of 0x100 and 0x14A TAGs.


A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system leading to a crash. Due to the nature of the flaw privilege escalation cannot be fully ruled out although it is thought to be unlikely.


OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.


JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52 Firefox ESR < 45.8 Thunderbird < 52 and Thunderbird < 45.8.


Memory safety bugs were reported in Firefox 52 Firefox ESR 45.8 Firefox ESR 52 and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52 Firefox ESR < 45.8 Thunderbird < 52 and Thunderbird < 45.8.


An incorrect assumption about block structure in Blink in Google Chrome prior to 57.0.2987.133 for Mac Windows and Linux and 57.0.2987.132 for Android allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.


JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7 Firefox ESR < 45.7 and Firefox < 51.


Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52 Firefox ESR < 45.8 Thunderbird < 52 and Thunderbird < 45.8.


Memory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52 and Thunderbird < 52.


Memory safety bugs were reported in Firefox 52 Firefox ESR 52 and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 52.1 and Firefox < 53.


A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 52.1 and Firefox < 53.


Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux Windows and Mac and 61.0.3163.81 for Android allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.


During DOM manipulations of the accessibility tree through script the DOM tree can become out of sync with the accessibility tree leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 54 Firefox ESR < 52.2 and Thunderbird < 52.2.


Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7 Firefox ESR < 45.7 and Firefox < 51.


gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when rendering


Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls the append path can be switched from UFO to non-UFO one which leads to a memory corruption. In case UFO packet lengths exceeds MTU copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 (\IPv4/IPv6: UFO Scatter-gather approach\) on Oct 18 2005.


Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379 SD 210/SD 212/SD 205 SD 625 SD 835 SD 845 SD 850 SDA660.


An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos7420 Exynos8890 or MSM8996 chipsets) software. RKP allows memory corruption. The Samsung ID is SVE-2016-7897 (January 2017).


Improper

input

validation

in

Bluetooth

Controller

function

can

lead

to

possible

memory

corruption

in

Snapdragon

Mobile

in

version

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Improper

input

validation

for

GATT

data

packet

received

in

Bluetooth

Controller

function

can

lead

to

possible

memory

corruption

in

Snapdragon

Mobile

in

version

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


xvpng.c in xv 3.10a has memory corruption (out-of-bounds write) when decoding PNG comment fields leading to crashes or potentially code execution because it uses an incorrect length value.


An issue was discovered on Samsung mobile devices with KK(4.4) L(5.0/5.1) and M(6.0) software. There is a NULL pointer exception in PersonManager causing memory corruption. The Samsung ID is SVE-2017-8286 (June 2017).


An issue was discovered on Samsung mobile devices with M(6.0) software. There is a NULL pointer exception in WifiService via adb-cmd causing memory corruption. The Samsung ID is SVE-2017-8287 (June 2017).


An issue was discovered in Oniguruma 6.2.0 as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\\700' would produce an invalid code point value larger than 0xff in next_state_val() resulting in an out-of-bounds write memory corruption.


An issue was discovered in Oniguruma 6.2.0 as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index resulting in an out-of-bounds write memory corruption.


Quick Heal Internet Security 10.1.0.316 Quick Heal Total Security 10.1.0.316 and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Memory Corruption while parsing a malformed Mach-O file.


An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter \-f\ and stores it on the stack. Since there is no length check this results in corrupting the registers for the function sub_A098 which results in memory corruption.


An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the \Authorization: Basic\ RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device.


The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2 when an update to the Cloud plugin is available allows local users to gain privileges by writing crafted data to a shared memory region which triggers memory corruption.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9650 SD 210/SD 212/SD 205 SD 410/12 SD 425 SD 430 SD 450 SD 600 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 and SD 850 in multiple Secure DEMUX functions (e.g. SDMX_open_session SDMX_close_session SDMX_set_session_cfg) when parameter validation fails an error code is written into a response buffer without checking that response buffer length (rsplen) passed from HLOS is large enough to hold the response. If the buffer is at the end of a non-secure page followed by secured memory page this can cause a secure memory corruption.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9650 SD 210/SD 212/SD 205 SD 410/12 SD 425 SD 430 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 and SD 850 while processing the rmp secure command memory corruption may result if the response buffer is smaller than the expected size.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9650 SD 210/SD 212/SD 205 SD 410/12 SD 425 SD 430 SD 450 SD 600 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 and SD 850 in Secure DEMUX command handler when parameter validation fails an error code is written into a response buffer without checking that response buffer length passed from HLOS which may result in memory corruption.


Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a crafted PowerPoint file which triggers the corruption when the file is closed. NOTE: due to the lack of available details as of 20060717 it is unclear how this is related to CVE-2006-3655 CVE-2006-3660 and CVE-2006-3590 although it is possible that they are all different.


The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument which causes Linux glibc to report heap memory corruption possibly because a strcpy in the strdup2 function can \overwrite some data.\


The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage collected which might allow remote attackers to trigger operations on freed memory and cause memory corruption.


Unspecified vulnerability in Microsoft Word 2000 2002 and 2003 and Word Viewer 2003 allows remote attackers to execute code via unspecified vectors related to malformed data structures that trigger memory corruption a different vulnerability than CVE-2006-5994.


An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely leading to memory corruption.


zlib before 1.2.12 allows memory corruption when deflating (i.e. when compressing) if the input has many distant matches.


An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string leading to memory corruption.


An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference leading to memory corruption.


The Bluetooth subsystem in QEMU mishandles negative values for length variables leading to memory corruption.


An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order causing heap memory corruption.


An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates are mishandled.


An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled leading to memory corruption.


openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.


Mozilla developers and community members reported memory safety bugs present in Firefox 64. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 65.


Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.5 Firefox ESR < 60.5 and Firefox < 65.


Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10.x / 11.0 / 11.5 / 11.6 / 11.7 / 11.10 / 11.20 could be triggered by an attacker with local administrator permission on the system.


An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability.


Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.


Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4 Firefox ESR < 60.4 and Firefox < 64.


Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63.


Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63 Firefox ESR < 60.3 and Thunderbird < 60.3.


Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62.


Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 64.


Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62 Firefox ESR < 60.2 and Thunderbird < 60.2.1.


In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1 a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect leading to slab-out-of-bounds in jfs_xattr.


There is potential for memory corruption in the RIL daemon due to de reference of memory outside the allocated array length in RIL in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables in versions MDM9206 MDM9607 MDM9635M MDM9650 MSM8909W SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 439 / SD 429 SD 450 SD 625 SD 636 SD 650/52 SD 675 SD 712 / SD 710 / SD 670 SD 820A SD 835 SD 845 / SD 850 SD 855 SDM439 SDM630 SDM660 ZZ_QCS605.


remctld in remctl before 3.14 when an attacker is authorized to execute a command that uses the sudo option has a use-after-free that leads to a daemon crash memory corruption or arbitrary command execution.


There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior different vulnerability than CVE-2018-11420.


Memory corruption issue was discovered in Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior a different vulnerability than CVE-2018-11424.


There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio r a different vulnerability than CVE-2018-11423.


There is Memory corruption in the web interface of Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior a different vulnerability than CVE-2018-11425.


An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.


The

Linux

Kernel

version

contains

a

dangerous

feature

vulnerability

in

that

can

result

in

crash

and

possibly

memory

corruption.

This

attack

appear

to

be

exploitable

via

local

code

execution

and

the

ability

to

use

ptrace.

This

vulnerability

appears

to

have

been

fixed

in

git

commit


NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of nasm when handling a crafted file due to function assemble_file(inname depend_ptr) at asm/nasm.c:482. vulnerability in function assemble_file(inname depend_ptr) at asm/nasm.c:482. that can result in aborting/crash nasm program. This attack appear to be exploitable via a specially crafted asm file..


The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable leading to memory corruption.


An issue was discovered in libthulac.so in THULAC through 2018-02-25. \operator delete\ is used with \operator new\ in the TaggingLearner class in include/cb_tagging_learner.h possibly leading to memory corruption.


A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird < 52.7 Firefox ESR < 52.7 and Firefox < 59.


Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.6 Firefox ESR < 52.6 and Firefox < 58.


Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerability affects Thunderbird ESR < 52.8 Thunderbird < 52.8 and Firefox ESR < 52.8.


Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60 Firefox ESR < 60.1 and Firefox < 61.


Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.7 Firefox ESR < 52.7 and Firefox < 59.


Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 61.


Memory safety bugs present in Firefox 60 Firefox ESR 60 and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60 Thunderbird < 52.9 Firefox ESR < 60.1 Firefox ESR < 52.9 and Firefox < 61.


Memory safety bugs were reported in Firefox 59 Firefox ESR 52.7 and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8 Thunderbird ESR < 52.8 Firefox < 60 and Firefox ESR < 52.8.


Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.


In iOS before 11.4 and macOS High Sierra before 10.13.5 a memory corruption issue exists and was addressed with improved memory handling.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.3 Security Update 2019-001 High Sierra Security Update 2019-001 Sierra macOS Mojave 10.14.2 Security Update 2018-003 High Sierra Security Update 2018-006 Sierra. A malicious application may be able to elevate privileges.


In Safari before 11.1.2 iTunes before 12.8 for Windows iOS before 11.4.1 tvOS before 11.4.1 iCloud for Windows before 7.6 multiple memory corruption issues were addressed with improved memory handling.


In iOS before 11.2.5 macOS High Sierra before 10.13.3 Security Update 2018-001 Sierra and Security Update 2018-001 El Capitan watchOS before 4.2.2 and tvOS before 11.2.5 a memory corruption issue exists and was addressed with improved memory handling.


In iCloud for Windows before 7.3 Safari before 11.0.3 iTunes before 12.7.3 for Windows and iOS before 11.2.5 multiple memory corruption issues exist and were addressed with improved memory handling.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to: iOS 12.1 watchOS 5.1.2 tvOS 12.1.1 macOS High Sierra 10.13.6 Security Update 2018-003 High Sierra macOS Sierra 10.12.6 Security Update 2018-006.


This issue is fixed in macOS Mojave 10.14. A memory corruption issue was addressed with improved input validation.


When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte memory corruption may occur within a specific object.


DISPUTED

An

issue

was

discovered

in

Artifex

Ghostscript

before

The

.setdistillerkeys

PostScript

command

is

accepted

even

though

it

is

not

intended

for

use

during

document

processing

(e.g.

after

the

startup

phase).

This

leads

to

memory

corruption

allowing

remote

attackers

able

to

supply

crafted

PostScript

to

crash

the

interpreter

or

possibly

have

unspecified

other

impact.

Note:

A

reputable

source

believes

that

the

CVE

is

potentially

a

duplicate

of

as

explained

in

Red

Hat

bugzilla


A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw privilege escalation cannot be fully ruled out.


A flaw was found in the Linux kernel's handle_rx() function in the vhost_net driver. A malicious virtual guest under specific conditions can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.


Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84.


Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84 Thunderbird < 78.6 and Firefox ESR < 78.6.


An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers possibly causing memory corruption in for example Rust 2.x.


An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be able to obtain sensitive information or guest programs can experience memory corruption.


An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send !Sync object leading to a data race and memory corruption.


An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait a data race and memory corruption can occur.


An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait memory corruption can occur.


An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread a data race and memory corruption can occur.


An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds a data race and memory corruption can occur.


An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays uninitialized memory can be dropped when a panic occurs leading to memory corruption.


An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type leading to memory corruption.


An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait a data race and memory corruption can occur.


An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound a data race and memory corruption can occur.


An issue was discovered in the hashconsing crate before 1.1.0 for Rust. Because HConsed does not have bounds on its Send trait or Sync trait memory corruption can occur.


napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0 12.18.0 and < 14.4.0.


Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server a series ofspecially-crafted PDUs could result in memory corruption possiblyallowing arbitrary code to be executed with the privileges of therunning guacd process.


A flaw was found in grub2 in versions prior to 2.06. During USB device initialization descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


A vulnerability has been identified in JT2Go (All versions < V13.1.0.1) Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing BMP files. This can result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12018)


A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


A vulnerability has been identified in JT2Go (All versions < V13.1.0.1) Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of PCT files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12182)


When flex-basis was used on a table wrapper a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 84 Thunderbird < 78.6 and Firefox ESR < 78.6.


Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83 Firefox ESR < 78.5 and Thunderbird < 78.5.


During browser shutdown reference decrementing could have occured on a previously freed object resulting in a use-after-free memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 83 Firefox ESR < 78.5 and Thunderbird < 78.5.


Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83.


Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox < 83.


Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail but are potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5 Firefox < 73 and Firefox < ESR68.5.


Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6 Firefox < 74 Firefox < ESR68.6 and Firefox ESR < 68.6.


Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0 Firefox ESR < 68.7 and Firefox < 75.


A content process could have modified shared memory relating to crash reporting information crash itself and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 73 and Firefox < ESR68.5.


Mozilla developers reported memory safety bugs present in Firefox 72. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 73.


Mozilla developers Tyson Smith Bob Clary and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 75.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the handling of network packets. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11253.


An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter than 8 bytes. If the size of the incoming ICMPv6 request packet is shorter than this the operation that calculates the size of the ICMPv6 echo replies has an integer wrap around leading to memory corruption and eventually Denial-of-Service in pico_icmp6_send_echoreply_not_frag in pico_icmp6.c.


In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4 while using mb_strtolower() function with UTF-32LE encoding certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption crashes and potentially code execution.


An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also an attacker might prepend these bytes with the goal of triggering memory corruption issues.


Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.


An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.


There is a potentially exploitable out of memory condition In Nanopb before 0.4.1 0.3.9.5 and 0.2.9.4. When nanopb is compiled with PB_ENABLE_MALLOC the message to be decoded contains a repeated string bytes or message field and realloc() runs out of memory when expanding the array nanopb can end up calling `free()` on a pointer value that comes from uninitialized memory. Depending on platform this can result in a crash or further memory corruption which may be exploitable in some cases. This problem is fixed in nanopb-0.4.1 nanopb-0.3.9.5 nanopb-0.2.9.4.


In

LoRa

Basics

Station

before

there

is

a

Use

After

Free

vulnerability

that

leads

to

memory

corruption.

This

bug

is

triggered

on

machines

when

the

CUPS

server

responds

with

a

message

where

the

signature

length

is

larger

than

GByte

(never

happens

in

practice)

or

the

response

is

crafted

specifically

to

trigger

this

issue

(i.e.

the

length

signature

field

indicates

a

value

larger

than

although

the

signature

actually

does

not

contain

that

much

data).

In

such

a

scenario

on

bit

machines

Basic

Station

would

execute

a

code

path

where

a

piece

of

memory

is

accessed

after

it

has

been

freed

causing

the

process

to

crash

and

restarted

again.

The

CUPS

transaction

is

typically

mutually

authenticated

over

TLS.

Therefore

in

order

to

trigger

this

vulnerability

the

attacker

would

have

to

gain

access

to

the

CUPS

server

first.

If

the

user

chose

to

operate

without

authentication

over

TLS

but

yet

is

concerned

about

this

vulnerability

one

possible

workaround

is

to

enable

TLS

authentication.

This

has

been

fixed

in


Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4 Firefox < 82 and Thunderbird < 78.4.


A

memory

corruption

issue

was

found

in

Artifex

Ghostscript

and

Use

of

a

non-standard

PostScript

operator

can

allow

overriding

of

file

access

controls.

The

'rsearch'

calculation

for

the

'post'

size

resulted

in

a

size

that

was

too

large

and

could

underflow

to

max

This

was

fixed

in

commit


In

TensorFlow

Lite

before

versions

and

models

using

segment

sum

can

trigger

a

write

out

bounds

segmentation

fault

if

the

segment

ids

are

not

sorted.

Code

assumes

that

the

segment

ids

are

in

increasing

order

using

the

last

element

of

the

tensor

holding

them

to

determine

the

dimensionality

of

output

tensor.

This

results

in

allocating

insufficient

memory

for

the

output

tensor

and

in

a

write

outside

the

bounds

of

the

output

array.

This

usually

results

in

a

segmentation

fault

but

depending

on

runtime

conditions

it

can

provide

for

a

write

gadget

to

be

used

in

future

memory

corruption-based

exploits.

The

issue

is

patched

in

commit

and

is

released

in

TensorFlow

versions

or

A

potential

workaround

would

be

to

add

a

custom

`Verifier`

to

the

model

loading

code

to

ensure

that

the

segment

ids

are

sorted

although

this

only

handles

the

case

when

the

segment

ids

are

stored

statically

in

the

model.

A

similar

validation

could

be

done

if

the

segment

ids

are

generated

at

runtime

between

inference

steps.

If

the

segment

ids

are

generated

as

outputs

of

a

tensor

during

inference

steps

then

there

are

no

possible

workaround

and

users

are

advised

to

upgrade

to

patched

code.


When processing a MAR update file after the signature has been validated an invalid name length could result in a heap overflow leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla this issue is only exploitable with the Mozilla-controlled signing key. This vulnerability affects Firefox < 80.


In tensorflow-lite before versions 1.15.4 2.0.3 2.1.2 2.2.1 and 2.3.1 if a TFLite saved model uses the same tensor as both input and output of an operator then depending on the operator we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow 1.15.4 2.0.3 2.1.2 2.2.1 or 2.3.1.


Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81 Thunderbird < 78.3 and Firefox ESR < 78.3.


In

Tensorflow

before

versions

and

the

implementation

of

can

be

made

to

use

uninitialized

memory

resulting

in

further

memory

corruption.

This

is

because

the

glue

code

assumes

that

the

argument

is

a

tensor.

However

there

is

nothing

stopping

users

from

passing

in

a

Python

object

instead

of

a

tensor.

The

uninitialized

memory

address

is

due

to

a

Since

the

`PyObject`

is

a

Python

object

not

a

TensorFlow

Tensor

the

cast

to

`EagerTensor`

fails.

The

issue

is

patched

in

commit

and

is

released

in

TensorFlow

versions

or


Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82.


Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81.


Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79 Firefox ESR < 68.11 Firefox ESR < 78.1 Thunderbird < 68.11 and Thunderbird < 78.1.


Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80 Firefox ESR < 78.2 Thunderbird < 78.2 and Firefox for Android < 80.


Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto Snapdragon Connectivity Snapdragon Mobile


While processing server certificate from IPSec server certificate validation for subject alternative name API can cause heap overflow which can lead to memory corruption in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile


Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Mobile


Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Memory corruption due to ioctl command size was incorrectly set to the size of a pointer and not enough storage is allocated for the copy of the user argument in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Memory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wired Infrastructure and Networking


Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from shared MSG RAM in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon IoT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave. Processing a maliciously crafted image may lead to arbitrary code execution.


In Wind River VxWorks memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result the actual memory allocated is smaller than the buffer size specified by the arguments leading to memory corruption.


A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption crashes and potentially code execution. This could have happened only if several events occurred together in sequence including receiving an animated sticker while placing a WhatsApp video call on hold.


Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions and version 1.14.0 and later versions.


WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.


A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances the index (a UInt) is copied and truncated into a uint16 which can lead to out of bound indexing and possible memory corruption.


u'Channel

name

string

which

has

been

read

from

shared

memory

is

potentially

subjected

to

string

manipulations

but

not

validated

for

termination

can

results

into

memory

corruption'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Bitra

Kamorta

Nicobar

Rennell

Saipan


Possible

memory

corruption

in

perfservice

due

to

improper

validation

array

length

taken

from

user

application.

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

in

Kamorta

Nicobar

Rennell

Saipan


u'Lack

of

check

to

ensure

that

the

TX

read

index

RX

write

index

that

are

read

from

shared

memory

are

less

than

the

FIFO

size

results

into

memory

corruption

and

potential

information

leakage'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Bitra

Kamorta

Nicobar

Rennell

Saipan


u'Non-secure

memory

is

touched

multiple

times

during

execution

and

can

lead

to

privilege

escalation

or

memory

corruption'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wired

Infrastructure

and

Networking

in

Kamorta

Rennell


Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 77.


When processing callbacks that occurred during window flushing in the parent process the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10 Firefox < 78 and Thunderbird < 68.10.0.


Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8 Firefox < 76 and Thunderbird < 68.8.0.


Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0 Firefox < 77 and Firefox ESR < 68.9.


OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.


Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 76.


In non-standard configurations a JPEG image created by JavaScript could have caused an internal variable to overflow resulting in an out of bounds write memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 78.


Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 78.


Due to confusion about ValueTags on JavaScript Objects an object may pass through the type barrier resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10 Firefox < 78 and Thunderbird < 68.10.0.


A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. A specially crafted file can trigger the reuse of a freed memory which can result in further memory corruption and arbitrary code execution. To trigger this vulnerability the victim needs to open an attacker-provided malformed file.


Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vulnerability affects Firefox < 50.1 Firefox ESR < 45.6 and Thunderbird < 45.6.


Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1 Firefox ESR < 45.6 and Thunderbird < 45.6.


An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page.


An exploitable heap out of bounds write vulnerability exists in the Fitz graphical library part of the MuPDF renderer. A specially crafted PDF file can cause a out of bounds write resulting in heap metadata and sensitive process memory corruption leading to potential code execution. Victim needs to open the specially crafted file in a vulnerable reader in order to trigger this vulnerability.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the \FaceTime\ component which allows remote attackers to trigger memory corruption and obtain audio data from a call that appeared to have ended.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

TOCTOU

vulnerability

during

SSD

image

decryption

may

cause

memory

corruption.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205 SD 410/12 SD 425 SD 427 SD 430 SD 435 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 808 SD 810 SD 820 SD 835 SD 845 SDM630 SDM636 SDM660 SDX20 and Snapdragon_High_Med_2016 the 'proper' solution for this will be to ensure that any users of qsee_log in the bootchain (before Linux boots) unallocate their buffers and clear the qsee_log pointer. Until support for that is implemented in TZ and the bootloader enable tz_log to avoid potential scribbling. This solution will prevent the linux kernel memory corruption.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Small

Cell

SoC

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

improper

input

validation

infuse

read

request

leads

to

memory

corruption.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

a

simultaneous

command

post

for

addSA

or

updateSA

on

same

SA

leads

to

memory

corruption.

APIs

addSA

and

updateSA

APIs

access

the

global

variable

outside

of

mutex

protection.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9607 MDM9635M MDM9640 MDM9645 MDM9650 MDM9655 MSM8909W SD 210/SD 212/SD 205 SD 425 SD 430 SD 450 SD 617 SD 625 SD 650/52 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 SD 850 and SDX20 NPA routines on the rootPD that handle resource requests remoted over QDI may not validate pointers passed from user space which may result in guest OS memory corruption.


An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. je_free in libQjpeg.so in Qjpeg in Qt 5.5 allows memory corruption via a malformed JPEG file. The Samsung ID is SVE-2015-5110 (January 2016).


An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. The Gallery library allow memory corruption via a malformed image. The Samsung ID is SVE-2016-5317 (May 2016).


Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5 Firefox ESR < 45.5 and Firefox < 50.


A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.


spf.c in Courier Mail Server does not properly handle DNS failures when looking up Sender Policy Framework (SPF) records which could allow attackers to cause memory corruption.


Unspecified vulnerability in VMware Workstation 5.5.8 and earlier and 6.0.5 and earlier 6.x versions; VMware Player 1.0.8 and earlier and 2.0.5 and earlier 2.x versions; VMware Server 1.0.9 and earlier; VMware ESXi 3.5; and VMware ESX 3.0.2 through 3.5 allows guest OS users to have an unknown impact by sending the virtual hardware a request that triggers an arbitrary physical-memory write operation leading to memory corruption.


The rb_str_format function in Ruby 1.8.4 and earlier 1.8.5 before 1.8.5-p231 1.8.6 before 1.8.6-p230 1.8.7 before 1.8.7-p22 and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca a different issue than CVE-2008-2662 CVE-2008-2663 and CVE-2008-2725. NOTE: as of 20080624 there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative although it is likely to change.


gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386 which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.


The PowerVR SGX driver in Android before 2.3.6 allows attackers to gain root privileges via an application that triggers kernel memory corruption using crafted user data to the pvrsrvkm device.


Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The fixed version is: 3.4.0 and later.


Adobe Reader and Acrobat 7.0.8 and earlier allows user-assisted remote attackers to execute code via a crafted PDF file that triggers memory corruption and overwrites a subroutine pointer during rendering.


Memory safety bugs were reported in Firefox 54. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 55.


Memory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57.


Memory safety bugs were reported in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56.


Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 51.


Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 54.


Memory safety bugs were reported in Firefox 57. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 58.


Memory safety bugs were reported in Firefox 58. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 59.


Memory safety bugs were reported in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 60.


Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1.


Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.


A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via memory corruption.


Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.


In the Linux kernel before 3.1 an off by one in the drivers/target/loopback/tcm_loop.c tcm_loop_make_naa_tpg() function could result in at least memory corruption.


Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption.


Multiple unspecified vulnerabilities in (1) mediasvr and (2) caloggerd in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 have unknown impact and attack vectors related to memory corruption.


Unknown vulnerability in the DNP dissector in Ethereal 0.10.5 through 0.10.8 allows remote attackers to cause \memory corruption.\


Unspecified vulnerability in the web server in eMule X-Ray before 1.4 allows remote attackers to trigger memory corruption via unknown attack vectors.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4 macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.


A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2 watchOS 5.1.3 iTunes 12.9.3 for Windows. A sandboxed process may be able to circumvent sandbox restrictions.


A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2. A malicious application may be able to elevate privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2. A malicious application may cause unexpected changes in memory shared between processes.


A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.2 tvOS 12.2 watchOS 5.2. Clicking a malicious SMS link may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.2 tvOS 12.2 Safari 12.1 iTunes 12.9.4 for Windows. A sandboxed process may be able to circumvent sandbox restrictions.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4 macOS Mojave 10.14.6 tvOS 12.4 watchOS 5.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15 tvOS 13. Processing a maliciously crafted movie may result in the disclosure of process memory.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4 macOS Mojave 10.14.6 tvOS 12.4 watchOS 5.3. A remote attacker may be able to cause arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. A local user may be able to cause unexpected system termination or read kernel memory.


A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina Security Update 2021-003 Mojave. A local attacker may be able to elevate their privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in Security Update 2021-005 Catalina macOS Big Sur 11.6. A local attacker may be able to elevate their privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-004 Catalina Security Update 2021-005 Mojave. A malicious application may be able to gain root privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in Boot Camp 6.1.14. A malicious application may be able to elevate privileges.


A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.6.5 macOS Monterey 12.3 Security Update 2022-003 Catalina. Processing a maliciously crafted file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1 macOS Mojave 10.14.2 tvOS 12.1.1 watchOS 5.1.2.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5 iTunes 12.9 for Windows iCloud for Windows 7.7.


A memory corruption issue was addressed with improved input validation This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1 tvOS 12.1.1 watchOS 5.1.2 Safari 12.0.2 iTunes 12.9.2 for Windows iCloud for Windows 7.9.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12 macOS Mojave 10.14.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1 watchOS 5.1.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.1.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5 iTunes 12.9 for Windows iCloud for Windows 7.7.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1 macOS Mojave 10.14.1 tvOS 12.1 watchOS 5.1 iTunes 12.9.1.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS High Sierra 10.13.6 macOS Mojave 10.14.


A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12.1 tvOS 12.1 watchOS 5.1 Safari 12.0.1 iTunes 12.9.1 iCloud for Windows 7.8.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1 macOS Mojave 10.14.1 tvOS 12.1 watchOS 5.1.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1.


A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12 tvOS 12 watchOS 5 Safari 12 iTunes 12.9 for Windows iCloud for Windows 7.7.


A memory corruption issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1 macOS Mojave 10.14.1 tvOS 12.1 watchOS 5.1.


A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12 tvOS 12 Safari 12 iTunes 12.9 for Windows iCloud for Windows 7.7.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1 macOS Mojave 10.14.2 tvOS 12.1.1 watchOS 5.1.2.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.


A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to Xcode 10.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1 macOS Mojave 10.14.2 tvOS 12.1.1 watchOS 5.1.2.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.


A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS High Sierra 10.13.6.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1 tvOS 11.4.1 watchOS 4.3.2 Safari 11.1.2 iTunes 12.8 for Windows iCloud for Windows 7.6.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1 macOS High Sierra 10.13.6 tvOS 11.4.1 watchOS 4.3.2.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1 macOS High Sierra 10.13.6 tvOS 11.4.1 watchOS 4.3.2 iTunes 12.8 for Windows iCloud for Windows 7.6.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1 tvOS 12.1.1 watchOS 5.1.2 Safari 12.0.2 iTunes 12.9.2 for Windows iCloud for Windows 7.9.


A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12 macOS Mojave 10.14 tvOS 12 watchOS 5 iTunes 12.9 for Windows iCloud for Windows 7.7.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2.


A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to cause unexpected system termination or read kernel memory.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. A remote attacker may cause an unexpected application termination.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1 iTunes for Windows 12.10.9. Processing a maliciously crafted text file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. Viewing a maliciously crafted JPEG file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to determine kernel memory layout.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7 watchOS 5.3.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. Viewing a maliciously crafted JPEG file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2. A malicious application may be able to execute arbitrary code with kernel privileges.

memory corruption
arbitrary code execution


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.3 macOS Mojave 10.14.3 tvOS 12.1.2 watchOS 5.1.3. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.3 tvOS 12.3 watchOS 5.2.1. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.5. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 6 iOS 13 tvOS 13. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15 tvOS 13. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 6 iOS 13 tvOS 13. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.3 macOS Mojave 10.14.5 tvOS 12.3 watchOS 5.2.1. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 14.7 macOS Big Sur 11.5. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in Security Update 2021-005 Catalina macOS Big Sur 11.6. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 11.2 watchOS 4.2. An application may be able to execute arbitrary code with kernel privilege.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS High Sierra 10.13. An application may be able to execute arbitrary code with elevated privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.4. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 macOS Catalina 10.15.1 tvOS 13.2 watchOS 6.1. An application may be able to execute arbitrary code with system privileges.

memory corruption
arbitrary code execution
dos


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 macOS Catalina 10.15.1 tvOS 13.2 watchOS 6.1. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 6.1.2 iOS 13.3.1 and iPadOS 13.3.1 tvOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 tvOS 13.2. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.1 and iPadOS 15.1 tvOS 15.1. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.1 and iPadOS 15.1. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to execute arbitrary code with system privileges on devices with an Apple Neural Engine.


A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Monterey 12.3 watchOS 8.5. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved validation. This issue is fixed in watchOS 8.5 iOS 15.4 and iPadOS 15.4. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6 watchOS 6.2.8. A malicious application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. A malicious application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in Security Update 2021-002 Catalina iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. An application may be able to gain elevated privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8 Safari 15 iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution.


A memory corruption issue was addressed with improved input validation. This issue is fixed in tvOS 15 watchOS 8 iOS 15 and iPadOS 15. Processing a maliciously crafted image may lead to arbitrary code execution.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8 Safari 15 tvOS 15 iOS 15 and iPadOS 15 watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.3 iOS 15.3 and iPadOS 15.3 watchOS 8.4 macOS Monterey 12.2. Processing a maliciously crafted file may lead to arbitrary code execution.


A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 watchOS 8.5. Processing a maliciously crafted image may lead to heap corruption.


A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8 watchOS 6.2.8. A malicious application may be able to break out of its sandbox.


A memory corruption issue was addressed with improved validation. This issue is fixed in Safari 13.0.1 iOS 13.1 and iPadOS 13.1 tvOS 13. Processing maliciously crafted web content may lead to arbitrary code execution.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. A remote attacker may be able to cause arbitrary code execution.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. Processing a maliciously crafted string may lead to heap corruption.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1 iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.


Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in watchOS 6.1 iCloud for Windows 11.0. Multiple issues in libxslt.


Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.4. Processing malicious data may lead to unexpected application termination.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to macOS High Sierra 10.13.6.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12 tvOS 12 watchOS 5 Safari 12 iTunes 12.9 for Windows iCloud for Windows 7.7.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1 watchOS 5.1 Safari 12.0.1 iTunes 12.9.1 iCloud for Windows 7.8.


Multiple memory corruption issues were addressed with improved input validation. This issue affected versions prior to iOS 11.4.1 tvOS 11.4.1 watchOS 4.3.2 Safari 11.1.2 iTunes 12.8 for Windows iCloud for Windows 7.6.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1 tvOS 11.4.1 Safari 11.1.2 iTunes 12.8 for Windows iCloud for Windows 7.6.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12 tvOS 12 Safari 12 iTunes 12.9 for Windows iCloud for Windows 7.7.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.3 tvOS 11.3 watchOS 4.3 Safari 11.1 iTunes 12.7.4 for Windows iCloud for Windows 7.4.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1 tvOS 11.4.1 watchOS 4.3.2 Safari 11.1.2 iTunes 12.8 for Windows iCloud for Windows 7.6.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1 tvOS 12.1 watchOS 5.1 Safari 12.0.1 iTunes 12.9.1 iCloud for Windows 7.8.


Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1 tvOS 12.1.1 watchOS 5.1.2 Safari 12.0.2 iTunes 12.9.2 for Windows iCloud for Windows 7.9.


Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code with kernel privileges.


Multiple memory corruption issues were addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to execute arbitrary code with kernel privileges.


A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory aka 'Microsoft Outlook Memory Corruption Vulnerability'.


A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based) aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426 CVE-2019-1427 CVE-2019-1429.


A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001 CVE-2019-1056 CVE-2019-1059.


A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1194.


A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer aka 'Scripting Engine Memory Corruption Vulnerability'.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1092 CVE-2019-1103 CVE-2019-1106 CVE-2019-1107.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062 CVE-2019-1092 CVE-2019-1103 CVE-2019-1107.