The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve89865 CSCsy56638.


An issue was discovered in ytnef before 1.9.1. This is related to a patch described as \3 of 9. Buffer Overflow in version field in lib/tnef-types.h.\


An issue was discovered in CHICKEN Scheme through 4.12.0. When using a nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in unmanaged memory the vector size would be used in unsanitised form as an argument to malloc(). With an unexpected size the impact may have been a segfault or buffer overflow.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve60376 CSCve78027.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve66540.


An issue was discovered in SysGauge 1.5.18. A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka \Service ready\) string.


A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will cause a crash. An example attack methodology may include a long message-body in a GET request.


An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the \decode_ne_resource_id\ function in the \restable.c\ source file. This is happening because the \len\ parameter for memcpy is not checked for size and thus becomes a negative integer in the process resulting in a failed memcpy. This affects wrestool.


Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long \Register a new card\ input fields. There may be a risk of local code execution with untrusted input to SmartDiag.exe or SymDiag.exe.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve66658.


Two errors in the \asn1_find_node()\ function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.


In the touch controller function in all Qualcomm products with Android for MSM Firefox OS for MSM or QRD Android a variable may be controlled by the user and can lead to a buffer overflow.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve60402.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve57697.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve78027 CSCve60276.


An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the \extract_icons\ function in the \extract.c\ source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve66601.


A boundary error within the \foveon_load_camf()\ function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.


A Stack Buffer Overflow issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server part of the CODESYS WebVisu web browser visualization software are affected: CODESYS Web Server Versions 2.3 and prior. A malicious user could overflow the stack buffer by providing overly long strings to functions that handle the XML. Because the function does not verify string size before copying to memory the attacker may then be able to crash the application or run arbitrary code.


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 the camera application triggers \user-memory-access\ issue as the Camera CPP module Linux driver directly accesses the application provided buffer which resides in user space. An unchecked userspace value (ioctl_ptr->len) is used to copy contents to a kernel buffer which can lead to kernel buffer overflow.


The

SIP

backup

feature

in

Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

ViewPoint

eSpace

has

a

buffer

overflow

vulnerability.

An

attacker

may

send

specially

crafted

messages

to

the

affected

products.

Due

to

the

insufficient

validation

of

some

values

for

SIP

messages

successful

exploit

may

cause

services

abnormal.


bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.


LAME

and

have

a

stack-based

buffer

overflow

in

in

a

different

vulnerability

than


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel an invalid input of firmware size (negative value) from user space can potentially lead to the memory leak or buffer overflow during the WLAN cal data store operation.


In spectral_create_samp_msg() in Android for MSM Firefox OS for MSM and QRD Android before 2017-10-11 some values from firmware are not properly validated potentially leading to a buffer overflow.


ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file a related issue to CVE-2009-1324.


The

SIP

module

in

Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

ViewPoint

eSpace

has

a

buffer

overflow

vulnerability.

An

attacker

would

have

to

find

a

way

to

craft

specific

messages

to

the

affected

products.

Due

to

the

insufficient

validation

for

SIP

messages

successful

exploit

may

cause

services

abnormal.


musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses and thus an attacker can provide an unexpected number by sending A records in a reply to an AAAA query.


A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes which in fact should be limited to 256 bytes causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.


Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the \Destination directory\ field either within an XML document or through use of passive mode.


bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.


The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c related to the processing of home directories using the ~ operator followed by a long string.


A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2 as used in V8 in Google Chrome prior to 62.0.3202.75 and other products allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.


Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378 but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages.


VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host.


There exists an unauthenticated SEH based Buffer Overflow vulnerability in the HTTP server of Flexense SyncBreeze Enterprise v10.1.16. When sending a GET request with an excessive length it is possible for a malicious user to overwrite the SEH record and execute a payload that would run under the Windows SYSTEM account.


In

Snapdragon

Automobile

Snapdragon

Wearable

and

Snapdragon

Mobile

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

improper

input

validation

in

causes

a

potential

buffer

overflow.


Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

eSpace

have

a

buffer

overflow

vulnerability.

An

unauthenticated

remote

attacker

may

send

specially

crafted

SIP

packages

to

the

affected

products.

Due

to

the

insufficient

validation

of

some

values

for

SIP

packages

successful

exploit

may

cause

services

abnormal.


Huawei eNSP software with software of versions earlier than V100R002C00B510 has a buffer overflow vulnerability. Due to the improper validation of specific command line parameter a local attacker could exploit this vulnerability to cause the software process abnormal.


Huawei

ViewPoint

have

a

buffer

overflow

vulnerability.

An

unauthenticated

remote

attacker

may

send

specially

crafted

certificates

to

the

affected

products.

Due

to

insufficient

validation

of

the

certificates

successful

exploit

may

cause

buffer

overflow

and

some

service

abnormal.


In Foxit Reader before 9.1 and Foxit PhantomPDF before 9.1 a flaw exists within the parsing of the BITMAPINFOHEADER record in BMP files. The issue results from the lack of proper validation of the biSize member which can result in a heap based buffer overflow. An attacker can leverage this to execute code in the context of the current process.


The inputhub driver of HUAWEI P9 Lite mobile phones with Versions earlier than VNS-L21C02B341 Versions earlier than VNS-L21C22B380 Versions earlier than VNS-L31C02B341 Versions earlier than VNS-L31C440B390 Versions earlier than VNS-L31C636B396 has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and the APP may sends specific data to the inputhub driver to exploit this vulnerability successful exploit could cause the system reboot.


OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp because an incorrect size value is used.


The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.


A buffer overflow vulnerability in \Add command\ functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.


An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64 and VAX/VMS 4.0 and later. A malformed DCL command table may result in a buffer overflow allowing a local privilege escalation when a non-privileged account enters a crafted command line. This bug is exploitable on VAX and Alpha and may cause a process crash on IA64. Software was affected regardless of whether it was directly shipped by VMS Software Inc. (VSI) HPE HP Compaq or Digital Equipment Corporation.


The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.


The Near Field Communication (NFC) module in Huawei Mate 9 Pro mobile phones with the versions before LON-AL00B 8.0.0.340a(C00) has a buffer overflow vulnerability due to the lack of input validation. An attacker may use an NFC card reader or another device to inject malicious data into a target mobile phone. Successful exploit could lead to system restart or arbitrary code execution.


An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths which (due to lack of checking) can lead to buffer overflows and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.


Huawei

have

a

buffer

overflow

vulnerability

due

to

incomplete

range

checks

of

the

input

data.

An

unauthenticated

remote

attacker

could

exploit

this

vulnerability

by

sending

malicious

IKE

packets

to

the

targeted

device.

An

exploit

could

allow

the

attacker

to

cause

the

device

to

write

out

of

bound

and

restart.


Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field aka WSCLT-1729.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c224 the value for the s_vol_play key is copied using strcpy to the buffer at 0xa0000418. This buffer is maximum 8 bytes large (this is the maximum size it could be it is possible other global variables are stored between this variable and the next one that we could identify) sending anything longer will cause a buffer overflow.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. This vulnerability leads to a stack-based buffer overflow condition in the internal Unicode string manipulation module. It is triggered by an invalid PDF file where a crafted Unicode string causes an out of bounds memory access of a stack allocated buffer due to improper checks when manipulating an offset of a pointer to the buffer. Attackers can exploit the vulnerability and achieve arbitrary code execution if they can effectively control the accessible memory.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c318 the value for the s_port key is copied using strcpy to the buffer at 0xa00017f4. This buffer is 6 bytes large sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between \0\ and \3\.


An error related to the \LibRaw::panasonic_load_raw()\ function (dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.


A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.


On Insteon Hub 2245-222 devices with firmware version 1012 specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. At 0x9d01ef24 the value for the s_offset key is copied using strcpy to the buffer at $sp+0x2b0. This buffer is 32 bytes large sending anything longer will cause a buffer overflow.


An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012 for the cc channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request At 0x9d014dd8 the value for the id key is copied using strcpy to the buffer at $sp+0x290. This buffer is 32 bytes large sending anything longer will cause a buffer overflow.


Specially crafted commands sent through the PubNub service in Insteon Hub 2245-222 with firmware version 1012 can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability.At 0x9d014cc0 the value for the cmd key is copied using strcpy to the buffer at $sp+0x11c. This buffer is 20 bytes large sending anything longer will cause a buffer overflow.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c0e8 the value for the s_dport key is copied using strcpy to the buffer at 0xa000180c. This buffer is 6 bytes large sending anything longer will cause a buffer overflow.


An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. A specially-crafted malicious file may be able to cause a heap-based buffer overflow vulnerability when opened by a user.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c2c8 the value for the s_url key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between \0\ and \3\.


GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the \Display visual image directory\ feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.


An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at 0x9d014e4c the value for the flg key is copied using strcpy to the buffer at $sp+0x270. This buffer is 16 bytes large sending anything longer will cause a buffer overflow.


A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. The stack-based buffer overflow vulnerability has been identified which may allow an attacker to execute code remotely or crash the device. After rebooting the device restores itself to a more vulnerable state in which Telnet is accessible.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c254 the value for the s_vol_dim_delta key is copied using strcpy to the buffer at 0xa0000514. This buffer is 4 bytes large sending anything longer will cause a buffer overflow.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bad0 the value for the host key is copied using strcpy to the buffer at 0xa00016e0. This buffer is 32 bytes large sending anything longer will cause a buffer overflow.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c368 the value for the s_mac key is copied using strcpy to the buffer at 0xa000170c. This buffer is 25 bytes large sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between \0\ and \3\.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c284 the value for the s_vol_brt_delta key is copied using strcpy to the buffer at 0xa0000510. This buffer is 4 bytes large sending anything longer will cause a buffer overflow.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large sending anything longer will cause a buffer overflow.


An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01e7d4 the value for the s_vol key is copied using strcpy to the buffer at 0xa0001700. This buffer is maximum 12 bytes large (this is the maximum size it could be it is possible other global variables are stored between this variable and the next one that we could identify) sending anything longer will cause a buffer overflow.


An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at At 0x9d014e84 the value for the cmd1 key is copied using strcpy to the buffer at $sp+0x280. This buffer is 16 bytes large.


A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1 14 before 14.7.1 and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617 which was only about the Party A buffer.


The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print().


The SNMP parser in tcpdump before 4.9.0 has a buffer overflow in print-snmp.c:asn1_parse().


The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print() a different vulnerability than CVE-2016-8575.


The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print().


The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otv_print().


Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux Windows and Mac and 56.0.2924.87 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print().


Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:sig_print().


Stack-based buffer overflow vulnerability in Netop Remote Control versions 11.53 12.21 and prior. The affected module in the Guest client is the \Import to Phonebook\ option. When a specially designed malicious file containing special characters is loaded the overflow occurs. 12.51 is the fixed version. The Support case ref is 00109744.


The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().


A buffer overflow read during SVG filter color value operations resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52.


The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in addrtoname.c:lookup_nsap().


samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary code execution


rust-base64 version <= 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the 'encode_config_buf' and 'encode_config' functions


Exiv2 0.26 contains a heap buffer overflow in tiff parser


Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R8300 before 1.0.2.106 and R8500 before 1.0.2.106.


NETGEAR R8000 devices before 1.0.4.2 are affected by a stack-based buffer overflow by an authenticated user.


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24 R6700v2 before 1.1.0.42 R6800 before 1.1.0.42 and R6900v2 before 1.1.0.42.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

and

before


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 430 SD 450 SD 625 SD 650/52 SD 820 SD 835 SD 845 while processing a SetParam command packet in the VR service the extracted name_len and value_len values are not checked and could potentially cause a buffer overflow in subsequent calls to memcpy().


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8300 before 1.0.2.104 and R8500 before 1.0.2.104.


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6020 before 1.0.0.30 R6080 before 1.0.0.30 R6700v2 before 1.1.0.42 R6800 before 1.1.0.42 and R6900v2 before 1.1.0.42.


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700v2 before 1.1.0.42 R6800 before 1.1.0.42 and R6900v2 before 1.1.0.42.


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R7800 before 1.0.2.36 PLW1000v2 before 1.0.0.14 and PLW1010v2 before 1.0.0.14.


While

processing

the

sensors

registry

configuration

file

if

inputs

are

not

validated

a

buffer

overflow

will

occur

in

Snapdragon

Automobile

Snapdragon

Mobile

Snapdragon

Wear

in

version

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Possible buffer overflows and array out of bounds accesses in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05 while flashing images.


bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled SOCKS proxy server is used. This results from an integer signedness error when the proxy server responds with an acknowledgement of an unexpected target domain name.


An issue was discovered on Samsung mobile devices with KK(4.4) L(5.0/5.1) M(6.0) and N(7.0) software. There is a buffer overflow in the fps sysfs entry. The Samsung ID is SVE-2016-7510 (January 2017).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40 and R9000 before 1.0.2.52.


An issue was discovered on Samsung Galaxy S5 mobile devices with software through 2016-12-20 (Qualcomm AP chipsets). There are multiple buffer overflows in the bootloader. The Samsung ID is SVE-2016-7930 (March 2017).


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24. R6700v2 before 1.1.0.42 R6800 before 1.1.0.42 and R6900v2 before 1.1.0.42.


Lack

of

check

of

buffer

length

before

copying

can

lead

to

buffer

overflow

in

camera

module

in

Small

Cell

SoC

Snapdragon

Mobile

Snapdragon

Wear

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects R6220 before V1.1.0.50 R7800 before V1.0.2.36 WNDR3400v3 before 1.0.1.14 and WNDR3700v5 before V1.1.0.48.


Buffer

overflow

in

AES-CCM

and

AES-GCM

encryption

via

initialization

vector

in

snapdragon

automobile

snapdragon

mobile

and

snapdragon

wear

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) (Qualcomm chipsets) software. There is a panel_lpm sysfs stack-based buffer overflow. The Samsung ID is SVE-2017-9414 (December 2017).


In

Android

before

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

in

GERAN

a

buffer

overflow

may

potentially

occur.


An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos8890 chipsets) software. There are multiple Buffer Overflows in TSP sysfs cmd_store. The Samsung ID is SVE-2016-7500 (January 2017).


An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer overflow in tlc_server. The Samsung ID is SVE-2017-8888 (July 2017).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

and

before


In

Android

for

MSM

Firefox

OS

for

MSM

QRD

Android

with

all

Android

releases

from

CAF

using

the

Linux

kernel

improper

input

validation

for

in

wma_pdev_hw_mode_transition_evt_handler()

which

is

received

from

firmware

leads

to

potential

buffer

overflow.


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24 R6700v2 before 1.1.0.42 R6800 before 1.1.0.42 and R6900v2 before 1.1.0.42.


An issue was discovered on Samsung mobile devices with KK(4.4) L(5.0/5.1) M(6.0) and N(7.0) (Exynos54xx Exynos7420 Exynos8890 or Exynos8895 chipsets) software. There is a buffer overflow in the sensor hub. The Samsung ID is SVE-2016-7484 (January 2017).


An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer overflow in process_cipher_tdea. The Samsung ID is SVE-2017-8973 (July 2017).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow.

This

affects

before

before

before

before

before

before

and

before


While iterating through the models contained in a fixed-size array in the actData structure which also stores an incorrect number of models that is greater than the size of the array a buffer overflow occurs in Snapdragon Automobile Snapdragon Mobile Snapdragon Wear in MDM9206 MDM9607 MDM9650 SD 210/SD 212/SD 205 SD 425 SD 430 SD 450 SD 617 SD 625 SD 650/52 SD 820 SD 820A SD 835


In

Android

for

MSM

Firefox

OS

for

MSM

QRD

Android

with

all

Android

releases

from

CAF

using

the

Linux

kernel

improper

input

validation

for

in

which

is

received

from

firmware

leads

to

potential

buffer

overflow.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

and

before


raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6100 before 1.0.1.20 R7800 before 1.0.2.40 and R9000 before 1.0.2.52.


An integer underflow may occur due to lack of check when received data length from font_mgr_qsee_request_service is bigger than the minimal value of the segment header which may result in a buffer overflow in Snapdragon Automobile Snapdragon Mobile Snapdragon Wear in MDM9206 MDM9607 MDM9650 SD 210/SD 212/SD 205 SD 425 SD 430 SD 450 SD 625 SD 650/52 SD 820 SD 820A SD 835 SD 845 SD 850.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with L(5.1) M(6.x) and N(7.x) software. There is a muic_set_reg_sel heap-based buffer overflow during the reading of MUIC register values. The Samsung ID is SVE-2017-10011 (December 2017).


Possible

buffer

overflow

if

input

is

not

terminated

in

DSP

Service

module

in

Snapdragon

Automobile

Snapdragon

Mobile

Snapdragon

Wear

in

version

SD

SD

SD

SD

SD

SD

SD

SD


In

Android

before

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

a

buffer

overflow

vulnerability

may

potentially

exist

while

making

an

IMS

call.


In utils.c in zsh before 5.4 symlink expansion had a buffer overflow.


Possible

Buffer

overflow

when

transmitting

an

RTP

packet

in

snapdragon

automobile

and

snapdragon

wear

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrentFile).


Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.


libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2 such as PHP to crash.


Document

Liberation

Project

libmwaw

before

has

an

out-of-bounds

write

caused

by

a

heap-based

buffer

overflow

related

to

the

MsWrd1Parser::readFootnoteCorrespondance

function

in


A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010 Ford a limited number of P-HEV vehicles Infiniti 2013 JX35 Infiniti 2014-2016 QX60 Infiniti 2014-2016 QX60 Hybrid Infiniti 2014-2015 QX50 Infiniti 2014-2015 QX50 Hybrid Infiniti 2013 M37/M56 Infiniti 2014-2016 Q70 Infiniti 2014-2016 Q70L Infiniti 2015-2016 Q70 Hybrid Infiniti 2013 QX56 Infiniti 2014-2016 QX 80 and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU.


Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c.


A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about \size\ many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2 such as PHP to crash.


An

issue

was

discovered

in

Oniguruma

as

used

in

Oniguruma-mod

in

Ruby

through

and

mbstring

in

PHP

through

A

stack

out-of-bounds

write

in

onigenc_unicode_get_case_fold_codes_by_str()

occurs

during

regular

expression

compilation.

Code

point

is

not

properly

handled

in

A

malformed

regular

expression

could

result

in

bytes

being

written

off

the

end

of

a

stack

buffer

of

during

the

call

to

a

typical

stack

buffer

overflow.


The driver of honor 5C honor 6x Huawei smart phones with software of versions earlier than NEM-AL10C00B356 versions earlier than Berlin-L21HNC432B360 have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system the APP can send a specific parameter to the driver of the smart phone causing a system reboot or arbitrary code execution.


The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on systems with a C library (e.g. glibc) that lacks its own strlcpy.


A potential Buffer Overflow Vulnerability (from a BB Code handling issue) has been identified in TeamSpeak Server version 3.0.13.6 (08/11/2016 09:48:33) it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server.


A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later iPad 4th generation and later iPod touch 6th generation.


FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.


In the service locator in all Qualcomm products with Android releases from CAF using the Linux kernel a buffer overflow can occur as the variable set for determining the size of the buffer is not used to indicate the size of the buffer.


SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote source. The problem is that the length of data written is an arbitrary number found within the file. The vendor response is SAP Security Note 2441560.


The CameraISP driver of some Huawei smart phones with software of versions earlier than Prague-AL00AC00B205 versions earlier than Prague-AL00BC00B205 versions earlier than Prague-AL00CC00B205 versions earlier than Prague-TL00AC01B205 versions earlier than Prague-TL10AC01B205 has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP the APP can send a specific parameter to the CameraISP driver of the smart phone causing system reboot.


The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162 the versions before Victoria-L29AC605B162 the versions before Vicky-L29AC605B162 have an out-of-bounds memory access vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. the APP can modify specific data to cause buffer overflow in the next system reboot causing out-of-bounds memory read which can continuous system reboot.


PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c related to a \pattern with very many captures.\


FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.


A buffer overflow can occur in all Qualcomm products with Android for MSM Firefox OS for MSM or QRD Android when processing a firmware image file.


Some Huawei smartphones with software AGS-L09C233B019 AGS-W09C233B019 KOB-L09C233B017 KOB-W09C233B012 have a type confusion vulnerability. The program initializes a variable using one type but it later accesses that variable using a type that is different with the original type when do certain register operation. Successful exploit could result in buffer overflow then may cause malicious code execution.


The Bastet driver of Honor 9 Huawei smart phones with software of versions earlier than Stanford-AL10C00B175 has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the driver of the smart phone causing arbitrary code execution


Huawei smart phones with software earlier than VIE-L09C40B360 versions have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the smart phone causing the smartphone restart or arbitrary code execution.


wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters aka a buffer overflow triggered by a malformed temporary DH file.


The camera driver of MTK platform in Huawei smart phones with software of versions earlier than Nice-AL00C00B155 has a buffer overflow vulnerability.Due to the insufficient input verification an attacker tricks a user into installing a malicious application which has special privilege and sends a specific parameter to the driver of the smart phone causing privilege escalation.


WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal with a buffer overflow.


LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.


The driver of honor 5C honor 6x Huawei smart phones with software of versions earlier than NEM-AL10C00B356 versions earlier than Berlin-L21HNC432B360 have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system the APP can send a specific parameter to the driver of the smart phone causing a system reboot or arbitrary code execution.


Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13 Acrobat and Acrobat Reader DC Classic before 2015.006.30094 and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information via unspecified vectors.


Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1) GetValueForIPv4Addr (2) GetValueForMACAddr (3) rfc3110_import or (4) CopyNSEC3ResourceRecord function.


An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-05-13. There is a buffer overflow in datablock_write because the amount of received data is not validated. The Samsung ID is SVE-2015-4018 (December 2015).


Buffer overflow in IOHIDFamily in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges via unspecified vectors.


Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allows attackers to gain privileges via a crafted application that uses a long WPS IE element.


Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0 Firefox ESR 31.x before 31.5 and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic.


Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allows attackers to gain privileges via a crafted application that establishes a packet filter.


Buffer overflow in xymon 4.3.17-1.


Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application aka \Win32k Pool Buffer Overflow Vulnerability.\


Buffer overflow in IOHIDFamily in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors.


Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application aka \Win32k Buffer Overflow Vulnerability.\


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3695 CVE-2015-3696 CVE-2015-3697 CVE-2015-3698 CVE-2015-3699 CVE-2015-3700 and CVE-2015-3701.


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3695 CVE-2015-3696 CVE-2015-3698 CVE-2015-3699 CVE-2015-3700 CVE-2015-3701 and CVE-2015-3702.


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3695 CVE-2015-3697 CVE-2015-3698 CVE-2015-3699 CVE-2015-3700 CVE-2015-3701 and CVE-2015-3702.


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3695 CVE-2015-3696 CVE-2015-3697 CVE-2015-3699 CVE-2015-3700 CVE-2015-3701 and CVE-2015-3702.


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3695 CVE-2015-3696 CVE-2015-3697 CVE-2015-3698 CVE-2015-3699 CVE-2015-3700 and CVE-2015-3702.


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3695 CVE-2015-3696 CVE-2015-3697 CVE-2015-3698 CVE-2015-3699 CVE-2015-3701 and CVE-2015-3702.


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3696 CVE-2015-3697 CVE-2015-3698 CVE-2015-3699 CVE-2015-3700 CVE-2015-3701 and CVE-2015-3702.


Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors a different vulnerability than CVE-2015-3695 CVE-2015-3696 CVE-2015-3697 CVE-2015-3698 CVE-2015-3700 CVE-2015-3701 and CVE-2015-3702.


Stack-based

buffer

overflow

in

the

function

in

in

the

Linux

kernel

before

allows

context-dependent

attackers

to

gain

privileges

by

constructing

a

crafted

microcode

header

and

leveraging

root

privileges

for

write

access

to

the

initrd.


Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier when using the qemu-xen-traditional (aka qemu-dm) device model allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries related to a \write path.\


OCaml before 4.03.0 does not properly handle sign extensions which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.


Multiple stack-based buffer overflows in the (1) conv_jistoeuc (2) conv_euctojis and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email involving Japanese character set conversion.


In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.


Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email involving Japanese character set conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8614.


The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read Write Execute (RWX) permissions at predictable addresses on 32-bit platforms when protecting another application which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

lack

of

input

validation

can

cause

potential

buffer

overflow.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 MDM9635M MDM9650 MDM9655 SD 400 SD 410/12 SD 615/16/SD 415 SD 617 SD 650/52 SD 808 SD 810 and SDX20 in a QTEE syscall handler HLOS can cause a buffer overflow to occur.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9607 MDM9640 MDM9650 SD 210/SD 212/SD 205 SD 425 SD 430 SD 450 SD 600 SD 625 SD 650/52 SD 808 SD 810 SD 820 SD 835 and SDX20 in pre-auth request Host driver uses FT IEs sent by the supplicant. A buffer overflow may occur if FT IEs sent by the supplicant are larger than the expected value.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

Snapdragon

Wear

and

Small

Cell

SoC

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

lack

of

input

Validation

in

can

cause

potential

buffer

overflow.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 615/16/SD 415 SD 617 SD 650/52 SD 800 SD 808 and SD 810 TOCTOU condition could lead to a buffer overflow in function playready_reader_bind().


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 425 SD 430 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A and SD 835 lack of length checking in wv_dash_core_load_keys_v8() could lead to a buffer overflow vulnerability.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

possible

buffer

overflow

when

processing

circuit

service

message.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

while

processing

scheduling

message

information

a

buffer

overflow

can

occur.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

possible

buffer

overflow

if

SIM

card

sends

a

response

greater

than

of

data

for

stream

APDU

command.


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

and

SD

in

a

QTEE

crypto

function

a

buffer

overflow

can

occur.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9607 MDM9635M MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 425 SD 430 SD 615/16/SD 415 SD 617 SD 800 SD 808 and SD 810 when making a high speed Dual Carrier Downlink Data call in a multicell environment a buffer overflow may occur.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile Snapdragon Mobile Snapdragon Wear and Small Cell SoC FSM9055 IPQ4019 MDM9206 MDM9607 MDM9625 MDM9635M MDM9640 MDM9645 MDM9650 MDM9655 MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 425 SD 430 SD 450 SD 600 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 800 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 SD 850 and SDX20 when an RSA encryption operation is called the ce_util_to_unsigned_bin is invoked to convert the input buffer to unsigned binary. The ce_util_to_unsigned_bin function instead of operating on the size of the unsigned character buffer that is passed operates on the address - i.e. operates on \c\ instead of \*c\. Decrementing the address to check if it is less than zero means that the operation will always pass since a pointer will never be less than zero and may result in a buffer overflow.


In the Linux kernel before 4.1.4 a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6 according to the userspace API. However the code allows larger values such as 23.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019 MDM9206 MDM9607 MDM9615 MDM9625 MDM9640 MDM9650 MDM9655 MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 600 SD 615/16/SD 415 and SDX20 when reading CDT from eMMC with a very large meta offset (>size of default CDT-array compiled in bootloader) for one of the CDBs a buffer overflow occurs.


add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible depending on the application C library compiler and other factors.


termpkg 3.3 suffers from buffer overflow.


Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory via a modified size for (1) EM_GET_CE_PARAMETER and (2) EM_SET_CE_PARAMETER messages which leads to a buffer overflow (probably an over-read).


Buffer overflow in Paul Rombouts pdnsd before 1.2.4 has unknown impact and attack vectors. NOTE: this issue might be related to the OUSPG PROTOS DNS test suite.


Unspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable possibly because of a buffer overflow.


NCP Network Communication Secure Client 8.11 Build 146 and possibly other versions allows local users to bypass security protections and configure privileged options via a long argument to ncpmon.exe which provides access to alternate privileged menus possibly due to a buffer overflow.


Buffer overflow in certain functions in src/fileio.c and src/unix/fileio.c in xmame before 11 January 2006 may allow local users to gain privileges via a long (1) -lang (2) -ctrlr (3) -pb or (4) -rec argument on many operating systems and via a long (5) -jdev argument on Ubuntu Linux.


Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables when writing to the log file.


Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors as identified by Oracle Vuln# DB29. NOTE: based on mutual credits by the relevant sources it is highly likely that this issue is a buffer overflow in the (a) DBMS_XMLSCHEMA and (b) DBMS_XMLSCHEMA_INT packages as exploitable via long arguments to (1) XDB.DBMS_XMLSCHEMA.GENERATESCHEMA or (2) XDB.DBMS_XMLSCHEMA.GENERATESCHEMAS.


Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to have an unknown impact via a crafted xfig file possibly involving an invalid (1) color index (2) number of points or (3) depth.


Buffer overflow in RealNetworks RealPlayer 10.5 6.0.12.1040 through 6.0.12.1348 RealPlayer 10 RealOne Player v2 RealOne Player v1 RealPlayer 8 and RealPlayer Enterprise before 20060322 allows remote attackers to have an unknown impact via a malicious Mimio boardCast (mbc) file.


Buffer overflow in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier allows remote attackers to have an unknown impact when a Unicode string is converted to a \narrow\ string.


Multiple buffer overflows in the checkscores function in scores.c in tetris-bsd in bsd-games before 2.17-r1 in Gentoo Linux might allow local users with games group membership to gain privileges by modifying tetris-bsd.scores to contain crafted executable content which is executed when another user launches tetris-bsd.


Buffer overflow in inet_server.cpp in (1) fb_inet_server and (2) fbserver in Firebird 1.5.2.4731 allows local users to gain privileges via a long value of the -p argument.


fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is \not correctly interpreting an offset to a pointer as a signed value.\


Stack-based buffer overflow in Python 2.4.2 and earlier running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5 allows local users to cause a \stack overflow \ and possibly gain privileges by running a script from a current working directory that has a long name related to the realpath function. NOTE: this might not be a vulnerability. However the fact that it appears in a programming language interpreter could mean that some applications are affected although attack scenarios might be limited because the attacker might already need to cross privilege boundaries to cause an exploitable program to be placed in a directory with a long name; or depending on the method that Python uses to determine the current working directory setuid applications might be affected.


Firebird 1.5.2.4731 installs (1) fb_lock_mgr (2) gds_drop and (3) fb_inet_server with setuid firebird permissions which might allow local users to gain privileges via a buffer overflow as identified by CVE-2006-1240 or possibly other vulnerabilities.


Multiple buffer overflows in htpasswd as used in Acme thttpd 2.25b and possibly other products such as Apache might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program and the exploit is through command line options perhaps this issue should not be included in CVE. However if there are some typical or recommended configurations that use htpasswd with sudo privileges or common products that access htpasswd remotely then perhaps it should be included.


Buffer overflow in Mercury Mail Transport System 4.01b for Windows has unknown impact and attack vectors as originally reported in a GLEG VulnDisco pack. NOTE: the provenance of this information is unknown; the details are obtained from third party information. The original researcher is reliable.


Unspecified vulnerability in Oracle Spatial component in Oracle Database 9.0.1.5 9.2.0.7 and 10.1.0.5 has unknown impact and remote authenticated attack vectors related to mdsys.md2 aka Vuln# DB03. NOTE: as of 20061023 Oracle has not disputed reports from reliable third parties that DB03 is related to one or more of (1) a buffer overflow in the (a) RELATE function or (2) SQL injection in the (b) TESSELATE_FIXED and (c) TESSELATE function.


Multiple unspecified vulnerabilities in Oracle Spatial component in Oracle Database 8.1.7.4 9.0.1.5 9.2.0.7 and 10.1.0.4 have unknown impact and remote authenticated attack vectors related to (1) mdsys.sdo_3gl aka Vuln# DB20 and (2) mdsys.sdo_cs aka DB21. NOTE: as of 20061023 Oracle has not disputed reports from reliable third parties that DB20 is a buffer overflow in GEOM_OPERATION and DB21 is related to a buffer overflow and SQL injection in TRANSFORM_LAYER.


Multiple buffer overflows in WS_FTP Server 5.05 before Hotfix 1 and possibly other versions down to 5.0 have unknown impact and remote authenticated attack vectors via the (1) XCRC (2) XMD5 and (3) XSHA1 commands. NOTE: in the early publication of this identifier on 20060926 the description was used for the wrong issue.


Buffer overflow in GuildFTPd 0.999.13 allows remote attackers to have an unknown impact possibly code execution related to input containing \globbing chars.\


Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS which triggers an overflow when initializing the table array.


The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a valid network IP address which allows remote attackers to obtain network information and facilitate other attacks as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0. NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way that is similar to strcpy's role in buffer overflows in which case this would be a class of implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a security-relevant manner.


Multiple buffer overflows in Eudora Worldmail possibly Worldmail 3 version 6.1.22.0 have unknown impact and attack vectors as demonstrated by the (1) \Eudora WorldMail stack overflow\ and (2) \Eudora WorldMail heap overflow\ modules in VulnDisco Pack. NOTE: Some of these details are obtained from third party information. As of 20061118 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in FTPRush 1.0.0.610 might allow attackers to gain privileges via a long Host field. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. Also it is not clear whether this issue crosses security boundaries.


Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors.


Buffer overflow in tt_printf function of rxvt 2.6.2 allows local users to gain privileges via a long (1) -T or (2) -name argument.


Buffer overflow in qpopper (aka qpop or popper) 4.0 through 4.0.2 allows remote attackers to gain privileges via a long username.


Buffer overflow in Snes9x 1.37 when installed setuid root allows local users to gain root privileges via a long command line argument.


Buffer overflows in gzip 1.3x 1.2.4 and other versions might allow attackers to execute code via a long file name possibly remotely if gzip is run on an FTP server.


Multiple buffer overflows in programs used by scoadmin and sysadmsh in SCO OpenServer 5.0.6a and earlier allow local users to gain privileges via a long TERM environment variable to (1) atcronsh (2) auditsh (3) authsh (4) backupsh (5) lpsh (6) sysadm.menu or (7) termsh.


Buffer overflows in muxatmd in AIX 4 allows an attacker to cause a core dump and possibly execute code.


Buffer overflow in uidadmin in Caldera Open Unix 8.0.0 and UnixWare 7 allows local users to gain root privileges via a long -S (scheme) command line argument.


Buffer overflow in ultimate_source function of man 1.5 and earlier allows local users to gain privileges.


Buffer overflow in xman allows local users to gain privileges via a long MANPATH environment variable.


Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the \news\ group to gain privileges via a long -c command line argument.


Buffer overflow in rsh on AIX 4.2.0.0 may allow local users to gain root privileges via a long command line argument.


Buffer overflow in rpc.yppasswdd (yppasswd server) in AIX allows attackers to gain unauthorized access via a long string. NOTE: due to lack of details in the vendor advisory it is not clear if this is the same issue as CVE-2001-0779.


Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges.


Buffer overflow in lpshut in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a long first argument to lpshut.


One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.


Buffer overflow in ja-xklock 2.7.1 and earlier allows local users to gain root privileges.


Buffer overflow in pppattach and other linked PPP utilities in Caldera Open Unix 8.0 and UnixWare 7.1.0 and 7.1.1 allows local users to gain privileges.


Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6 7 and 8 allows remote attackers to gain root access via a long username.


Buffer overflow in mailx in Solaris 8 and earlier allows a local attacker to gain additional privileges via a long '-F' command line option.


Becky! 2.00.05 and earlier can allow a remote attacker to gain additional privileges via a buffer overflow attack on long messages without newline characters.


kcms_configure as included with Solaris 7 and 8 allows a local attacker to gain additional privileges via a buffer overflow in a command line argument.


Buffer overflow in transaction signature (TSIG) handling code in BIND 8 allows remote attackers to gain root privileges.


Buffer overflow in mail included with SunOS 5.8 for x86 allows a local user to gain privileges via a long HOME environment variable.


A configuration error in the libdb1 package in OpenLinux 3.1 uses insecure versions of the snprintf and vsnprintf functions which could allow local or remote users to exploit those functions with a buffer overflow.


Buffer overflow in dtmail in Solaris 2.6 and 7 allows local users to gain privileges via the MAIL environment variable.


lpadmin in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow attack in the first argument to the command.


Buffer overflow in db_loader in ClearCase 4.2 and earlier allows local users to gain root privileges via a long TERM environment variable.


Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename which triggers the overflow when the directory name is added aka the \SSI privilege elevation\ vulnerability.


Buffer overflow in nslookupComplain function in BIND 4 allows remote attackers to gain root privileges.


Buffer overflow in dc20ctrl before 0.4_1 in FreeBSD and possibly other operating systems allows local users to gain privileges.


Buffer overflow in Vixie cron 3.0.1-56 and earlier could allow a local attacker to gain additional privileges via a long username (> 20 characters).


Buffer overflow in lpforms in SCO OpenServer 5.0-5.0.6 can allow a local attacker to gain additional privileges via a long first argument to the lpforms command.


Buffer overflow in libi18n library in IBM AIX 5.1 and 4.3.x allows local users to gain root privileges via a long LANG environmental variable.


HP Event Correlation Service (ecsd) as included with OpenView Network Node Manager 6.1 allows a remote attacker to gain addition privileges via a buffer overflow attack in the '-restore_config' command line parameter.


Buffer overflow in ja-elvis and ko-helvis ports of elvis allow local users to gain root privileges.


Buffer overflow in ximp40 shared library in Solaris 7 and Solaris 8 allows local users to gain privileges via a long \arg0\ (process name) argument.


Buffer overflow in /usr/bin/cu in Solaris 2.8 and earlier and possibly other operating systems allows local users to gain privileges by executing cu with a long program name (arg0).


Buffer overflow in lpsched on DGUX version R4.20MU06 and MU02 allows a local attacker to obtain root access via a long command line argument (non-existent printer name).


Buffer overflow in exrecover in Solaris 2.6 and earlier possibly allows local users to gain privileges via a long command line argument.


Buffer overflows in Pileup before 1.2 allows local users to gain root privileges via (1) long command line arguments or (2) a long callsign.


Buffer overflow in sudo earlier than 1.6.3p6 allows local users to gain root privileges.


Buffer overflows in Washington University imapd 2000a through 2000c could allow local users without shell access to execute code as themselves in certain configurations.


Buffer overflows in ascdc Afterstep while running setuid allows local users to gain root privileges via a long (1) -d option (2) -m option or (3) -f option.


Buffer overflow in FTPFS allows local users to gain root privileges via a long user name.


deliver program in MMDF 2.43.3b in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow in the first argument to the command.


Buffer overflow in dsh in dqs 3.2.7 in SuSE Linux 7.0 and earlier and possibly other operating systems allows local users to gain privileges via a long first command line argument.


Buffer overflow in SNMP proxy agent snmpd in Solaris 8 may allow local users to gain root privileges by calling snmpd with a long program name.


Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS (2) PING (3) SERVICES (4) TRC_FILE (5) SAVE_CONFIG or (6) RELOAD.


Buffer overflow in kdc_reply_cipher of libkrb (Kerberos 4 authentication library) in NetBSD 1.5 and FreeBSD 4.2 and earlier as used in Kerberised applications such as telnetd and login allows local users to gain root privileges.


Buffer overflow in Berkeley parallel make (pmake) 2.1.33 and earlier allows a local user to gain root privileges via a long check argument of a shell definition.


recon in SCO OpenServer 5.0 through 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow attack in the first command line argument.


Buffer overflow in Compaq Management Agents before 5.2 included in Compaq Web-enabled Management Software allows local users to gain privileges.


Buffer overflow in dtsession on Solaris and possibly other operating systems allows local users to gain privileges via a long LANG environmental variable.


Buffer overflow in ptexec in the Sun Validation Test Suite 4.3 and earlier allows a local user to gain privileges via a long -o argument.


Buffer overflows in (1) send_status (2) kill_print and (3) chk_fhost in lpd in AIX 4.3 and 5.1 allow remote attackers to gain root privileges.


Buffer overflow in swverify in HP-UX 11.0 and possibly other programs allows local users to gain privileges via a long command line argument.


Buffer overflow in Computalynx CMail POP3 mail server 2.4.9 allows remote attackers to run arbitrary code via a long HELO command.


Buffer overflow in jaZip Zip/Jaz drive manager allows local users to gain root privileges via a long DISPLAY environmental variable.


Buffer overflow in Frox transparent FTP proxy 0.6.6 and earlier with the local caching method selected allows remote FTP servers to run arbitrary code via a long response to an MDTM request.


Buffer overflow in yaSSL as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28 has unspecified impact and attack vectors a different vulnerability than CVE-2013-1492.


The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012 when Internet Explorer is used might allow remote attackers to obtain sensitive information via a URI with a % (percent) character as its (1) last or (2) second-to-last character in situations where a certain \post-URL data\ buffer contains a 0x0000 character but a buffer overflow does not occur.


plow has local buffer overflow vulnerability


Buffer overflow in the DataDirect ODBC driver as used in Oracle Hyperion Interactive Reporting 11.1.2.1 and 11.1.2.2 Essbase Server 11.1.2.1 and 11.1.2.2 Production Reporting Server 11.1.2.1 and 11.1.2.2 and Integration Services Server 11.1.2.1 and 11.1.2.2 has unknown impact and attack vectors.


A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters not supported by the current locale set in the LC_CTYPE environment variable are printed through the echo built-in function. A local attacker who can provide data to print through the \echo -e\ built-in function may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().


Buffer overflow in pgpwded.sys in Symantec PGP Desktop 10.x and Encryption Desktop 10.3.0 before MP1 on Windows XP and Server 2003 allows local users to gain privileges via a crafted application.


Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request a different vulnerability than CVE-2012-4504.


Buffer overflow in Beijer ADP 6.5.0-180_R1967 and 6.5.1-186_R2942 and H-Designer 6.5.0 B180_R1967 allows local users to gain privileges by inserting a long string into a DLL file.


HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability


RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable.


An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoder_encodeOctetString in mms/asn1/ber_encoder.c. This is exploitable even after CVE-2018-18834 has been patched with a different dataSetValue sequence than the CVE-2018-18834 attack vector.


An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the \set font\ function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.


An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer overflow in the function calculate_gain() in libfaad/sbr_hfadj.c.


An

issue

was

discovered

in

JasPer

There

is

a

heap-based

buffer

overflow

of

size

in

the

function

in


Buffer overflow in apply.cgi on TRENDnet TEW-632BRP 1.010B32 and TEW-673GRU devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (with authentication).


An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to conduct stack-based buffer overflow attacks via the IPv4Address field.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.


An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer overflow in the function excluded_channels() in libfaad/syntax.c.


Buffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68 V1.2.2.65 and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (without authentication).


Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.


A stack-based buffer overflow in the find_green() function of dcraw through 9.28 as used in ufraw-batch and many other products may allow a remote attacker to cause a control-flow hijack denial-of-service or unspecified other impact via a maliciously crafted raw photo file.


An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the \set font\ function. This issue occurs when the Gnuplot postscript terminal is used as a backend.


aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.


An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df_generate_ascii_array_entry. To exploit this vulnerability an attacker must pass an overlong string as the right bound of the range argument that is passed to the plot function.


Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response because a buffer size is supposed to match an expanded length but actually matches a compressed length.


Buffer overflow in video.cgi on TRENDnet TV-IP110WN V1.2.2 build 68 V1.2.2.65 and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (without authentication).


An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57 R7800 before 1.0.2.40 R9000 before 1.0.3.6 WNDR3700v4 before 1.0.2.92 and WNDR4300 before 1.0.2.98.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.57 D7800 before 1.0.1.28 R7500v2 before 1.0.3.24 R7800 before 1.0.2.40 and R9000 before 1.0.3.6.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x and P(9.0) (Exynos chipsets) software. There is a stack-based buffer overflow in the Shannon Baseband. The Samsung ID is SVE-2018-12757 (September 2018).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67 D6000 before 1.0.0.67 and R9000 before 1.0.2.52.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects EX2700 before 1.0.1.28 R7800 before 1.0.2.40 WN2000RPTv3 before 1.0.1.20 WN3000RPv3 before 1.0.2.50 and WN3100RPv2 before 1.0.0.56.


An issue was discovered on Samsung mobile devices with L(5.x) M(6.x) and N(7.x) software. There is a vnswap heap-based buffer overflow via the store function with resultant privilege escalation. The Samsung ID is SVE-2017-10599 (January 2018).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40 and R9000 before 1.0.3.6.


OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67 D6000 before 1.0.0.67 D6100 before 1.0.0.56 and R6100 before 1.0.1.20.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40 R9000 before 1.0.2.52 WNDR3700v4 before 1.0.2.92 and WNDR4300 before 1.0.2.94.


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with N(7.x) and O(8.0) software. The sem Trustlet has a buffer overflow that leads to arbitrary TEE code execution. The Samsung IDs are SVE-2018-13230 SVE-2018-13231 SVE-2018-13232 SVE-2018-13233 (December 2018).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with M(6.0) N(7.x) and O(8.x) except exynos9610/9820 in all Platforms M(6.0) except MSM8909 SC77xx/9830 exynos3470/5420 N(7.0) except MSM8939 N(7.1) except MSM8996 SDM6xx/M6737T software. There is an integer underflow with a resultant buffer overflow in eCryptFS. The Samsung ID is SVE-2017-11857 (September 2018).


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

a

stack-based

buffer

overflow

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with N(7.x) and O(8.X) (Exynos chipsets) software. There is a Buffer overflow in the esecomm Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2018-12852 (October 2018).


Certain

NETGEAR

devices

are

affected

by

a

buffer

overflow

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on Samsung mobile devices with software through 2017-11-03 (S.LSI modem chipsets). The Exynos modem chipset has a baseband buffer overflow. The Samsung ID is SVE-2017-10745 (January 2018).


A Buffer Overflow issue was discovered in Kamailio before 4.4.7 5.0.x before 5.0.6 and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.


Parsing malformed project files in Omron CX-One versions 4.42 and prior including the following applications: CX-FLnet versions 1.00 and prior CX-Protocol versions 1.992 and prior CX-Programmer versions 9.65 and prior CX-Server versions 5.0.22 and prior Network Configurator versions 3.63 and prior and Switch Box Utility versions 1.68 and prior may cause a heap-based buffer overflow.