Missing authentication and improper input validation in KERUI Wifi Endoscope Camera (YPC99) allow an attacker to execute arbitrary commands (with a length limit of 19 characters) via the \ssid\ value as demonstrated by ssid:;ping 192.168.1.2 in the body of a SETSSID command.


conf_datetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field (obtained from the web interface).


Telnet proxy in Avirt Gateway Suite 4.2 does not require authentication for connecting to the proxy system itself which allows remote attackers to list file contents of the proxy and execute arbitrary commands via a \dos\ command.


A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated remote attacker to execute arbitrary commands on the affected system. The vulnerability is due to improper validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrative privileges and supplying crafted requests to the application. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges on a targeted node.

arbitrary command execution
improper user input validation


IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function . A remote attacker could inject arbitrary shell commands which would be executed on the affected system. IBM X-Force ID: 214958.


A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall Cisco RV130W Wireless-N Multifunction VPN Router and Cisco RV215W Wireless-N VPN Router could allow an authenticated remote attacker to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input to scripts by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the root user.


IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user caused by improper validation of user-supplied input. IBM X-Force ID: 174966.


Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100 300 and 500 Series Wireless Access Points could allow an authenticated remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper validation of user-supplied input. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit these vulnerabilities the attacker must have valid administrative credentials for the device.

arbitrary command execution
improper user input validation
command injection


Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary commands via inbound QuickConnect traffic.

arbitrary command execution
man in the middle


Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the server using a modified distribution definition file with the \allow-external-scripts\ option.


The Sidebar gadget in ITN News Gadget (aka ITN Hub Gadget) 1.06 for Windows Vista and possibly other versions before 1.23 allows remote web servers or man-in-the-middle attackers to execute arbitrary commands via script in a short_title response.


Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2 as used in Ubuntu Enterprise Cloud (UEC) and other products do not properly interpret signed elements in SOAP requests which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request related to an \XML Signature Element Wrapping\ or a \SOAP signature replay\ issue.


Dell

Command

Update

versions

prior

to

contain

an

Arbitrary

File

Deletion

Vulnerability.

A

local

authenticated

malicious

user

with

low

privileges

potentially

could

exploit

this

vulnerability

to

delete

arbitrary

files

by

creating

a

symlink

from

the

\Temp\\ICProgress\\Dell_InventoryCollector_Progress.xml\

to

any

targeted

file.

This

issue

occurs

because

permissions

on

the

Temp

directory

were

set

incorrectly.


An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19 Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature.


An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with export data transfer privileges can craft a request to perform arbitrary file deletion.


Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.


An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges.


An arbitrary file deletion vulnerability exists within Maccms10.


An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.

arbitrary file deletion
denial of service
dos


An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.


An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co. Ltd. BossCMS 1.0 which can be exploited by an attacker to gain control of the server.


Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0


Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2


Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta


An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.


An Arbitrary File Upload vulnerability was discovered in the Golo Laravel theme v 1.1.5.


An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes to \.php\.


An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.


An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file.


An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this an attacker must have a valid authenticated (admin/manager) session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php.


An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess .php4 .php5 and .phtl extensions.


An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.

arbitrary file upload
arbitrary code execution


An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.


An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file.


An arbitrary file upload vulnerability in the file upload module of Connect-Multiparty v2.2.0 allows attackers to execute arbitrary code via a crafted PDF file.


An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename.


An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename.


An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file.


An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file.


An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.


An arbitrary file upload vulnerability in the file upload module of Express-Fileupload v1.3.1 allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.


An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.


An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.


An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file which is later changed to a PHP file.


An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.


An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.


An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file.


An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file.


An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTML file.


An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code.


An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.


An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.


An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.


An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.

arbitrary file upload
arbitrary command execution


An arbitrary file upload in the <input type=\file\ name=\user_image\> component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary commands.


An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands.


An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to the Tomcat server via Path Traversal allowing remote code execution with SYSTEM privileges.

arbitrary file upload
remote code execution


An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.


An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution.


An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution.


An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page.


Jenkins Speaks! Plugin all current versions allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM effectively elevating privileges to Overall/Run Scripts.


In ICEcoder 8.0 allows a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET'replace' variable. As a result arbitrary Javascript code can get executed.


The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings.


In ImageMagick 7.0.5-7 Q16 a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.


Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated malicous actor to force the change of the admin password due to a hidden administrative command.


Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local unauthenticated attacker to modify the Wi-Fi network the base station connects to.


Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local unauthenticated attacker to pair a rogue keypad to an armed system.


An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagnostic Tools component is vulnerable to Remote Command Execution allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials.


Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface.


cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).


Certain

NETGEAR

devices

are

affected

by

authentication

bypass.

This

affects

before

before

before

before

before

before

before

and

before


cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).


InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).


An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FW_remote.htm&todo=cfg_init request without a cookie reads the Set-Cookie header in the 401 Unauthorized response and then repeats the FW_remote.htm&todo=cfg_init request with the specified cookie.


Certain

NETGEAR

devices

are

affected

by

authentication

bypass.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


NETGEAR R9000 devices before 1.0.4.26 are affected by authentication bypass.


NETGEAR RAX40 devices before 1.0.3.64 are affected by authentication bypass.


cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).


Linear eMerge 50P/5000P devices allow Authentication Bypass.


D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.


Authentication bypass vulnerability in the the web interface in Hunt CCTV Capture CCTV Hachi CCTV NoVus CCTV and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.


Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05 2019.11 2020.05 and 2020.10. The vulnerability could allow remote attackers to bypass user authentication and get unauthorized access.


CAPTCHA bypass vulnerability in MantisBT before 1.2.19.


Authentication bypass vulnerability in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allows attackers to access a specific part of the console using a blank password.


Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability.


Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool.


HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer when configured with the AWS IAM auth method may be vulnerable to authentication bypass. Fixed in 1.2.5 1.3.8 1.4.4 and 1.5.1..


HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer when configured with the GCP GCE auth method may be vulnerable to authentication bypass. Fixed in 1.2.5 1.3.8 1.4.4 and 1.5.1.


An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.


An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf which lets a remote malicious user obtain sensitive information.


An Authentication Bypass vulnerability exists in Gitea before 1.5.0 which could let a malicious user gain privileges. If captured the TOTP code for the 2FA can be submitted correctly more than once.


An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges.


An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to unauthorized access. An attacker can send an HTTP request to trigger this vulnerability.


An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04 which could let a malicious user obtain elevated privileges.


An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.


An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted DHCP packet can lead to authentication bypass. An attacker can DHCP poison to trigger this vulnerability.


An Authentication Bypass vulnerability in HPE MSA 1040 and MSA 2040 SAN Storage IN version GL220P008 and earlier was found.


An Authentication Bypass vulnerability in HPE MSA 1040 and HPE MSA 2040 SAN Storage in version GL220P008 and earlier and was found.


An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials from the HTML source code of the cgi-bin/index2.asp URI.


An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file.

authentication bypass vulnerability
arbitrary code execution


An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.

authentication bypass vulnerability
arbitrary command execution


An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using \Javascript debugging.\

authentication bypass vulnerability
bypass authentication


An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege.

authentication bypass vulnerability
escalated privilege


An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges.

authentication bypass vulnerability
man in the middle


Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.

authentication bypass
weak authentication management
information disclosure


In all Qualcomm products with Android releases from CAF using the Linux kernel when an access point sends a challenge text greater than 128 bytes the host driver is unable to validate this potentially leading to authentication failure.


A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that may occur when certain sequences of actions are processed during an SSH login event on the affected device. An attacker could exploit this vulnerability by initiating an SSH session to the device with a specific sequence that presents the two usernames. A successful exploit could result in logging data misrepresentation user enumeration or in certain circumstances a command authorization bypass. See the Details section for more information.


In cPanel before 67.9999.103 a user account's backup archive could contain all MySQL databases on the server (SEC-284).


In Wireshark 3.0.0 to 3.0.2 2.6.0 to 2.6.9 and 2.4.0 to 2.4.15 the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c by properly restricting buffer increments.


The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password which allows remote attackers to obtain administrative privileges by leveraging a LAN session.


The web interface for SOHO Routefinder 550 firmware 4.63 and earlier and possibly later versions has a default \admin\ account with a blank password which could allow attackers on the LAN side to conduct unauthorized activities.


Aspire-derived NEC PBXes including the SV8100 SV9100 SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid successfully authenticating account.


In Wireshark 2.6.0 to 2.6.2 2.4.0 to 2.4.8 and 2.2.0 to 2.2.16 the Bluetooth AVDTP dissector could crash. This was addressed in epan/dissectors/packet-btavdtp.c by properly initializing a data structure.


Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition such users can be granted several admin permissions via the Roles parameter.)


Adobe Acrobat and Reader 2018.011.20040 and earlier 2017.011.30080 and earlier and 2015.006.30418 and earlier versions have a Buffer Errors vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


Adobe Acrobat and Reader versions 2018.011.20063 and earlier 2017.011.30102 and earlier and 2015.006.30452 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2020.006.20042 and earlier 2017.011.30166 and earlier 2017.011.30166 and earlier and 2015.006.30518 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2020.009.20074 and earlier 2020.001.30002 2017.011.30171 and earlier and 2015.006.30523 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.021.20061 and earlier 2017.011.30156 and earlier 2017.011.30156 and earlier and 2015.006.30508 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .


In all Qualcomm products with Android releases from CAF using the Linux kernel validation of a buffer length was missing in a PlayReady DRM routine.


In Xpdf 4.01.01 a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second privateDicts array element because the privateDicts array has only one element allocated.


In OpenCV 3.3.1 a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.


In tcpdump 4.9.2 a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.


In libsamplerate before 0.1.9 a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.


In FreeType before 2.6.1 a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.


In sam2p 0.49.3 a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.


In tcpdump before 4.9.0 a bug in multiple protocol parsers (Geneve GRE NSH OTV VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print().


In Irssi before 1.0.6 a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.


In SwiftNIO before 1.8.0 a buffer overflow was addressed with improved size validation.


In Tinyftp Tinyftpd 1.1 a buffer overflow exists in the text variable of the do_mkd function in the ftpproto.c file. An attacker can overwrite ebp via a long pathname.


In tnef before 1.4.18 an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment because of a heap-based buffer over-read involving strdup.


In Wireshark 2.4.0 2.2.0 to 2.2.8 and 2.0.0 to 2.0.14 the IrCOMM dissector has a buffer over-read and application crash. This was addressed in plugins/irda/packet-ircomm.c by adding length validation.


Oniguruma through 6.9.3 as used in PHP 7.3.x and other products has a heap-based buffer over-read in str_lower_case_match in regexec.c.


libebml before 1.3.6 as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3 has a heap-based buffer over-read in EbmlElement::FindNextElement.


In elfutils 0.175 there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file as demonstrated by eu-readelf.


In LibTIFF 4.0.9 there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.


In ImageMagick 7.0.8-43 Q16 there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c related to Magick_png_write_raw_profile and LocaleNCompare.


In Poppler through 0.76.1 there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.


In GoHttp through 2017-07-25 there is a stack-based buffer over-read via a long User-Agent header.


In wolfSSL through 4.1.0 there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically there is a one-byte heap-based buffer over-read in CheckCertSignature_ex in wolfcrypt/src/asn.c.


In GraphicsMagick 1.3.27a there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c related to oFFs chunk allocation.


In GraphicsMagick 1.3.27a there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.


In ImageMagick 7.0.7-24 Q16 there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.


In ImageMagick 7.0.7-17 Q16 there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function related to the sixel_decode function.


In ImageMagick 7.0.8-43 Q16 there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.


In GNU Chess 6.2.5 there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file.


In unixODBC before 2.3.5 there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.


In RELIC before 2021-04-03 there is a buffer overflow in PKCS#1 v1.5 signature verification because garbage bytes can be present.


In Pillow before 7.1.0 there are two Buffer Overflows in libImaging/TiffDecode.c.


njs through 0.3.3 used in NGINX has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-12207 is in place.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:538:33.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:18:11.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the pnm_load_raw function in input-pnm.c:346:41.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:17:11.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:559:29.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:16:11.


libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27.


Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.


Ming (aka libming) 0.4.8 has a heap-based buffer over-read (2 bytes) in the function decompileIF() in decompile.c.


Ming (aka libming) 0.4.8 has a heap-based buffer over-read (8 bytes) in the function decompileIF() in decompile.c.


In all Android releases from CAF using the Linux kernel a buffer overread can occur if a particular string is not NULL terminated.


In all Android releases from CAF using the Linux kernel a kernel driver has an off-by-one buffer over-read vulnerability.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel a buffer over-read can occur In the WMA NDP event handler functions due to lack of validation of input value event_info which is received from FW.


In all Qualcomm products with Android releases from CAF using the Linux kernel while processing a vendor sub-command a buffer over-read can occur.


In all Qualcomm products with Android releases from CAF using the Linux kernel the camera application can possibly request frame/command buffer processing with invalid values leading to the driver performing a heap buffer over-read.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer over-read vulnerability exists in RFA-1x.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer over-read vulnerability exists in digital television/digital radio DRM.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer over-read vulnerability exists in a TrustZone syscall.


In all Qualcomm products with Android releases from CAF using the Linux kernel a buffer over-read may occur in the processing of a downlink 3G NAS message.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 410/12 SD 615/16/SD 415 SD 808 and SD 810 in a PlayReady API function a buffer over-read can occur.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 835 SD 845 and SD 850 vendor specific opcodes may not have any packet length validation leading to buffer over-reads.


In

Android

for

MSM

Firefox

OS

for

MSM

QRD

Android

with

all

Android

releases

from

CAF

using

the

Linux

kernel

while

processing

a

specially

crafted

vendor

command

a

buffer

over-read

can

occur.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing a specially crafted cfg80211 vendor command a buffer over-read can occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing cfg80211 vendor sub command QCA_NL80211_VENDOR_SUBCMD_ROAM a buffer over-read can occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing a specially crafted cfg80211 vendor command a buffer over-read can occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_NDP cfg80211 vendor command a buffer over-read can occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing the SENDACTIONFRAME IOCTL a buffer over-read can occur if the payload length is less than 7.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing a vendor command a buffer over-read can occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel if userspace provides a too-large IE length in wlan_hdd_cfg80211_set_ie a buffer over-read occurs.


Netwide Assembler (NASM) 2.14rc15 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for insufficient input.


Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the special cases of the % and $ and ! characters.


Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in x86/regflags.c.


The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print().


The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_multicast_vpn().


The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_rt_routing_info().


The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).


The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).


The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).


In BlueZ 5.42 a buffer over-read was observed in \l2cap_dump\ function in \tools/parser/l2cap.c\ source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.


In BlueZ 5.42 a buffer over-read was identified in \l2cap_packet\ function in \monitor/packet.c\ source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.


buffer

overread

can

happen

while

parsing

downlink

session

management

OTA

messages

if

network

sends

un-intended

values

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Buffer

over-read

can

occur

while

parsing

an

ogg

file

with

a

corrupted

comment

block.

in

Snapdragon

Auto

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print).


The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32 when processing invalid multi-byte input sequences in the EUC-KR encoding may have a buffer over-read.


RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.4 (in 4.0.x) and 4.1.4 (in 4.1.x) and RSA BSAFE Micro Edition Suite versions prior to 4.0.13 (in 4.0.x) and prior to 4.4 (in 4.1.x 4.2.x 4.3.x) are vulnerable to a Buffer Over-read vulnerability when processing DSA signature. A malicious remote user could potentially exploit this vulnerability to cause a crash in the library of the affected system.


An issue was discovered in libming 0.4.8. There is a heap-based buffer over-read in the function writePNG in the file util/dbl2png.c of the dbl2png command-line program. Because this is associated with an erroneous call to png_write_row in libpng an out-of-bounds write might occur for some memory layouts.


Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key negotiation which could crash the application or leak sensitive information.


In libsixel v1.8.2 there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c as demonstrated by img2sixel.


Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPubKeyLen during key negotiation which could crash the application or leak sensitive information.


libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled and \\X or \\R has more than one fixed quantifier a related issue to CVE-2019-20454.


An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in dwg_encode_entity in common_entity_data.spec.


GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF_SeekToSamples in GPMF_parse.c for the size calculation.


repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.


A stack-based buffer over-read was discovered in Mat_VarReadNextInfo5 in mat5.c in matio 1.5.17.


libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte if the encoding is set to ucs-2 or ucs-4 outside of the application as demonstrated by the ASPELL_CONF environment variable.


GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.


An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decode_R13_R2000 in decode.c.


A stack-based buffer over-read was discovered in ReadNextStructField in mat5.c in matio 1.5.17.


ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c.


An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode while parsing a crafted XML file performs incorrect memory handling leading to a heap-based buffer over-read while running strchr() starting with a pointer after a '\\0' character (where the processing of a string was finished).


An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in decode_R13_R2000 in decode.c a different vulnerability than CVE-2019-20011.


An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c.


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (Exynos chipsets) software. There is a buffer over-read and possible information leak in the core touch screen driver. The Samsung ID is SVE-2019-14942 (November 2019).


A stack-based buffer over-read was discovered in ReadNextCell in mat5.c in matio 1.5.17.


GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the \matching tags\ feature.


An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode while parsing crafted a XML file performs incorrect memory handling leading to a heap-based buffer over-read in the \normalize line endings\ feature.


A

heap-based

buffer

over-read

was

discovered

in

wasm::WasmBinaryBuilder::processFunctions()

in

wasm/wasm-binary.cpp

(when

calling

wasm::WasmBinaryBuilder::getFunctionIndexName)

in

Binaryen

A

crafted

input

can

cause

segmentation

faults

leading

to

denial-of-service

as

demonstrated

by

wasm-opt.


LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in ast_sel_weave.cpp.


libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c as demonstrated by a stack-based buffer over-read.


An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.


In GraphicsMagick 1.4 snapshot-20191208 Q8 there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c.


An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c.


An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.


stb_image.h (aka the stb image loader) 2.23 as used in libsixel and other products has a heap-based buffer over-read in stbi__load_main.


An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.


An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c.


An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.


njs through 0.3.3 used in NGINX has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling as demonstrated by an njs_regexp_literal call that leads to an njs_parser_lexer_error call and then an njs_parser_scope_error call.


lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.


In GPAC before 0.8.0 isomedia/isom_read.c in libgpac.a has a heap-based buffer over-read as demonstrated by a crash in gf_m2ts_sync in media_tools/mpegts.c.


block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.


mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.


In ImageMagick 7.0.8-50 Q16 ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.


GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\\0' character.


A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim an attacker can manipulate the control flow such that the condition to leave the loop is true. After leaving the loop the network packet has a length of 2 bytes. There is no validation of this length. Later on the code tries to read at an empty position leading to a crash.


An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.


Multiple

Buffer

Over-read

issue

can

happen

due

to

improper

length

checks

while

decoding

Service

Reject/RAU

Reject/PTMSI

Realloc

cmd

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell


Buffer over-read can occur in fast message handler due to improper input validation while processing a message from firmware in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in APQ8053 APQ8096AU MSM8996AU MSM8998 QCN7605 QCS405 QCS605 SDA660 SDM636 SDM660 SDX20 SDX24


Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in MDM9150 MDM9206 MDM9607 MDM9615 MDM9640 MDM9650 MSM8996AU QCA6174A QCA6574AU QCA9377 QCA9379 SD 210/SD 212/SD 205 SD 425 SD 427 SD 430 SD 435 SD 450 SD 600 SD 625 SD 712 / SD 710 / SD 670 SD 820 SD 820A SD 845 / SD 850 SDX20


Buffer

over-read

can

occur

while

playing

the

video

clip

which

is

not

standard

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


Buffer

Over-read

when

UE

is

trying

to

process

the

message

received

form

the

network

without

zero

termination

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in

Nicobar

Rennell


An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \\n character then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \\r results in an integer underflow.


An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.


tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer Return Address etc. on stack. The component is: line 234: \ND_PRINT((ndo \%s\ buf));\ in function named \print_prefix\ in \print-hncp.c\. The attack vector is: The victim must open a specially crafted pcap file.


dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.


In libexpat before 2.2.8 crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.


An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp.


wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex.


An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4AvccAtom.cpp.


GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.


memcached 1.5.16 when UNIX sockets are used has a stack-based buffer over-read in conn_to_str in memcached.c.


In DjVuLibre 3.5.27 DjVmDir.cpp in the DJVU reader component allows attackers to cause a denial-of-service (application crash in GStringRep::strdup in libdjvu/GString.cpp caused by a heap-based buffer over-read) by crafting a DJVU file.


GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.


WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file related to TIFFRewriteDirectory TIFFWriteDirectory TIFFWriteDirectorySec and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.


An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBits at Core/Ap4Utils.cpp.


Buffer Over-read when WLAN module gets a WMI message for SAR limits with invalid number of limits to be enforced in Snapdragon Compute Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wired Infrastructure and Networking in APQ8098 IPQ8074 MSM8998 QCA8081 QCN7605 QCS605 SDA660 SDA845 SDM630 SDM636 SDM660 SDM670 SDM710 SDM845 SDM850 SM8150 SXR1130


Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string.


An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a heap-based buffer over-read in libpng via a crafted flif file.


The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result a heap-based buffer over-read can be triggered via a crafted .ogg file.


Buffer

over-read

in

ADSP

parse

function

due

to

lack

of

check

for

availability

of

sufficient

data

payload

received

in

command

response

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in


Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wired Infrastructure and Networking in IPQ8074 MDM9206 MDM9207C MDM9607 QCN7605 SM8150


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read for the \Rank and Dimension\ feature in the function ReadNextCell() in mat5.c.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a buffer over-read in the function Mat_VarPrint() in mat.c.


An issue was discovered in GNU libiberty as distributed in GNU Binutils 2.32. It is a heap-based buffer over-read in d_expression_1 in cp-demangle.c after many recursive calls.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dxf_header_write at header_variables_dxf.spec.


An issue was discovered in PHP before 5.6.40 7.x before 7.1.26 7.2.x before 7.2.14 and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c ext/mbstring/oniguruma/regexec.c ext/mbstring/oniguruma/regparse.c ext/mbstring/oniguruma/enc/unicode.c and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.


In SQLite 3.27.2 running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.


In the GNU C Library (aka glibc or libc6) through 2.29 proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in the function InflateDimensions() in inflate.c when called from ReadNextCell in mat5.c.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in Mat_VarReadNextInfo5() in mat5.c.


An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dwg_dxf_LTYPE at dwg.spec.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read for a memcpy in the function ReadNextCell() in mat5.c.


An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in the function ReadNextStructField() in mat5.c.


An issue was discovered in PHP before 5.6.40 7.x before 7.1.26 7.2.x before 7.2.14 and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.


GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.


GNU Serveez through 0.2.2 has an Information Leak. An attacker may send an HTTP POST request to the /cgi-bin/reader URI. The attacker must include a Content-length header with a large positive value that when represented in 32 bit binary evaluates to a negative number. The problem exists in the http_cgi_write function under http-cgi.c; however exploitation might show svz_envblock_add in libserveez/passthrough.c as the location of the heap-based buffer over-read.


libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \\ character.


libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.


** DISPUTED ** libyal liblnk 20191006 has a heap-based buffer over-read in the network_share_name_offset>20 code block of liblnk_location_information_read_data in liblnk_location_information.c a different issue than CVE-2019-17264. NOTE: the vendor has disputed this as described in the GitHub issue.


Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\\0' character leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.


DISPUTED

In

libyal

libfwsi

before

libfwsi_extension_block_copy_from_byte_stream

in

has

a

heap-based

buffer

over-read

because

rejection

of

an

unsupported

size

only

considers

values

less

than

even

though

values

of

and

are

also

unsupported.

NOTE:

the

vendor

has

disputed

this

as

described

in

the

GitHub

issue.


An

issue

was

discovered

in

There

is

a

heap-based

buffer

over-read

in

in

when

called

from

in


Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest tSmbNtlmAuthChallenge and tSmbNtlmAuthResponse read and write operations as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.


** DISPUTED ** In libyal liblnk before 20191006 liblnk_location_information_read_data in liblnk_location_information.c has a heap-based buffer over-read because an incorrect variable name is used for a certain offset. NOTE: the vendor has disputed this as described in the GitHub issue.


An

issue

was

discovered

in

There

is

a

heap-based

buffer

over-read

in

in

when

called

from

in

when

called

from

in


do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read related to file_printable a different vulnerability than CVE-2018-10360.


do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read related to file_printf and file_vprintf.


Zint Barcode Generator before 2.10.0 has a one-byte buffer over-read related to is_last_single_ascii in code1.c and rs_encode_uint in reedsol.c.


An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.


jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.


Possible buffer overread due to lack of length check while flashing meta images in Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables


Possible buffer overread occurs due to lack of length check of request buffer in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music


Possible Buffer Over-read due to lack of validation of boundary checks when loading splash image in Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible buffer overread due to lack of data length check in QVR Service configuration in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Wearables


Possible buffer overread due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile


Croatia Control Asterix 2.8.1 has a heap-based buffer over-read with additional details to be disclosed at a later date.


NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Programming (ISP) mode. This discloses protected flash memory.


The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.


GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.


x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN the buffer lacks '\\0' termination.


Possible buffer overread due to improper buffer allocation for file length passed from user space in Snapdragon Auto Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of USB In-System Programming (ISP) mode. This discloses protected flash memory.


** DISPUTED ** Guidance Software EnCase allows user-assisted attackers to trigger a buffer over-read and application crash via a malformed NTFS filesystem containing a modified FILE record with a certain large offset. NOTE: the vendor disputes the significance of this issue asserting that relevant attackers typically do not corrupt a filesystem and indicating that the relevant read operation can be disabled.


Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.


The php_binary serialization handler in the session extension in PHP before 4.4.5 and 5.x before 5.2.1 allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value which triggers a buffer over-read.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

a

buffer

over-read

can

occur

in

a

DRM

API.


The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read as demonstrated by reading private keys related to d1_both.c and t1_lib.c aka the Heartbleed bug.


The Coda filesystem kernel module as used in NetBSD and FreeBSD when Coda is loaded and Venus is running with /coda mounted allows local users to read sensitive heap memory via a large out_size value in a ViceIoctl struct to a Coda ioctl which triggers a buffer over-read.


loaders/load_it.c in libmikmod possibly 3.1.12 does not properly account for the larger size of name##env relative to name##tick and name##node which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.


gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read as demonstrated by MP4Box.


Buffer Over-read in GitHub repository vim/vim prior to 8.2.


Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software Modify Memory and possible remote execution


Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.


Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically this can allow attackers to read sensitive information from other memory locations or cause a crash.


singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup call leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.


There is a buffer over-read in Ruby before 2.6.10 2.7.x before 2.7.6 3.x before 3.0.4 and 3.1.x before 3.1.2. It occurs in String-to-Float conversion including Kernel#Float and String#to_f.


tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c.


tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c.


A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.


tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse_mpls in common/get.c.


GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c resulting in a heap-based buffer over-read as demonstrated by MP4Box.


A remote unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.


path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.


The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1 Visual Studio 2005 SP1 and 2008 Gold and SP1 and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read related to ATL headers and buffer allocation aka \ATL Null String Vulnerability.\


Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring().


The EIGRP parser in tcpdump before 4.9.2 has a buffer over-read in print-eigrp.c:eigrp_print().


The RIPng parser in tcpdump before 4.9.2 has a buffer over-read in print-ripng.c:ripng_print().


The PIMv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c:pimv2_print().


The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().


The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply().


The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().


The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().


The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().


Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in util-print.c:tok2strbuf().


The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c several functions.


The IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print().


The IPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-ip6.c:ip6_print().


The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print().


The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c several functions.


The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.


The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().


The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.


The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().


The telnet parser in tcpdump before 4.9.2 has a buffer over-read in print-telnet.c:telnet_parse().


The

IS-IS

parser

in

tcpdump

before

has

a

buffer

over-read

in

print-isoclns.c:isis_print_extd_ip_reach().


The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().


The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().


The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep() several functions.


The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().


The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c several functions.


The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:l_strnstart().


The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_print().


The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_id().


The

Juniper

protocols

parser

in

tcpdump

before

has

a

buffer

over-read

in


The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().


The

PPP

parser

in

tcpdump

before

has

a

buffer

over-read

in


The

IEEE

parser

in

tcpdump

before

has

a

buffer

over-read

in

print-802_15_4.c:ieee802_15_4_if_print().


The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print().


The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:xid_map_enter().


The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print().


The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print().


The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfs_printfh().


The PIM parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c several functions.


The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().


The EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print().


The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print().


The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv6_print().


The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().


The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().


The

LLDP

parser

in

tcpdump

before

has

a

buffer

over-read

in


The OSPFv3 parser in tcpdump before 4.9.2 has a buffer over-read in print-ospf6.c:ospf6_decode_v3().


The Apple PKTAP parser in tcpdump before 4.9.2 has a buffer over-read in print-pktap.c:pktap_if_print().


The RPKI-Router parser in tcpdump before 4.9.2 has a buffer over-read in print-rpki-rtr.c:rpki_rtr_pdu_print().


The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print().


The LMP parser in tcpdump before 4.9.2 has a buffer over-read in print-lmp.c:lmp_print().


The RADIUS parser in tcpdump before 4.9.2 has a buffer over-read in print-radius.c:print_attr_string().


The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().


The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv4_print().


The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c several functions.


The DHCPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-dhcp6.c:dhcp6opt_print().


The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c several functions.


The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().


The ARP parser in tcpdump before 4.9.2 has a buffer over-read in print-arp.c several functions.


The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printroute().


The VQP parser in tcpdump before 4.9.2 has a buffer over-read in print-vqp.c:vqp_print().


The

LLDP

parser

in

tcpdump

before

has

a

buffer

over-read

in

print-lldp.c:lldp_mgmt_addr_tlv_print().


The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().


The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().


The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().


The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().


The

ISO

IS-IS

parser

in

tcpdump

before

has

a

buffer

over-read

in

print-isoclns.c:isis_print_is_reach_subtlv().


The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts().


The L2TP parser in tcpdump before 4.9.2 has a buffer over-read in print-l2tp.c several functions.


The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print().


The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c several functions.


The AODV parser in tcpdump before 4.9.2 has a buffer over-read in print-aodv.c:aodv_extension().


The Rx protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-rx.c:ubik_print().


The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().


The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().


In PHP before 5.6.30 and 7.x before 7.0.15 the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel buffer Over-read in Display due to the lack of an upper-bound validation when reading \num_of_cea_blocks\ from the untrusted source (EDID) kernel memory can be exposed.


In ImageMagick 7.0.6-0 a heap-based buffer over-read in the GetNextToken function in token.c allows remote attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document that is mishandled in the GetUserSpaceCoordinateValue function in coders/svg.c.


The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3 as used in GDAL and other products mishandles undersized RTree blobs in a crafted database leading to a heap-based buffer over-read or possibly unspecified other impact.


While flashing meta image a buffer over-read may potentially occur when the image size is smaller than the image header size or is smaller than the image header size + total image header entry in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


While flashing a meta image a buffer over-read can potentially occur when the number of images are out of the maximum range of 32 in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05.


The AP4_AvccAtom and AP4_HvccAtom classes in Bento4 version 1.5.0-617 do not properly validate data sizes leading to a heap-based buffer over-read and application crash in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.


The AP4_HdlrAtom class in Core/Ap4HdlrAtom.cpp in Bento4 version 1.5.0-617 uses an incorrect character data type leading to a heap-based buffer over-read and application crash in AP4_BytesToUInt32BE in Core/Ap4Utils.h.


unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a stack-based buffer over-read in unrarlib.c related to ExtrFile and stricomp.


objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file leading to program crash.


The Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols leading to a GNU linker (ld) program crash.


The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character which leads to a heap-based buffer over-read.


readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.


An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types related to MAPIPrint() in libytnef.


** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5 there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says \In my opinion this issue should not have a CVE since the GD and GD2 formats are documented to be 'obsolete and should only be used for development and testing purposes.'\


An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read.


An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams related to DecompressRTF() in libytnef.


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 a policy for the packet pattern attribute NL80211_PKTPAT_OFFSET is not defined which can lead to a buffer over-read in nla_get_u32().


LAME

and

have

a

heap-based

buffer

over-read

when

handling

a

malformed

file

in

in

vbrquantize.c.


LAME

and

has

a

heap-based

buffer

over-read

in

in

related

to

in

a

different

vulnerability

than


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 while processing PTT commands ptt_sock_send_msg_to_app() is invoked without validating the packet length. If the packet length is invalid then a buffer over-read can occur.


WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file.


In GraphicsMagick 1.4 snapshot-20171217 Q8 there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c related to an incompatibility with libwebp versions 0.5.0 and later that use a different structure type.


In GraphicsMagick 1.4 snapshot-20171217 Q8 there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c in which LocaleNCompare reads heap data beyond the allocated region.


ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file related to ReadOneMNGImage.


ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted file.


ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafted file.


In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21 there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c related to length calculation and caused by an off-by-one error.


ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafted file.


In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21 there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c related to a WEBP_DECODER_ABI_VERSION check.


The (1) i2pd before 2.17 and (2) kovri pre-alpha implementations of the I2P routing protocol do not properly handle Garlic DeliveryTypeTunnel packets which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read as demonstrated by reading sensitive router memory aka the GarlicRust bug.


In GraphicsMagick 1.4 snapshot-20171217 Q8 there is a heap-based buffer over-read in ReadMNGImage in coders/png.c related to accessing one byte before testing whether a limit has been reached.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the JPEG 2000 module. An invalid JPEG 2000 input code stream leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information such as object heap addresses etc.


In the Ox gem 2.8.1 for Ruby the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the True Type2 Font parsing module. A corrupted cmap table input leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information such as object heap addresses etc.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the exif processing module for a PNG file (during XPS conversion). Invalid input leads to a computation where pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information such as object heap addresses etc.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the module that handles character codes for certain textual representations. Invalid input leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information such as object heap addresses etc.


tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.


In libavcodec in Libav 9.21 ff_h264_execute_ref_pic_marking() has a heap-based buffer over-read.


An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer over-read in a trustlet. The Samsung ID is SVE-2017-8890 (August 2017).


Buffer over-read vulnerabilities in an older version of ASN.1 parser in Snapdragon Mobile in versions SD 600.


In

Android

before

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

while

playing

an

ASF

file

a

buffer

over-read

can

potentially

occur.


An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function in lit/lit-char-helpers.c via a RegExp(\\\x0\); payload.


In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1 there is a buffer over-read while parsing malformed TCP UDP and IPv6 packets in the functions `extract_l3_ipv6` `extract_l4_tcp` and `extract_l4_udp` that can be triggered remotely.


An issue also known as DW201703-001 was discovered in libdwarf 2017-03-21. In dwarf_formsdata() a few data types were not checked for being in bounds leading to a heap-based buffer over-read.


libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2 such as PHP to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.


An issue also known as DW201703-002 was discovered in libdwarf 2017-03-21. In _dwarf_decode_s_leb128_chk() a byte pointer was dereferenced just before it was checked for being in bounds leading to a heap-based buffer over-read.


libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2 such as PHP to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.


In Open vSwitch (OvS) v2.7.0 there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-util.c` in the function `ofputil_pull_ofp15_group_mod`.


In libytnef in ytnef through 1.9.2 there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.


An issue also known as DW201703-006 was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarf_formsdata() is due to a failure to check a pointer for being in bounds (in a few places in this function) and a failure in a check in dwarf_attr_list().


In LibTIFF 4.0.7 the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input leading to a heap-based buffer over-read in bmp2tiff.


In

Open

vSwitch

(OvS)

while

parsing

an

type

OFP

message

there

is

a

buffer

over-read

that

is

caused

by

an

unsigned

integer

underflow

in

the

function

in

`lib/ofp-util.c`.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel buffer over-read is possible in camera driver function msm_isp_stop_stats_stream. Variable stream_cfg_cmd->num_streams is from userspace and it is not checked against \MSM_ISP_STATS_MAX\.


An issue also known as DW201703-005 was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in _dwarf_read_loc_expr_op() is due to a failure to check a pointer for being in bounds (in a few places in this function).


The Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library such as objcopy and strip to crash.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 425 SD 430 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A and SD 835 in a crypto API function a buffer over-read can occur.


FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 615/16/SD 415 SD 617 SD 650/52 SD 800 SD 808 and SD 810 buffer over-read in QSEE app may cause confidential information to be leaked.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

if

is

called

with

keyBoxLength

set

to

a

value

higher

than

a

buffer

over-read

occurs.


FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

in

a

PlayReady

API

function

a

buffer

over-read

can

occur.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

in

a

crypto

API

function

a

buffer

over-read

can

occur.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

in

a

WideVine

API

function

a

buffer

over-read

can

occur.


FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

in

a

DRM

function

a

buffer

over-read

can

occur.


The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26 4.1.x up to 4.1.18 and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte which causes a buffer over-read.


The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks which can cause a buffer over-read in the ajp_process_callback in mod_jk which allows remote attackers to read portions of sensitive memory.


The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0 Firefox ESR 10.x before 10.0.7 Thunderbird before 15.0 Thunderbird ESR 10.x before 10.0.7 and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.


ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.


An

issue

was

discovered

in

JasPer

There

is

a

heap-based

buffer

over-read

of

size

in

the

function

in


In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10 the dissection engine could crash. This was addressed in epan/tvbuff_composite.c by preventing a heap-based buffer over-read.


An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.


In LibSass prior to 3.5.5 the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.


libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c as demonstrated by djpeg.


A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.


The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation leading to a heap-based buffer over-read.


Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_flags.


Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c related to an unterminated string.


In PoDoFo 0.9.5 there exists a heap-based buffer over-read vulnerability in UnescapeName() in PdfName.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.


An issue was discovered in Bento4 1.5.1-627. There is a heap-based buffer over-read in AP4_AvccAtom::Create in Core/Ap4AvccAtom.cpp as demonstrated by mp42hls.


lib/support/unicodeconv/unicodeconv.c in libotfcc.a in otfcc v0.10.3-alpha has a buffer over-read.


jp2_encode in jp2/jp2_enc.c in JasPer 2.0.14 has a heap-based buffer over-read.


ok-file-formats through 2018-10-16 has a heap-based buffer over-read in the ok_mo_decode2 function in ok_mo.c.


Tcpreplay before 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c.


In PHP before 5.6.39 7.x before 7.0.33 7.1.x before 7.1.25 and 7.2.x before 7.2.13 a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.


Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c.


ARM mbed TLS before 2.1.11 before 2.7.2 and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.


ARM mbed TLS before 2.1.11 before 2.7.2 and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.


Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.


There exists a heap-based buffer over-read in ff_vc1_pred_dc in vc1_block.c in Libav 12.3 which allows attackers to cause a denial-of-service via a crafted aac file.


An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in DLS::Region::GetSample() in DLS.cpp.


An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in RIFF::List::GetListTypeString in RIFF.cpp.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9607 MDM9650 SD 210/SD 212/SD 205 SD 425 SD 430 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 808 SD 820 SD 820A SD 835 SD 845 while parsing a private frame in an ID3 tag a buffer over-read can occur when comparing frame data with predefined owner identifier strings.


In the WLAN driver in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel event->num_entries_in_page is a value received from firmware that is not properly validated which can lead to a buffer over-read


In libpbc.a in PBC through 2017-03-02 there is a buffer over-read in calc_hash in map.c.


An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.


In libpbc.a in PBC through 2017-03-02 there is a heap-based buffer over-read in _pbcM_ip_new in map.c.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a buffer over-read in H5O_chunk_deserialize in H5Ocache.c.


An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer over-read in the function H5F_addr_decode_len in H5Fint.c.


An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Type.


An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check).


An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate.


An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next related to certain checks for GPMF_KEY_END and nest_level (conditional on a buffer_size_longs check).


Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_link_decode in H5Olink.c.


An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.


An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_fill_old_decode in H5Ofill.c.


An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next related to certain checks for a positive nest_level.


Genann through 2018-07-08 has a stack-based buffer over-read in genann_train in genann.c.


md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.


In

Snapdragon

(Automobile

Mobile

Wear)

in

version

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

while

parsing

FLAC

file

with

corrupted

picture

block

a

buffer

over-read

can

occur.


RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x) and RSA BSAFE Crypto-C Micro Edition version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would result in such issue.


jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.


ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.


md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination.


An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_utf8 function via a RegExp(\\\\\u0020\) payload related to re_parse_char_class in parser/regexp/re-parser.c.


In ImageMagick 7.0.7-37 Q16 SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file.


** DISPUTED ** TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the reported overflow is due to improper use of the library and not a vulnerability in tinyxml2.


An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function via a RegExp(\\\\\u0\) payload related to re_parse_char_class in parser/regexp/re-parser.c.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler ndp_cfg len and num_ndp_app_info is from fw. If they are not checked it may cause buffer over-read once the value is too large.