A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated remote attacker to execute arbitrary code with vmanage user privileges or cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient access restrictions to the HTTP management interface of the affected solution. An attacker could exploit this vulnerability by sending a malicious HTTP request to the affected management service through an authenticated device. A successful exploit could allow the attacker to execute arbitrary code with vmanage user privileges or stop HTTP services on an affected system. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software vEdge 100 Series Routers vEdge 1000 Series Routers vEdge 2000 Series Routers vEdge 5000 Series Routers vEdge Cloud Router Platform vManage Network Management Software vSmart Controller Software. Cisco Bug IDs: CSCvi69976.


Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software Cisco IOS XE Software and Cisco IOS XR Software could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

denial of service
arbitrary code execution
dos


A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Small Business RV340 RV340W RV345 and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated remote attacker to execute arbitrary code on an affected device or cause the device to reload resulting in a denial of service (DoS) condition. The vulnerability exists because HTTP requests are not properly validated. An attacker could exploit this vulnerability by sending a crafted HTTP request over an SSL connection to an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device or cause the device to reload resulting in a DoS condition.


A vulnerability in the Topology Discovery Service of Cisco One Platform Kit (onePK) in Cisco IOS Software Cisco IOS XE Software Cisco IOS XR Software and Cisco NX-OS Software could allow an unauthenticated adjacent attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient length restrictions when the onePK Topology Discovery Service parses Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol message to an affected device. An exploit could allow the attacker to cause a stack overflow which could allow the attacker to execute arbitrary code with administrative privileges or to cause a process crash which could result in a reload of the device and cause a DoS condition.


Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) that are running Cisco IOS Software could allow an attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device or cause the device to reload. This vulnerability is due to missing checks when an IP camera processes a Cisco Discovery Protocol packet. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute code on the affected IP camera or cause it to reload unexpectedly resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).


The JPEG decoder in Microsoft Internet Explorer allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via certain crafted JPEG images as demonstrated using (1) mov_fencepost.jpg (2) cmp_fencepost.jpg (3) oom_dos.jpg or (4) random.jpg.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016 RV042 RV042G RV082 RV320 and RV325 Routers could allow an authenticated remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload resulting in a denial of service (DoS) condition. To exploit these vulnerabilities an attacker would need to have valid administrator credentials on the affected device.

denial of service
arbitrary code execution
improper user input validation
dos


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W RV130 RV130W and RV215W Routers could allow an authenticated remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload resulting in a denial of service (DoS) condition. To exploit these vulnerabilities an attacker would need to have valid administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.


Format string vulnerability in PackageKit in Apple Mac OS X 10.6.x before 10.6.6 allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to interaction between Software Update and distribution scripts.

denial of service
arbitrary code execution
man in the middle


The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.

denial of service
arbitrary code execution
out of bound read


The SelectionIterator::GetNextSegment function in Mozilla Firefox before 21.0 Firefox ESR 17.x before 17.0.6 Thunderbird before 17.0.6 and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


The gfxSkipCharsIterator::SetOffsets function in Mozilla Firefox before 21.0 Firefox ESR 17.x before 17.0.6 Thunderbird before 17.0.6 and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0 Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1 Thunderbird before 17.0.2 Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


The ClusterIterator::NextCluster function in Mozilla Firefox before 19.0 Thunderbird before 17.0.3 and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


The nsCodingStateMachine::NextState function in Mozilla Firefox before 19.0 Thunderbird before 17.0.3 and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


The RandR extension in XFree86 4.2.0 X.Org X Window System (aka X11 or X) X11R6.7 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcRRQueryVersion (2) SProcRRGetScreenInfo (3) SProcRRSelectInput or (4) SProcRRConfigureOutputProperty function.


The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXChangeDeviceControl (2) ProcXChangeDeviceControl (3) ProcXChangeFeedbackControl (4) ProcXSendExtensionEvent (5) SProcXIAllowEvents (6) SProcXIChangeCursor (7) ProcXIChangeHierarchy (8) SProcXIGetClientPointer (9) SProcXIGrabDevice (10) SProcXIUngrabDevice (11) ProcXIUngrabDevice (12) SProcXIPassiveGrabDevice (13) ProcXIPassiveGrabDevice (14) SProcXIPassiveUngrabDevice (15) ProcXIPassiveUngrabDevice (16) SProcXListDeviceProperties (17) SProcXDeleteDeviceProperty (18) SProcXIListProperties (19) SProcXIDeleteProperty (20) SProcXIGetProperty (21) SProcXIQueryDevice (22) SProcXIQueryPointer (23) SProcXISelectEvents (24) SProcXISetClientPointer (25) SProcXISetFocus (26) SProcXIGetFocus or (27) SProcXIWarpPointer function.


The Render extension in XFree86 4.0.1 X.Org X Window System (aka X11 or X) X11R6.7 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion (2) SProcRenderQueryVersion (3) SProcRenderQueryPictFormats (4) SProcRenderQueryPictIndexValues (5) SProcRenderCreatePicture (6) SProcRenderChangePicture (7) SProcRenderSetPictureClipRectangles (8) SProcRenderFreePicture (9) SProcRenderComposite (10) SProcRenderScale (11) SProcRenderCreateGlyphSet (12) SProcRenderReferenceGlyphSet (13) SProcRenderFreeGlyphSet (14) SProcRenderFreeGlyphs or (15) SProcRenderCompositeGlyphs function.


The XVideo extension in XFree86 4.0.0 X.Org X Window System (aka X11 or X) X11R6.7 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXvQueryExtension (2) SProcXvQueryAdaptors (3) SProcXvQueryEncodings (4) SProcXvGrabPort (5) SProcXvUngrabPort (6) SProcXvPutVideo (7) SProcXvPutStill (8) SProcXvGetVideo (9) SProcXvGetStill (10) SProcXvPutImage (11) SProcXvShmPutImage (12) SProcXvSelectVideoNotify (13) SProcXvSelectPortNotify (14) SProcXvStopVideo (15) SProcXvSetPortAttribute (16) SProcXvGetPortAttribute (17) SProcXvQueryBestSize (18) SProcXvQueryPortAttributes (19) SProcXvQueryImageAttributes or (20) SProcXvListImageFormats function.


The DBE extension in X.Org X Window System (aka X11 or X) X11R6.1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcDbeSwapBuffers or (2) SProcDbeSwapBuffers function.


The SProcXFixesSelectSelectionInput function in the XFixes extension in X.Org X Window System (aka X11 or X) X11R6.8.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value.


The SProcXCMiscGetXIDList function in the XC-MISC extension in X.Org X Window System (aka X11 or X) X11R6.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value.


X.Org

Server

(aka

xserver

and

xorg-server)

through

before

allows

remote

authenticated

users

to

cause

a

denial

of

service

(out-of-bounds

read

or

write)

or

possibly

execute

arbitrary

code

via

a

crafted

length

or

index

value

to

the

or

function

in

the

(a)

or

(b)

Present

extension.


The

PropertyProvider::FindJustificationRange

function

in

Mozilla

Firefox

before

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

(out-of-bounds

read)

via

unspecified

vectors.


Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28 and 2.6.x to 2.6.9 allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function which decrements a counter to -1 or (2) the igmp_marksources function which does not properly validate IGMP message parameters and performs an out-of-bounds read.


An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the \Intel Graphics Driver\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read) via a crafted app.


Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read or write access) via unspecified open and close requests aka \Microsoft Silverlight RCE Vulnerability.\


The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.


The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.


Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.


The

nsTransformedTextRun::SetCapitalization

function

in

Mozilla

Firefox

before

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

(out-of-bounds

read

of

heap

memory)

via

a

crafted

Cascading

Style

Sheets

(CSS)

token

sequence

that

triggers

a

restyle

or

reflow

operation.


The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.


WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted packet to (1) TCP or (2) UDP port 2001.


The IsCSSWordSpacingSpace function in Mozilla Firefox before 16.0 Firefox ESR 10.x before 10.0.8 Thunderbird before 16.0 Thunderbird ESR 10.x before 10.0.8 and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read.


An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the \Kernel\ component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read) via a crafted app.


The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.


The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4 when built with the Firmware Configuration device emulation support allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.


The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML XML or SVG document.


The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4 as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1 does not validate a certain skip operation which allows remote attackers to execute arbitrary code obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.


The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted MetaActions in an (1) ODP or (2) OTP file.


pi.c in OpenJPEG as used in PDFium in Google Chrome before 48.0.2564.109 does not validate a certain precision value which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document related to the opj_pi_next_rpcl opj_pi_next_pcrl and opj_pi_next_cprl functions.


The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.


Pro-face GP-Pro EX EX-ED before 4.05.000 PFXEXEDV before 4.05.000 PFXEXEDLS before 4.05.000 and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read.


The

GLX

extension

in

X.Org

X

Window

System

(aka

or

X)

and

X.Org

Server

(aka

xserver

and

xorg-server)

before

allows

remote

authenticated

users

to

cause

a

denial

of

service

(out-of-bounds

read

or

write)

or

possibly

execute

arbitrary

code

via

a

crafted

length

or

index

value

to

the

DoSwapInterval

DoGetProgramString

DoGetString

GetSeparableFilter

GetConvolutionFilter

GetHistogram

GetMinmax

or

GetColorTable

function.

denial of service
arbitrary code execution
out of bound read
dos


BrowseGate 2.80 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long Authorization or Referer MIME headers in the HTTP request.

denial of service
arbitrary command execution


CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0 and Proficy Process Systems with CIMPLICITY allows remote attackers to execute arbitrary commands or cause a denial of service (daemon crash) via a crafted packet.


The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR packet to TCP port 5555 aka ZDI-CAN-1885.


Netscape Enterprise Server in NetWare 5.1 allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed URL.


FTP servers such as OpenBSD ftpd NetBSD ftpd ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title) which allows remote attackers to cause a denial of service or execute arbitrary commands.


Avirt Mail 4.0 and 4.2 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long \RCPT TO\ or \MAIL FROM\ command.


EServ 2.92 Build 2982 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via long HELO and MAIL FROM commands.


The logging capability in muh 2.05d IRC server does not properly cleanse user-injected format strings which allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed nickname.


Netscape Communicator 4.73 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a JPEG image containing a comment with an illegal field length of 1.


The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL.


The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


Vulnerability in auto_parms and set_parms in HP-UX 11.00 and earlier allows remote attackers to execute arbitrary commands or cause a denial of service.


The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


Argosoft FRP server 1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long string to the (1) USER or (2) CWD commands.


Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long URL.


The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP) which allows an attacker to cause a denial of service or execute arbitrary commands aka the \Extended Stored Procedure Parameter Parsing\ vulnerability.


IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.


Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string which allows remote attackers to execute arbitrary commands or cause a denial of service (paging outage) by leveraging an unattended workstation aka ZEN-15412.


The management interface in the phion airlock Web Application Firewall (WAF) 4.1-10.41 does not properly handle CGI requests that specify large width and height parameters for an image which allows remote attackers to execute arbitrary commands or cause a denial of service (resource consumption) via a crafted request.


Palm Pilot HotSync Manager 3.0.4 in Windows 98 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long string to port 14238 while the manager is in network mode.


Netscape Communicator 4.7 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long certificate key.


Format string vulnerability in the PrintString function in c_console.cpp in client/server Doom (csDoom) 0.7 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via format string specifiers in strings passed to the console.


Configuration error in Argus PitBull LX allows root users to bypass specified access control restrictions and cause a denial of service or execute arbitrary commands by modifying kernel variables such as MaxFiles MaxInodes and ModProbePath in /proc/sys via calls to sysctl.


FaSTream FTP++ Server 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long username.


SEDUM 2.1 HTTP server allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.


Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request containing \%2e\ (dot dot) characters.


Moby Netsuite Web Server 1.02 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.


CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.


CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.


MDG Computer Services Web Server 4D WS4D/eCommerce 3.0 and earlier and possibly 3.5.3 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long HTTP request.


Multiple unspecified vulnerabilities in NetApp Data ONTAP as used on NetApp and IBM eServer platforms allow remote attackers to execute arbitrary commands cause a denial of service (system crash) or obtain sensitive information probably related to insufficient access control for HTTP requests. NOTE: this may overlap CVE-2008-3160.


w_export.c in XWine 1.0.1 on Debian GNU/Linux sets insecure permissions (0666) for /etc/wine/config which might allow local users to execute arbitrary commands or cause a denial of service by modifying the file.


Format string vulnerability in ftpd in HP-UX 10.20 allows remote attackers to cause a denial of service or execute arbitrary commands via format strings in the PASS command.


Format string vulnerability in AOL Instant Messenger (AIM) 4.1.2010 allows remote attackers to cause a denial of service and possibly execute arbitrary commands by transferring a file whose name includes format characters.


Format string vulnerability in AnswerBook2 (AB2) web server dwhttpd 3.1a4 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via encoded % characters in an HTTP request which is improperly logged.


Multiple unspecified vulnerabilities in Nortel Communication Server 1000 4.50.x allow remote attackers to execute arbitrary commands to gain privileges obtain sensitive information or cause a denial of service via unknown vectors.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Evolved Programmable Network (EPN) Manager could allow an authenticated remote attacker to execute arbitrary commands on an affected system. The vulnerability is due to insufficient validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system (OS) with the permissions of a special non-root user. In this way an attacker could take control of the affected system which would allow them to obtain and alter sensitive data. The attacker could also affect the devices that are managed by the affected system by pushing arbitrary configuration files retrieving device credentials and confidential information and ultimately undermining the stability of the devices causing a denial of service (DoS) condition.

denial of service
arbitrary command execution
dos


ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service (aka DoS) vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat message exists. The user sending the message does not need to be authorized within the bot or ASF process. The attacker needs to know ASF's `CommandPrefix` in advance but majority of ASF setups run with an unchanged default value. This attack does not allow attacker to gain any potentially-sensitive information such as logins or passwords does not allow to execute arbitrary commands and otherwise exploit the crash further. The issue is patched in ASF V4.3.1.0. The only workaround which guarantees complete protection is running all bots with `OnlineStatus` of `0` (Offline). In this setup ASF is able to ignore even the specifically-crafted message without attempting to interpret it.


A local privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local low-privileged user to cause the Juniper DHCP daemon (jdhcpd) process to crash resulting in a Denial of Service (DoS) or execute arbitrary commands as root. Continued processing of malicious input will repeatedly crash the system and sustain the Denial of Service (DoS) condition. Systems are only vulnerable if jdhcpd is running which can be confirmed via the 'show system processes' command. For example: root@host# run show system processes extensive | match dhcp 26537 root -16 0 97568K 13692K RUN 0 0:01 3.71% jdhcpd This issue affects: Juniper Networks Junos OS: All versions including the following supported releases: 15.1 versions prior to 15.1R7-S10; 17.4 versions prior to 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7 19.2R3-S3; 19.3 versions prior to 19.3R2-S6 19.3R3-S3; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R2-S2 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S1 20.4R3; 21.1 versions prior to 21.1R1-S1 21.1R2. Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-S3-EVO; All versions of 21.1-EVO.


In mpg123 1.25.0 there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input will lead to a remote denial of service attack.


In LibSass 3.4.5 there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted input will lead to a remote denial of service attack.


In radare2 2.4.0 there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.


In radare2 2.4.0 there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.


In radare2 2.4.0 there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_classes.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted Mach-O file.


In radare2 2.5.0 there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. This issue is different from CVE-2017-15368.


In ImageMagick 7.0.8-13 Q16 there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c which allows attackers to cause a denial of service via a crafted SVG image file.


In ImageMagick 7.0.8-13 Q16 there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c which allows attackers to cause a denial of service via a crafted SVG image file.


JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image related to the jp2_decode function in libjasper/jp2/jp2_dec.c.


LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image related to \READ of size 8\ and libtiff/tif_read.c:523:22.


Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file.


Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CAB archive.


Off-by-one error in the Libsystem strnstr API in libc on Apple Mac OS X 10.4.11 allows context-dependent attackers to cause a denial of service (crash) via crafted arguments that trigger a buffer over-read.


An issue was discovered in libgpac.a in GPAC before 0.8.0 as demonstrated by MP4Box. It contains a heap-based buffer over-read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.


An issue was discovered in libgpac.a in GPAC before 0.8.0 as demonstrated by MP4Box. It contains a heap-based buffer over-read in BS_ReadByte (called from gf_bs_read_bit) in utils/bitstream.c that can cause a denial of service via a crafted MP4 file.


In elfutils 0.175 a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.


In Poppler 0.73.0 a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document as demonstrated by pdftocairo.


In Xpdf 4.01.01 a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples. It can for example be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak or possibly have unspecified other impact.


In Xpdf 4.01.01 a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can for example be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak or possibly have unspecified other impact.


A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can for example be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.


In radare2 through 3.5.1 there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c.


In Xpdf 4.01.01 a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can for example be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak or possibly have unspecified other impact.


A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions. It can for example be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data.


Improper

input

validation

while

processing

SIP

URI

received

from

the

network

will

lead

to

buffer

over-read

and

then

to

denial

of

service

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell

Saipan


A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service (application outage).


Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file.


An issue was discovered in Bento4 1.5.1-628. A heap-based buffer over-read exists in AP4_BitStream::ReadBytes() in Codecs/Ap4BitStream.cpp a similar issue to CVE-2017-14645. It can be triggered by sending a crafted file to the aac2mp4 binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.


Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1 4.0.2 and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list which triggers a heap-based buffer over-read.


The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17 when running in verbose mode allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr a different vulnerability than CVE-2013-0179.


The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame contains any data outside of the header which might allow attackers to cause a denial of service (buffer over-read) via a crafted header.


Multiple

off-by-one

errors

in

Nagios

Core

and

earlier

and

Icinga

before

before

and

before

allow

remote

authenticated

users

to

obtain

sensitive

information

from

process

memory

or

cause

a

denial

of

service

(crash)

via

a

long

string

in

the

last

key

value

in

the

variable

list

to

the

function

in

avail.c

cmd.c

config.c

extinfo.c

histogram.c

notifications.c

outages.c

status.c

statusmap.c

summary.c

and

trends.c

in

cgi/

which

triggers

a

heap-based

buffer

over-read.


The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.


The Control and Provisioning of Wireless Access Points (CAPWAP) protocol implementation on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service via a crafted CAPWAP packet that triggers a buffer over-read aka Bug ID CSCuh81880.


libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field which triggers a buffer over-read.


The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17 when running in verbose mode allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.


The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.


The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.


A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash resulting in a denial of service condition.


The fs_data_put_str function in ntfs.c in fls in Brian Carrier The Sleuth Kit (TSK) before 2.09 does not validate a certain length value which allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain NTFS files via a malformed NTFS image which triggers a buffer over-read.


Dibbler 0.6.0 does not verify that certain length parameters are appropriate for buffer sizes which allows remote attackers to trigger a buffer over-read and cause a denial of service (daemon crash) as demonstrated by incorrect behavior of the TSrvMsg constructor in SrvMessages/SrvMsg.cpp when (1) reading the option code and option length and (2) parsing options.


The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+ 9.2.0.8 9.2.0.8DV 10.1.0.5 and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size which triggers a buffer over-read aka DB22.


The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0 when using a threaded MPM allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.


The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image related to fs/udf/inode.c and fs/udf/symlink.c.


The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier as used in PHP before 5.5.21 and 5.6.x before 5.6.5 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.


The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.


Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player T27 LD before SP32 EP16 T28 before T28.12 and T29 before T29.2 allow remote attackers to cause a denial of service (application crash) via a crafted (1) .wrf or (2) .arf file that triggers a buffer over-read aka Bug ID CSCuh52768.


PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys which triggers a buffer over-read.


The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.


Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x when the maximum number of physical CPUs are in use allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall which triggers a buffer over-read.


MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.


The (1) get_quoted_string and (2) get_unquoted_string functions in epan/dissectors/packet-cups.c in the CUPS dissector in Wireshark 1.12.x before 1.12.1 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a CUPS packet that lacks a trailing '\\0' character.


Integer underflow in Armed Assault (aka ArmA) 1.14 and earlier and 1.16 beta and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) via a VoIP over Network (VON) packet to port 2305 with a negative packet_size value which triggers a buffer over-read.


The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1 as used in Python PyXML w3c-libwww and other software allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read a different vulnerability than CVE-2009-2625.


The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1 as used in the XML-Twig module for Perl allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read related to the doProlog function in lib/xmlparse.c a different vulnerability than CVE-2009-2625 and CVE-2009-3720.


The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.


The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data which is improperly demarshalled and triggers a buffer over-read a related issue to CVE-2010-0407.


The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.


The

gig::DimensionRegion::CreateVelocityTable

function

in

gig.cpp

in

libgig

allows

remote

attackers

to

cause

a

denial

of

service

(stack-based

buffer

over-read

and

application

crash)

via

a

crafted

gig

file.


The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file.


In ImageMagick 7.0.6-6 and GraphicsMagick 1.3.26 a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c which allows attackers to cause a denial of service via a crafted file.


The Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 does not validate the PLT section size which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.


The put_chars function in html_r.c in Twibright Links 2.14 allows remote attackers to cause a denial of service (buffer over-read) via a crafted HTML file.


tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function called from the stp_print function for the Spanning Tree Protocol.


The shoco_decompress function in the API in shoco through 2017-07-17 allows remote attackers to cause a denial of service (buffer over-read and application crash) via malformed compressed data.


The resample_gauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a setuid-root installation.


The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha as used in ClamAV 0.99.2 and other products allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.


The GetImageDepth function in MagickCore/attribute.c in ImageMagick 7.0.6-4 might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted Flexible Image Transport System (FITS) file.


The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the \block_type != 2\ case a similar issue to CVE-2017-9870.


The ExifImageFile::readDHT function in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted jpg file.


The ExifImageFile::readDQT function in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted jpg file.


An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows \DHCP - Buffer over-read in fr_dhcp_decode_suboptions()\ and a denial of service.


An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows \DHCP - Buffer over-read in fr_dhcp_decode_options()\ and a denial of service.


The mng_get_long function in coders/png.c in ImageMagick 7.0.6-0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted MNG image.


The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 mishandles HintName vector entries which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file related to the bfd_getl16 function.


ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file as demonstrated by an ofxdump call.


WP1StylesListener.cpp WP5StylesListener.cpp and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.


The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file.


The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file.


libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.


In MongoDB libbson 1.7.0 the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c) as demonstrated by bson-to-json.c.


The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file.


ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted JPEG file.


decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 mishandles a length calculation which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file related to read_1_byte.


ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


The restore_tqb_pixels function in hevc_filter.c in libavcodec as used in libbpg 0.9.7 and other products miscalculates a memcpy destination address which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact.


JasPer

allows

remote

attackers

to

cause

a

denial

of

service

(heap-based

buffer

over-read

and

application

crash)

via

a

crafted

image

related

to

the

function

in


The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary index is encountered which allows an attacker to launch a denial of service attack.


The decode_residual function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.


The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.


The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.


The read_u32_leb128 function in libr/util/uleb128.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.


The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


The bm_readbody_bmp function in bitmap_io.c in Potrace 1.14 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8698.


The

PoDoFo::PdfSimpleEncoding::ConvertToEncoding

function

in

PdfEncoding.cpp

in

PoDoFo

allows

remote

attackers

to

cause

a

denial

of

service

(heap-based

buffer

over-read

and

application

crash)

via

a

crafted

PDF

document.


The read_next_pam_token function in imagew-pnm.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted file.


The iwmiffr_convert_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.


The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.


The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.


The ff_h2645_extract_rbsp function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read) or obtain sensitive information from process memory via a crafted h264 video file.


The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.


The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout which allows local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission.


dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 mishandles pointers which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file related to parse_die and parse_line_table as demonstrated by a parse_die heap-based buffer over-read.


The wasm_dis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect r_hex_bin2str call.


bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file related to bfd_getl32.


nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file.


elf.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 does not validate sizes of core notes which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file related to elfcore_grok_netbsd_procinfo elfcore_grok_openbsd_procinfo and elfcore_grok_nto_status.


The png_load function in lib/png.c in SWFTools 0.9.2 does not properly validate a multiplication of width and bits-per-pixel values which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file as demonstrated by an erroneous png_load call that occurs because of incorrect integer data types in png2swf.


The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\\0' character in an xattr name which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.


The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.


The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.


print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file.


The pcm_encode_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted media file.


The mpc8_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted audio file.


The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image related to imagew-jpeg.c.


The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.


The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file as demonstrated by mishandling within the nm program.


GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file related to MIPS GOT mishandling in the process_mips_specific function in readelf.c.


The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.


The TDStretchSSE::calcCrossCorr function in source/SoundTouch/sse_optimized.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted wav file.


The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.


The bdecode function in bdecode.cpp in libtorrent 1.1.3 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image related to imagew-jpeg.c.


The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file in which a certain size field is larger than a corresponding data field as demonstrated by mishandling within the objdump program.


The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.


The III_i_stereo function in layer3.c in mpglib as used in libmpgdecoder.a in LAME 3.99.5 and other products allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the \block_type == 2\ case a similar issue to CVE-2017-11126.


The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a crafted mp3 file.


The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file related to the byte_get_little_endian function in elfcomm.c the get_unwind_section_word function in readelf.c and ARM unwind information that contains invalid word offsets.


The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted PDF document related to missing color-map validation in ImageOutputDev.cc.


The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.


The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document related to the xps_encode_font_char_imp function.


The II_step_one function in layer2.c in mpglib as used in libmpgdecoder.a in LAME 3.99.5 and other products allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.


The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.


The

PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry

function

in

in

PoDoFo

allows

remote

attackers

to

cause

a

denial

of

service

(heap-based

buffer

over-read)

or

possibly

have

unspecified

other

impact

via

a

crafted

PDF

file.


The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.


The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.


The lut_inverse_interp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service (buffer over-read and application crash) via crafted attributes in the ICC 4 profile of an image.


The chmd_read_headers function in chmd.c in libmspack before 0.5 does not validate name lengths which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.


Skia as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing related to gpu/GrBitmapTextContext.cpp and gpu/GrDistanceFieldTextContext.cpp a different vulnerability than CVE-2015-1205.


The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM) which allows remote attackers to cause a denial of service (integer underflow buffer over-read and mediaserver process crash) via crafted 3GPP metadata aka internal bug 20923261 a related issue to CVE-2015-3828.


ext/phar/phar.c in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive related to the phar_parse_metadata and phar_parse_pharfile functions.


The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.


hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data a different vulnerability than CVE-2016-2052.


dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \<!DOCTYPE html\ substring in a crafted HTML document.


app/aboot/aboot.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to cause a denial of service (OS outage or buffer over-read) via a crafted application aka Android internal bug 28822690 and Qualcomm internal bug CR822275.


The xmlNextChar function in libxml2 2.9.2 does not properly check the state which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.


The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4 3.98.2 3.98 3.99 3.99.1 3.99.2 3.99.3 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.


The Remote Data Service Object (RDS.DataControl) in Microsoft Internet Explorer 6 on Windows 2000 allows remote attackers to cause a denial of service (crash) via a series of operations that result in an invalid length calculation when using SysAllocStringLen then triggers a buffer over-read.


The decode_stringmap function in server_transport.cpp for UFO2000 svn 1057 allows remote attackers to cause a denial of service (daemon termination) via a keysize or valsize that is inconsistent with the packet size which leads to a buffer over-read.


The raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application crash) via a large ID which causes an invalid memory access (buffer over-read).


The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot 2 and earlier allow remote attackers to cause a denial of service (application crash) via packets with incorrect message sizes which triggers a buffer over-read.


Multiple unspecified vulnerabilities in DeleGate 9.x before 9.0.6 and 8.x before 8.11.6 allow remote attackers to cause a denial of service via crafted DNS responses messages that cause (1) a buffer over-read or (2) infinite recursion which can trigger a segmentation fault or invalid memory access as demonstrated by the OUSPG PROTOS DNS test suite.


Mozilla Firefox before 1.5.0.7 Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) via a malformed JavaScript regular expression that ends with a backslash in an unterminated character set (\\\\\\) which leads to a buffer over-read.


Integer underflow in OpenSSL before 0.9.8x 1.0.0 before 1.0.0j and 1.0.1 before 1.0.1c when TLS 1.1 TLS 1.2 or DTLS is used with CBC encryption allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation.


The default configuration for MongoDB before 2.3.2 does not validate objects which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command which triggers a buffer over-read.


khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via large canvas dimensions which leads to an unexpected sign extension and a heap-based buffer over-read.


The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service (crash) via a crafted GFN that triggers a buffer over-read.


An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.


opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data as demonstrated by rasm2.


In Exiv2 0.26 and previous versions PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.


An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.


getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data as demonstrated by rasm2.


audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file as demonstrated by pbmmask.


The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file as demonstrated by pdftohtml.


The JPXStream::inverseTransformLevel function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file as demonstrated by pdftohtml.


The JPXStream::fillReadBuf function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file as demonstrated by pdftohtml.


The JBIG2Stream::readGenericBitmap function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file as demonstrated by pdftohtml.


The JPXStream::close function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file as demonstrated by pdftohtml.


The JBIG2MMRDecoder::getBlackCode function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (buffer over-read and application crash) via a specific pdf file as demonstrated by pdftohtml.


The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file as demonstrated by pdftohtml.


In radare2 prior to 3.1.1 the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file a related issue to CVE-2018-20455.


In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.


The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.


The process_file function in reader.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.


The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file as demonstrated by pdftoppm.


A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.31 because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service as demonstrated by ld.


CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file as demonstrated by pdftoppm.


The GfxImageColorMap class in GfxState.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file as demonstrated by pdftoppm.


The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.


get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packets as demonstrated by tcpprep.


In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24 there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file.


The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file as demonstrated by mkd2html.


The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file as demonstrated by mkd2html.


The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file as demonstrated by mkd2html.


Netwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Remote attackers could leverage this vulnerability to cause a denial of service or possibly have unspecified other impact via a crafted ELF file.


There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack.


process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file as demonstrated by readelf.


In radare2 2.5.0 there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p/anal_dalvik.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. Note that this issue is different from CVE-2018-8809 which was patched earlier.


curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.


The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new.


get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.


The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Mini Crash Dump file.


SIMDComp before 0.1.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it can read (and then discard) extra bytes. NOTE: this issue exists because of an incomplete fix for CVE-2018-17427.


The function mp4v2::impl::MP4Track::FinishSdtp() in mp4track.cpp in libmp4v2 2.1.0 mishandles compatibleBrand while processing a crafted mp4 file which leads to a heap-based buffer over-read causing denial of service.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump.


An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer over-read was triggered in the function dlt_en10mb_encode() of the file plugins/dlt_en10mb/en10mb.c due to inappropriate values in the function memmove(). The length (pktlen + ctx -> l2len) can be larger than source value (packet + ctx->l2len) because the function fails to ensure the length of a packet is valid. This leads to Denial of Service.


SIMDComp before 0.1.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it can read (and then discard) extra bytes.


The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not validate the child_frame_length data obtained from a .webm file which allows remote attackers to cause an information leak or a denial of service (heap-based buffer over-read and later out-of-bounds write) or possibly have unspecified other impact.


In

WAVM

through

a

crafted

file

sent

to

the

WebAssembly

Virtual

Machine

may

cause

a

denial

of

service

(application

crash)

or

possibly

have

unspecified

other

impact

because

of

an

IR::FunctionValidationContext::catch_all

heap-based

buffer

over-read.


Exiv2::Internal::PngChunk::parseTXTChunk

in

allows

remote

attackers

to

cause

a

denial

of

service

(heap-based

buffer

over-read)

via

a

crafted

image

file

a

different

vulnerability

than


dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.


SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file as demonstrated by pdftoppm.


The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function _rt_md5_hmac_veneer() or _rt_hmac_sha1_veneer() resulting in a stack buffer over-read which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK.


IBM Sterling Connect Direct for Microsoft Windows 4.7 4.8 6.0 and 6.1 could allow a remote attacker to cause a denial of service caused by a buffer over-read. Bysending a specially crafted request the attacker could cause the application to crash. IBM X-Force ID: 188906.


An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function H5O__layout_decode() located in H5Olayout.c. It allows an attacker to cause Denial of Service.


A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module authenc. When a payload longer than 4 bytes and is not following 4-byte alignment boundary guidelines it causes a buffer over-read threat leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.


Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.


libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the \malformed dwarf file\ approach related to a \Heap Buffer Over-read\ issue affecting the dwarf_util.c component aka DW201611-006.


The _iprintf function in outputtxt.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of service (buffer over-read) via a crafted SWF file.


in

the

Catapult

dissector

in

Wireshark

before

does

not

restrict

the

number

of

channels

which

allows

remote

attackers

to

cause

a

denial

of

service

(buffer

over-read

and

application

crash)

via

a

crafted

packet.


The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) via a crafted file.


The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.


LibTIFF 4.0.0alpha4 4.0.0alpha5 4.0.0alpha6 4.0.0beta7 4.0.0 4.0.1 4.0.2 4.0.3 4.0.4 4.0.4beta 4.0.5 4.0.6 and 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image related to \READ of size 512\ and libtiff/tif_unix.c:340:2.


The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.


The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.


The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.


The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.


epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers an empty set.


epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.2 mishandles the Grouping subfield which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.


Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers a 0xff tag value.


The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


The xmlDictAddString function in libxml2 before 2.9.4 as used in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4 as used in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


The htmlCurrentChar function in libxml2 before 2.9.4 as used in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.


CachedCmap.cpp in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


The

function

in

Graphite

before

as

used

in

Mozilla

Firefox

before

and

Firefox

ESR

before

allows

remote

attackers

to

cause

a

denial

of

service

(buffer

over-read)

or

possibly

have

unspecified

other

impact

via

a

crafted

Graphite

smart

font

a

different

vulnerability

than


The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font a different vulnerability than CVE-2016-2792.


The

function

in

TtfUtil.cpp

in

Graphite

before

as

used

in

Mozilla

Firefox

before

and

Firefox

ESR

before

allows

remote

attackers

to

cause

a

denial

of

service

(buffer

over-read)

or

possibly

have

unspecified

other

impact

via

a

crafted

Graphite

smart

font

a

different

vulnerability

than


The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.


in

the

MSM

audio

driver

for

the

Linux

kernel

as

used

in

Qualcomm

Innovation

Center

(QuIC)

Android

contributions

for

MSM

devices

and

other

products

allows

attackers

to

cause

a

denial

of

service

(buffer

over-read)

or

possibly

have

unspecified

other

impact

via

a

crafted

application

that

makes

an

ioctl

call

specifying

many

commands.


The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font a different vulnerability than CVE-2016-2800.


The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


The

function

in

Graphite

before

as

used

in

Mozilla

Firefox

before

and

Firefox

ESR

before

allows

remote

attackers

to

cause

a

denial

of

service

(buffer

over-read)

or

possibly

have

unspecified

other

impact

via

a

crafted

Graphite

smart

font.


The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.


Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6 as used in Google Chrome before 48.0.2564.82 allow attackers to cause a denial of service or possibly have other impact via crafted data as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc a different issue than CVE-2015-8947.


The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier when the \-c lzw\ option is used allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.


The decoder_peek_si_internal function in vp9/vp9_dx_iface.c in libvpx in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows remote attackers to cause a denial of service (buffer over-read and device hang or reboot) via a crafted media file aka internal bug 30013856.


The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier when the \-c none\ option is used allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.


The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier when the \-c zip\ option is used allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.


libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length which triggers a buffer over-read.


Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome 0.2.149.27 allows remote attackers to cause a denial of service (browser crash) via a URI with an invalid handler followed by a \%\ (percent) character which triggers a buffer over-read as demonstrated using an \about:%\ URI.


The fragment_add_work function in epan/reassemble.c in Wireshark 0.8.19 through 1.0.1 allows remote attackers to cause a denial of service (crash) via a series of fragmented packets with non-sequential fragmentation offset values which lead to a buffer over-read.


src/sdp.c in bluez-libs 3.30 in BlueZ and other bluez-libs before 3.34 and bluez-utils before 3.34 versions does not validate string length fields in SDP packets which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.


yaSSL 1.7.5 and earlier as used in MySQL and possibly other products allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp.


The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated which triggers a buffer over-read.