Microsoft Edge in Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to how the scripting engine handles objects in memory aka \Scripting Engine Memory Corruption Vulnerability\. This CVE ID is unique from CVE-2018-0758 CVE-2018-0762 CVE-2018-0768 CVE-2018-0769 CVE-2018-0772 CVE-2018-0773 CVE-2018-0774 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 CVE-2018-0778 and CVE-2018-0781.


Microsoft Edge in Windows 10 Gold 1511 1607 1703 1709 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to how the scripting engine handles objects in memory aka \Scripting Engine Memory Corruption Vulnerability\. This CVE ID is unique from CVE-2018-0758 CVE-2018-0762 CVE-2018-0768 CVE-2018-0769 CVE-2018-0770 CVE-2018-0772 CVE-2018-0773 CVE-2018-0774 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 and CVE-2018-0778.

memory corruption
arbitrary code execution


Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user due to how the scripting engine handles objects in memory aka \Scripting Engine Memory Corruption Vulnerability\. This CVE ID is unique from CVE-2018-0758 CVE-2018-0762 CVE-2018-0769 CVE-2018-0770 CVE-2018-0772 CVE-2018-0773 CVE-2018-0774 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 CVE-2018-0778 and CVE-2018-0781.


Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user due to how the scripting engine handles objects in memory aka \Scripting Engine Memory Corruption Vulnerability\. This CVE ID is unique from CVE-2018-0758 CVE-2018-0762 CVE-2018-0768 CVE-2018-0769 CVE-2018-0770 CVE-2018-0772 CVE-2018-0773 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 CVE-2018-0778 and CVE-2018-0781.


Media Foundation in Microsoft Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 and 1607 and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site aka \Media Foundation Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Excel for Mac 2011 Excel 2016 for Mac and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 Office 2010 SP2 Word 2010 SP2 Word for Mac 2011 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 SP2 Office 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2010 SP2 Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 Office Web Apps Server 2013 SP1 and Office Online Server allow remote attackers to execute arbitrary code via a crafted RTF document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 Office 2010 SP2 Word 2010 SP2 Word for Mac 2011 Excel for Mac 2011 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Excel for Mac 2011 Excel 2016 for Mac Office Compatibility Pack SP3 and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Animation Manager in Microsoft Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 and 1607 and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site aka \Windows Animation Manager Memory Corruption Vulnerability.\


Microsoft Word 2007 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word for Mac 2011 Excel for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 Word Automation Services on SharePoint Server 2010 SP2 Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft PowerPoint 2010 SP2 PowerPoint Viewer and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps Server 2013 SP1 and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability \ a different vulnerability than CVE-2016-0022.


Microsoft Excel 2007 SP3 Excel 2010 SP2 Office Compatibility Pack SP3 Excel Services on SharePoint Server 2007 SP3 and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors aka \Scripting Engine Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 Office 2010 SP2 Word Automation Services on SharePoint Server 2010 SP2 and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Word 2016 for Mac Office Compatibility Pack SP3 and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Office 2013 SP1 2013 RT SP1 and 2016 allows remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Windows Journal in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal file aka \Windows Journal Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Office 2016 Word 2016 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 Word Automation Services on SharePoint Server 2010 SP2 Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 Office Web Apps Server 2013 SP1 and Office Online Server allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 Office 2010 SP2 Office 2013 SP1 Office 2013 RT SP1 Office 2016 Excel for Mac 2011 PowerPoint for Mac 2011 Word for Mac 2011 Excel 2016 for Mac PowerPoint 2016 for Mac Word 2016 for Mac and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


The

font

library

in

Microsoft

Windows

Vista

Windows

Server

and

Windows

Windows

Windows

Server

Gold

and

Windows

RT

Windows

Gold

and

Office

and

Word

Viewer;

.NET

Framework

and

Skype

for

Business

Lync

Lync

Attendee;

Lync

and

Live

Meeting

Console

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

embedded

font

aka

\Graphics

Memory

Corruption

Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2010 SP2 Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


The Imaging Component in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document aka \Windows Imaging Component Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps Server 2013 SP1 and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2010 SP2 Word for Mac 2011 and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines as used in Internet Explorer 8 through 11 and other products allow remote attackers to execute arbitrary code via a crafted web site aka \Scripting Engine Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Excel for Mac 2011 Excel 2016 for Mac Office Compatibility Pack SP3 Excel Viewer Excel Services on SharePoint Server 2007 SP3 Excel Services on SharePoint Server 2010 SP2 Excel Services on SharePoint Server 2013 SP1 and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1 Office Web Apps 2010 SP2 and Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Windows Journal in Microsoft Windows Vista SP2 Windows 7 SP1 Windows 8.1 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal (aka .jnt) file aka \Windows Journal Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps Server 2013 SP1 and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability \ a different vulnerability than CVE-2016-0052.


Microsoft Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Word for Mac 2011 Word 2016 for Mac Word Automation Services on SharePoint Server 2010 SP2 and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Outlook 2010 SP2 2013 SP1 2013 RT SP1 and 2016 allows remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 Office 2010 SP2 Office 2013 SP1 Office 2013 RT SP1 Office 2016 Word for Mac 2011 Word 2016 for Mac Word Viewer Word Automation Services on SharePoint Server 2010 SP2 SharePoint Server 2013 SP1 Excel Automation Services on SharePoint Server 2013 SP1 Word Automation Services on SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 Excel Viewer Excel Services on SharePoint Server 2007 SP3 Excel Services on SharePoint Server 2010 SP2 Excel Automation Services on SharePoint Server 2013 SP1 and Office Online Server allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability \ a different vulnerability than CVE-2016-3365.


StringBuilder in Microsoft Silverlight 5 before 5.1.50709.0 does not properly allocate memory for string-insert and string-append operations which allows remote attackers to execute arbitrary code via a crafted web site aka \Microsoft Silverlight Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 and Excel Viewer allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability \ a different vulnerability than CVE-2016-3381.


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Excel for Mac 2011 Excel 2016 for Mac Office Compatibility Pack SP3 and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 Excel Viewer Excel Services on SharePoint Server 2007 SP3 Excel Services on SharePoint Server 2010 SP2 Excel Automation Services on SharePoint Server 2013 SP1 and Office Online Server allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability \ a different vulnerability than CVE-2016-3362.


Microsoft Excel 2010 SP2 allows remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability.\


The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site aka \Scripting Engine Memory Corruption Vulnerability.\


Microsoft Office 2010 SP2 Word 2007 SP3 Word 2010 SP2 Word for Mac 2011 Word 2016 for Mac and Word Viewer allow remote attackers to execute arbitrary code via a crafted file aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word 2013 SP1 Word 2013 RT SP1 Word 2016 Word for Mac 2011 Word 2016 for Mac Office Compatibility Pack SP3 Word Viewer Word Automation Services on SharePoint Server 2010 SP2 Word Automation Services on SharePoint Server 2013 SP1 SharePoint Server 2016 Office Web Apps 2010 SP2 Office Web Apps Server 2013 SP1 and Office Online Server allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Excel 2016 for Mac Office Compatibility Pack SP3 Excel Viewer Excel Services on SharePoint Server 2007 SP3 Excel Services on SharePoint Server 2010 SP2 Excel Automation Services on SharePoint Server 2013 SP1 and Office Online Server allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word 2013 SP1 2013 RT SP1 2016 and 2016 for Mac allow remote attackers to execute arbitrary code via a crafted file aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Word Viewer allows remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel 2013 SP1 Excel 2013 RT SP1 Excel 2016 Office Compatibility Pack SP3 and Excel Viewer allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability \ a different vulnerability than CVE-2016-3363.


Microsoft Visio 2016 allows remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft PowerPoint 2007 SP3 PowerPoint 2010 SP2 PowerPoint 2013 SP1 PowerPoint 2013 RT SP1 PowerPoint 2016 for Mac Office Compatibility Pack SP3 PowerPoint Viewer SharePoint Server 2013 SP1 Office Web Apps 2010 SP2 and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability.\


Internet Explorer 5.01 5.5 and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function which allows remote attackers to execute arbitrary code aka the \DHTML Method Heap Memory Corruption Vulnerability.\


Unknown vulnerability in Internet Explorer 5.0 5.5 and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption aka \JPEG Image Rendering Memory Corruption Vulnerability\.


Microsoft Office Word 2000 SP3 2002 SP3 2003 SP3 and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Word document that contains a malformed value which triggers memory corruption aka \Word Memory Corruption Vulnerability.\


Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption aka \Parameter Validation Memory Corruption Vulnerability.\


Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption related to a WebDAV request for a file with a long name aka \HTML Objects Memory Corruption Vulnerability.\


Microsoft Internet Explorer 7 sometimes attempts to access a deleted object which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption aka \Uninitialized Memory Corruption Vulnerability.\


The FlexGrid ActiveX control in Microsoft Visual Basic 6.0 Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 Office FrontPage 2002 SP3 and Office Project 2003 SP3 does not properly handle errors during access to incorrectly initialized objects which allows remote attackers to execute arbitrary code via a crafted HTML document related to corruption of the \system state \ aka \FlexGrid Control Memory Corruption Vulnerability.\


Array index vulnerability in Microsoft Office Excel 2000 SP3 2002 SP3 and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Excel spreadsheet with a NAME record that contains an invalid index value which triggers stack corruption aka \Excel Global Array Memory Corruption Vulnerability.\


The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects which allows remote attackers to execute arbitrary code via a crafted HTML document related to corruption of the \system state \ aka \DataGrid Control Memory Corruption Vulnerability.\


The Charts ActiveX control in Microsoft Visual Basic 6.0 Visual Studio .NET 2002 SP1 and 2003 SP1 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects which allows remote attackers to execute arbitrary code via a crafted HTML document related to corruption of the \system state \ aka \Charts Control Memory Corruption Vulnerability.\


Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB) which bypasses an initialization step and triggers an \arbitrary free \ aka \Word Memory Corruption Vulnerability.\


gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 Server 2008 Office XP SP3 Office 2003 SP2 and SP3 2007 Microsoft Office System Gold and SP1 Visio 2002 SP2 PowerPoint Viewer 2003 Works 8 Digital Image Suite 2006 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 Report Viewer 2005 SP1 and 2008 and Forefront Client Security 1.0 does not properly perform memory allocation which allows remote attackers to execute arbitrary code via a malformed EMF image file aka \GDI+ EMF Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted which allows remote attackers to execute arbitrary code via a crafted HTML document aka \Uninitialized Memory Corruption Vulnerability.\


Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory which allows remote attackers to execute arbitrary code via a crafted HTML document aka \HTML Objects Memory Corruption Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1 6 SP2 and and 7 allows remote attackers to execute arbitrary code by assigning malformed values to certain properties as demonstrated using the by property of an animateMotion SVG element aka \Property Memory Corruption Vulnerability.\


Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code via an Excel document with malformed cell comments that trigger memory corruption from an \allocation error \ aka \Microsoft Office Cell Parsing Memory Corruption Vulnerability.\


Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01 6 SP1 and SP2 and 7 allows remote attackers to execute arbitrary code via a crafted image aka \Argument Handling Memory Corruption Vulnerability.\


Unspecified vulnerability in Microsoft Office 2000 SP3 XP SP3 2003 SP2 Excel Viewer 2003 up to SP3 and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption from an \allocation error \ aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Excel 2003 SP3 and Office 2004 for Mac do not properly handle objects in memory which allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet aka \Record Memory Corruption Vulnerability.\


ENCDEC.DLL in Windows Media Player and Media Center in Microsoft Windows XP SP2 and SP3 Windows Vista SP2 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted .dvr-ms file aka \Windows Media Player DVR-MS Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \Drag and Drop Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \Style Object Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \Selection Object Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \Link Properties Handling Memory Corruption Vulnerability.\


The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \Time Element Memory Corruption Vulnerability.\


Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \Layout Memory Corruption Vulnerability.\


Microsoft Internet Explorer 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \DOM Manipulation Memory Corruption Vulnerability.\


The Vector Markup Language (VML) implementation in vgx.dll in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \VML Memory Corruption Vulnerability.\


Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \HTTP Redirect Memory Corruption Vulnerability.\


Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \XSLT Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 7 and 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011 aka \Object Management Memory Corruption Vulnerability.\


The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate fields in DFS responses which allows remote DFS servers to execute arbitrary code via a crafted response aka \DFS Memory Corruption Vulnerability.\


The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests aka \TMG Firewall Client Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted aka \DOM Modification Memory Corruption Vulnerability.\


Microsoft Internet Explorer 6 7 and 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted leading to memory corruption related to a \dangling pointer \ aka \Uninitialized Memory Corruption Vulnerability \ a different vulnerability than CVE-2010-2556 and CVE-2011-0035.


Microsoft Internet Explorer 6 7 and 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted leading to memory corruption aka \Uninitialized Memory Corruption Vulnerability \ a different vulnerability than CVE-2010-2556 and CVE-2011-0036.


ELEMENTS.DLL in Microsoft Visio 2002 SP2 2003 SP3 and 2007 SP2 does not properly parse structures during the opening of a Visio file which allows remote attackers to execute arbitrary code via a file containing a malformed structure aka \Visio Data Type Memory Corruption Vulnerability.\


The LZW stream decompression functionality in ORMELEMS.DLL in Microsoft Visio 2002 SP2 2003 SP3 and 2007 SP2 allows remote attackers to execute arbitrary code via a Visio file with a malformed VisioDocument stream that triggers an exception handler that accesses an object that has not been fully initialized which triggers memory corruption aka \Visio Object Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 2010 SP2 2013 SP1 and 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted file aka \Graphics Component Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 2010 SP2 2013 SP1 2013 RT SP1 and 2016 Word 2016 for Mac and Word Viewer allow remote attackers to execute arbitrary code via a crafted file aka \Microsoft Office Memory Corruption Vulnerability.\


Unspecified vulnerability in Microsoft Word 2000 SP3 Word 2002 SP3 and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string in a Word file aka \Word Memory Corruption Vulnerability.\


Unspecified vulnerability in Microsoft Internet Explorer 5.01 6 SP1 and SP2 and 7 allows remote attackers to execute arbitrary code via crafted HTML layout combinations aka \HTML Rendering Memory Corruption Vulnerability.\


Unspecified vulnerability in Microsoft Office Publisher 2000 2002 and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file aka \Publisher Memory Corruption Vulnerability.\


Microsoft Windows Vista SP2 and Server 2008 SP2 allow remote authenticated users to execute arbitrary code via a crafted string in a Server Message Block (SMB) server error-logging action aka \Server Message Block Memory Corruption Vulnerability.\


An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

memory corruption
arbitrary code execution
command injection


A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6.1 tvOS 13.2 iOS 13.2 and iPadOS 13.2. An application may be able to execute arbitrary code with kernel privileges.

memory corruption
arbitrary code execution
dos


A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. A malicious application may be able to execute arbitrary code with kernel privileges.


The RPC client implementation in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly allocate memory during the parsing of responses which allows remote RPC servers and man-in-the-middle attackers to execute arbitrary code via a malformed response aka \RPC Memory Corruption Vulnerability.\

memory corruption
arbitrary code execution
man in the middle


Race condition in Microsoft Internet Explorer 5.01 SP4 6 6 SP1 and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption aka \Race Condition Memory Corruption Vulnerability.\

memory corruption vulnerability
race condition
memory corruption
arbitrary code execution


Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01 5.5 and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail aka \DHTML Object Memory Corruption Vulnerability\.


Microsoft InfoPath 2007 SP3 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Ghostscript 8.64 8.70 and possibly other versions allows context-dependent attackers to execute arbitrary code via a PostScript file containing unlimited recursive procedure invocations which trigger memory corruption in the stack of the interpreter.


In serviceDied of HalDeathHandlerHidl.cpp there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege in the audio server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-116665972


In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9 Android ID: A-120445479


In GateKeeper::MintAuthToken of gatekeeper.cpp in Android 7.1.1 7.1.2 8.0 8.1 and 9 there is possible memory corruption due to a double free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.


In setCpuVulkanInUse of GpuStats.cpp there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141003796


LIBSNDFILE.DLL as used by AOL Nullsoft Winamp 5.33 and possibly other products allows remote attackers to execute arbitrary code via a crafted .MAT file that contains a value that is used as an offset which triggers memory corruption.


Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.


WebKit in Apple Mac OS X 10.3.9 10.4.9 and later and iPhone before 1.0.1 performs an \invalid type conversion\ which allows remote attackers to execute arbitrary code via unspecified frame sets that trigger memory corruption.


Array index error in Microsoft Word 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Word document that triggers memory corruption aka \Word Index Vulnerability.\


A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8775.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5 Security Update 2019-003 High Sierra Security Update 2019-003 Sierra watchOS 5.2 macOS Mojave 10.14.4 Security Update 2019-002 High Sierra Security Update 2019-002 Sierra iOS 12.2. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.2 Security Update 2019-002 Mojave and Security Update 2019-007 High Sierra. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6 iOS 13. An application may be able to execute arbitrary code with kernel privileges.


A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4 Security Update 2019-002 High Sierra Security Update 2019-002 Sierra. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 macOS Catalina 10.15 iOS 13. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.5 Security Update 2019-003 High Sierra Security Update 2019-003 Sierra macOS Mojave 10.14.4 Security Update 2019-002 High Sierra Security Update 2019-002 Sierra. An application may be able to execute arbitrary code with system privileges.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13581.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14912.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TVS files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13697.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of 3DS files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14736.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15392.


The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).


This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13304.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13307.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12438.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave. An attacker in a privileged network position may be able to execute arbitrary code.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.5 Security Update 2021-004 Catalina Security Update 2021-005 Mojave. An application may be able to execute arbitrary code with kernel privileges.


Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1 as used in poppler teTeX KDE KOffice CUPS and other products allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.


Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via a crafted movie file that triggers memory corruption.


Kodak Image Viewer in Microsoft Windows 2000 SP4 and in some cases XP SP2 and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via crafted image files that trigger memory corruption as demonstrated by a certain .tif (TIFF) file.


Microsoft Excel in Office 2000 SP3 Office XP SP3 Office 2003 SP2 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a Workspace with a certain index value that triggers memory corruption.


The array_user_key_compare function in PHP 4.4.6 and earlier and 5.x up to 5.2.1 makes erroneous calls to zval_dtor which triggers memory corruption and allows local users to bypass safe_mode and execute arbitrary code via a certain unset operation after array_user_key_compare has been called.


The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in IN_MOD.DLL in AOL Nullsoft Winamp 5.33 allows remote attackers to execute arbitrary code via a crafted (1) .IT or (2) .S3M file containing integer values that are used as memory offsets which triggers memory corruption.


Unspecified vulnerability in MSO.dll in Microsoft Office 2000 SP3 2002 SP3 2003 SP2 2004 for Mac and 2007 allows user-assisted remote attackers to execute arbitrary code via a malformed drawing object which triggers memory corruption.


Unspecified vulnerability in Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 2003 Viewer 2004 for Mac and 2007 allows user-assisted remote attackers to execute arbitrary code via a crafted set font value in an Excel file which results in memory corruption.


Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to DataSource that trigger memory corruption aka \Office Web Components DataSource Vulnerability.\


Mozilla Firefox 1.5.0.9 and 2.0.0.1 and SeaMonkey before 1.0.8 allow remote attackers to execute arbitrary code via JavaScript onUnload handlers that modify the structure of a document wich triggers memory corruption due to the lack of a finalize hook on DOM window objects.


Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 2003 Viewer and 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted AutoFilter filter record in an Excel BIFF8 format XLS file which triggers memory corruption.


chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file which triggers memory corruption.


Unspecified vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2 Windows Server 2003 SP1 or SP2 or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects which results in memory corruption aka the first of two \HTML Objects Memory Corruption Vulnerabilities\ and a different issue than CVE-2007-0947.


Microsoft Internet Explorer 5.01 and 6 allows remote attackers to execute arbitrary code by instantiating certain COM objects from Urlmon.dll which triggers memory corruption during a call to the IObjectSafety function.


Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 allows remote attackers to execute arbitrary code via a crafted ASF_File_Properties_Object size field in a WMV file which triggers memory corruption.


Microsoft Word in Office 2000 SP3 XP SP3 Office 2003 SP2 Works Suite 2004 to 2006 and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a Word file with a malformed drawing object which leads to memory corruption.


Unspecified vulnerability in Internet Explorer 5.01 and 6 SP1 allows remote attackers to execute arbitrary code via crafted Cascading Style Sheets (CSS) strings that trigger memory corruption during parsing related to use of out-of-bounds pointers.


Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2 Windows Server 2003 SP1 or SP2 or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects resulting in accessing deallocated memory of CMarkup objects aka the second of two \HTML Objects Memory Corruption Vulnerabilities\ and a different issue than CVE-2007-0946.


Unspecified vulnerability in diskimages-helper in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote user-assisted attackers to execute arbitrary code via a crafted compressed disk image that triggers memory corruption.


The OLE Dialog component in Microsoft Windows 2000 SP4 XP SP2 and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption.


fsck as used by the AirPort Disk feature of the AirPort Extreme Base Station with 802.11n before Firmware Update 7.1 and by Apple Mac OS X 10.3.9 through 10.4.9 does not properly enforce password protection of a USB hard drive which allows context-dependent attackers to list arbitrary directories or execute arbitrary code resulting from memory corruption.


Multiple unspecified vulnerabilities in Microsoft Visio 2002 allow remote user-assisted attackers to execute arbitrary code via a Visio (.VSD VSS .VST) file with a crafted packed object that triggers memory corruption aka \Visio Document Packaging Vulnerability.\


Microsoft Excel 2000 SP3 2002 SP3 2003 SP2 2004 for Mac and v.X for Mac allows remote attackers to execute arbitrary code via malformed IMDATA records that trigger memory corruption.


Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list which triggers memory corruption.


VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22 4.0.x before 4.0.24 4.1.x before 4.1.32 4.2.x before 4.2.24 and 4.3.x before 4.3.8 when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.


Microsoft Office XP SP3 Office 2003 SP3 Office 2007 SP2 Office 2010 Office 2004 and 2008 for Mac Office for Mac 2011 and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption aka \Drawing Exception Handling Vulnerability.\


Microsoft Word 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted Word document containing bookmarks that trigger use of an invalid pointer and memory corruption aka \Word Bookmarks Vulnerability.\


Microsoft Office XP SP3 Office 2003 SP3 Office 2007 SP2 Office 2010 Office 2004 and 2008 for Mac Office for Mac 2011 and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Office document containing an Office Art Drawing record with crafted msofbtSp records and unspecified flags which triggers memory corruption aka \Office Art Drawing Records Vulnerability.\


Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle unspecified return values during parsing of a Word document which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption aka \Word Return Value Vulnerability.\


The JIT compiler in Microsoft .NET Framework 4.0 on 64-bit platforms does not properly perform optimizations which allows remote attackers to execute arbitrary code via a crafted .NET application that triggers memory corruption aka \.NET Framework x64 JIT Compiler Vulnerability.\


Microsoft Office XP SP3 Office 2004 and 2008 for Mac Office for Mac 2011 and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption aka \MSO Large SPID Read AV Vulnerability.\


Array index vulnerability in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via a crafted Word document that triggers memory corruption aka \Word Index Parsing Vulnerability.\


Microsoft Word 2002 SP3 and 2003 SP3 Office 2004 for Mac and Word Viewer do not properly handle a malformed record during parsing of a Word document which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption aka \Word Parsing Vulnerability.\


Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11 Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10 and SeaMonkey 2.x before 2.0.10 when JavaScript is enabled allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended the appendChild method incorrect index tracking and the creation of multiple frames which triggers memory corruption as exploited in the wild in October 2010 by the Belmoo malware.


Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle an uninitialized pointer during parsing of a Word document which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption aka \Word Uninitialized Pointer Vulnerability.\


Adobe Reader and Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X allow attackers to execute arbitrary code via a PDF file with crafted Flash content involving the (1) pushstring (0x2C) operator (2) debugfile (0xF1) operator and an \invalid pointer vulnerability\ that triggers memory corruption a different vulnerability than CVE-2010-1285 and CVE-2010-2168.


Unspecified vulnerability in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to execute arbitrary code via unknown vectors that trigger memory corruption. NOTE: due to conflicting information and use of the same CVE identifier by the vendor ZDI and TippingPoint it is not clear whether this issue is related to use of an uninitialized pointer an incorrect pointer offset calculation or both.


Array index error in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher 97 file aka \Memory Corruption Due To Invalid Index Into Array in Pubconv.dll Vulnerability.\


Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly check an unspecified boundary during parsing of a Word document which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption aka \Word Boundary Check Vulnerability.\


Adobe Reader and Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X allow attackers to execute arbitrary code via a PDF file with crafted Flash content involving the newfunction (0x44) operator and an \invalid pointer vulnerability\ that triggers memory corruption a different vulnerability than CVE-2010-1285 and CVE-2010-2201.


Use-after-free vulnerability in Adobe Flash Player 6.0.79 as distributed in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code by unloading a Flash object that is currently being accessed by a script leading to memory corruption aka a \Movie Unloading Vulnerability.\


Adobe Reader and Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X allow attackers to execute arbitrary code via unspecified manipulations involving the newclass (0x58) operator and an \invalid pointer vulnerability\ that triggers memory corruption a different vulnerability than CVE-2010-2168 and CVE-2010-2201.


The SpreadSheet Lotus 123 reader (wkssr.dll) in Autonomy KeyView 10.4 and 10.9 as used in multiple IBM Symantec and other products allows remote attackers to execute arbitrary code via unspecified vectors related to allocation of an array of pointers and \string indexing \ which triggers memory corruption.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15105.


Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file which may allow an attacker to execute arbitrary code.


Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code obtain GPS coordinates or enable the microphone via an SMS message that triggers memory corruption as demonstrated by Charlie Miller at SyScan '09 Singapore.


The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404 VMware Workstation 6.5.x before 6.5.3 build 185404 VMware Player 2.5.x before 2.5.3 build 185404 and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.


Adobe Flash Player 10.x before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.


Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream which triggers an integer sign extension that bypasses a sanity check leading to memory corruption.


Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption related to an \invalid string length vulnerability.\ NOTE: some of these details are obtained from third party information.


Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.


Microsoft Office PowerPoint 2000 SP3 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format leading to memory corruption aka \Legacy File Format Vulnerability \ a different vulnerability than CVE-2009-0222 CVE-2009-0223 CVE-2009-0226 and CVE-2009-0227.


Adobe Acrobat Reader 9 before 9.1 8 before 8.1.4 and 7 before 7.1.1 might allow remote attackers to trigger memory corruption and possibly execute arbitrary code via unknown attack vectors related to JBIG2 a different vulnerability than CVE-2009-0193 and CVE-2009-1061.


The JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3 Adobe Reader 8 and Acrobat 8 before 8.1.6 and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.


Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.


Microsoft Office PowerPoint 2000 SP3 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format leading to a \pointer overwrite\ and memory corruption aka \Legacy File Format Vulnerability \ a different vulnerability than CVE-2009-0223 CVE-2009-0226 CVE-2009-0227 and CVE-2009-1137.


Array index error in the insertItemBefore method in WebKit as used in Apple Safari before 3.2.3 and 4 Public Beta iPhone OS 1.0 through 2.2.1 iPhone OS for iPod touch 1.1 through 2.2.1 Google Chrome Stable before 1.0.154.65 and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList (2) SVGStringList (3) SVGNumberList (4) SVGPathSegList (5) SVGPointList or (6) SVGLengthList SVGList object which triggers memory corruption.


Microsoft Office Publisher 2007 SP1 does not properly calculate object handler data for Publisher files which allows remote attackers to execute arbitrary code via a crafted file in a legacy format that triggers memory corruption aka \Pointer Dereference Vulnerability.\


Microsoft Office PowerPoint 2000 SP3 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format leading to memory corruption aka \Legacy File Format Vulnerability \ a different vulnerability than CVE-2009-0222 CVE-2009-0226 CVE-2009-0227 and CVE-2009-1137.


The TCP reassembly functionality in libnids before 1.18 allows remote attackers to cause \memory corruption\ and possibly execute arbitrary code via \overlarge TCP packets.\


The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command (\bodyp\) that is treated as a different command (\body.peek\) and causes an index increment error that leads to an out-of-bounds memory corruption.


The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) \bodyp\ (2) \binaryp\ or (3) \binaryp\) that cause an index increment error that leads to an out-of-bounds memory corruption.


Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary code and escalate privileges to resources normally reserved for the kernel on vulnerable installations by exploiting tmwfp.sys. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.


A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted Filmbox document which triggers memory corruption.


Unspecified vulnerability in the Centrino (1) w22n50.sys (2) w22n51.sys (3) w29n50.sys and (4) w29n51.sys Microsoft Windows drivers for Intel 2200BG and 2915ABG PRO/Wireless Network Connection before 10.5 with driver 9.0.4.16 allows remote attackers to execute arbitrary code via certain frames that trigger memory corruption.


Unspecified vulnerability in mso.dll in Microsoft Office 2000 XP and 2003 and Microsoft PowerPoint 2000 XP and 2003 allows remote user-assisted attackers to execute arbitrary code via a malformed record in a (1) .DOC (2) .PPT or (3) .XLS file that triggers memory corruption related to an \array boundary condition\ (possibly an array index overflow) a different vulnerability than CVE-2006-3434 CVE-2006-3650 and CVE-2006-3868.


Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.


Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2 Office XP SP3 Office 2000 SP3 and other products allows user-assisted attackers to execute arbitrary code via an Office file with a malformed property that triggers memory corruption related to record lengths aka \Microsoft Office Property Vulnerability \ a different vulnerability than CVE-2006-1316.


Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via \exceptional conditions\ that trigger memory corruption as demonstrated using an exception handler and nested object tags a variant of CVE-2006-1992.


Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3 Office XP SP3 Office 2003 SP1 and SP2 Office 2004 for Mac and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record which triggers memory corruption.


Mozilla Firefox 1.5 Thunderbird 1.5 if Javascript is enabled in mail and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects which leads to memory corruption.


Unspecified vulnerability in Microsoft Excel 2000 2002 and 2003 in Microsoft Office 2000 SP3 and other packages allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption probably involving invalid pointers.


Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2 Office XP SP3 Office 2000 SP3 and other products allows user-assisted attackers to execute arbitrary code via an Office file with malformed string that triggers memory corruption related to record lengths aka \Microsoft Office Parsing Vulnerability \ a different vulnerability than CVE-2006-2389.


Microsoft JScript 5.1 5.5 and 5.6 on Windows 2000 SP4 and 5.6 on Windows XP Server 2003 Windows 98 and Windows Me will \release objects early\ in certain cases which results in memory corruption and allows remote attackers to execute arbitrary code.


Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag which leads to memory corruption.


Multiple

unspecified

vulnerabilities

in

Microsoft

Internet

Explorer

and

and

earlier

allow

remote

attackers

to

execute

arbitrary

code

by

instantiating

certain

COM

objects

from

as

ActiveX

controls

including

and

which

causes

memory

corruption

during

garbage

collection.


The RichEdit component in Microsoft Windows 2000 SP4 XP SP2 and 2003 SP1; Office 2000 SP3 XP SP3 2003 SP2 and Office 2004 for Mac; and Learning Essentials for Microsoft Office 1.0 1.1 and 1.5 allows user-assisted remote attackers to execute arbitrary code via a malformed OLE object in an RTF file which triggers memory corruption.


Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted LABEL record that triggers memory corruption.


Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted SELECTION record that triggers memory corruption a different vulnerability than CVE-2006-1302.


Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll (2) Mdt2dd.dll and (3) Mdt2gddo.dll COM objects as ActiveX controls which leads to memory corruption.


Unspecified vulnerability in Microsoft Word 2000 and 2002 Office Word and Word Viewer 2003 Word 2004 and 2004 v. X for Mac and Works 2004 2005 and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption a different vulnerability than CVE-2006-6456.


Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows when accessed by Internet Explorer allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption a different vulnerability than CVE-2006-4685. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in Microsoft Word 2000 2002 and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption as demonstrated via the 12122006-djtest.doc file a different issue than CVE-2006-5994 and CVE-2006-6456.


The qcamvc_video_init function in qcamvc.c in De Marchi Daniele QuickCam VC Linux device driver (aka quickcam-vc) 1.0.9 and earlier does not properly check a boundary triggering memory corruption which might allow attackers to execute arbitrary code via a crafted QuickCam object.


Mozilla Firefox 2.x before 2.0.0.1 1.5.x before 1.5.0.9 and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document which triggers memory corruption.


The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image which triggers memory corruption aka \out-of heap-based buffer write.\


Microsoft Excel 2003 SP3 and Office 2008 for Mac do not properly handle memory during the opening of files which allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel Memory Corruption Using Various Modified Bytes Vulnerability.\


Microsoft Excel 2003 SP3 2007 SP2 and SP3 and 2010 Gold and SP1; Office 2008 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 do not properly handle memory during the opening of files which allows remote attackers to execute arbitrary code via a crafted spreadsheet aka \Excel File Format Memory Corruption in OBJECTLINK Record Vulnerability.\


Potential memory corruption in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059) 10.18.x.5057 (aka 15.36.x.5057) 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables a privileged user to execute arbitrary code via local access.


An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'show' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'show <node_name>' function and cause memory corruption. Furthermore it is possible to redirect the flow of the program and execute arbitrary code.


An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'staticGet' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'staticGet <node_name attr>' function and cause memory corruption. Furthermore it is possible to redirect the flow of the program and execute arbitrary code.


An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'read' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'read <node_name>' function and cause memory corruption. Furthermore it is possible to redirect the flow of the program and execute arbitrary code.


An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'commit' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'commit <node_name>' function and cause memory corruption. Furthermore it is possible to redirect the flow of the program and execute arbitrary code.


An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as an 'unset' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'unset <node_name>' function and cause memory corruption. Furthermore it is possible to redirect the flow of the program and execute arbitrary code.


An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'get <node_name attr>' function and cause memory corruption. Furthermore it is possible to redirect the flow of the program and execute arbitrary code.


This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within PdfEncoding::ParseToUnicode. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5673.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1. A malicious application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CR2 files. The issue results from the lack of proper validation of user-supplied data which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11230.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175647.


IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183320.


IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially crafted file a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 178244.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system caused by a memory corruption error. By persuading a victim to open a specially-crafted document a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 176266


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially crafted file a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 180167.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175637.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system caused by memory corruption. By persuading a victim to open a specially-crafted document a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 181723.


IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 187868.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175648.


IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183321.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175644.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system caused by a memory corruption error. By persuading a victim to open a specially-crafted document a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 176270.


IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 187873.


IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183317.


IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183319.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175646.


IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 187870.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system caused by memory corruption. By persuading a victim to open a specially-crafted document a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 181721.


IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183318.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175649.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175635.


IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183322.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system caused by a memory corruption. By persuading a victim to open a specially-crafted file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 175645.


IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system caused by a memory corruption error. By persuading a victim to open a specially-crafted document a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. IBM X-Force ID: 176269.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3 Security Update 2020-001 Mojave Security Update 2020-001 High Sierra. An application may be able to execute arbitrary code with system privileges.


The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause \memory corruption\ and execute arbitrary code via a crafted FSG 1.33 file.


Unspecified vulnerability in Microsoft Excel 2000 2002 and 2003 in Microsoft Office 2000 SP3 and other packages allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range which could lead to memory corruption involving an argument to the msvcrt.memmove function aka \Brand new Microsoft Excel Vulnerability \ as originally placed for sale on eBay as item number 7203336538.


Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier might allow remote attackers to execute arbitrary code via a crafted GIF file that triggers memory corruption during display of the splash screen possibly related to splashscreen.dll.


Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed object which triggers memory corruption during the loading of records from this spreadsheet aka \File Format Parsing Vulnerability.\


Double free vulnerability in Microsoft Office Word 2000 SP3 2002 SP3 2003 SP3 and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted (1) RTF file or (2) rich text e-mail message with multiple consecutive Drawing Object (\\\do\) tags which triggers a \memory calculation error\ and memory corruption aka \Word RTF Object Parsing Vulnerability.\


Microsoft Office Word 2000 SP3 2002 SP3 2003 SP3 and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a malformed string in (1) an RTF file or (2) a rich text e-mail message which triggers incorrect memory allocation and memory corruption aka \Word RTF Object Parsing Vulnerability.\


Adobe Reader and Acrobat 8.1.2 and earlier and before 7.1.1 allow remote attackers to execute arbitrary code via a crafted PDF document that (1) performs unspecified actions on a Collab object that trigger memory corruption related to a GetCosObj method; or (2) contains a malformed PDF object that triggers memory corruption during parsing.


Microsoft Office Word 2000 SP3 2002 SP3 2003 SP3 and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats Gold and SP1 allow remote attackers to execute arbitrary code via crafted control words in (1) an RTF file or (2) a rich text e-mail message which triggers incorrect memory allocation and memory corruption aka \Word RTF Object Parsing Vulnerability \ a different vulnerability than CVE-2008-4028.


The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4 XP SP2 and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted (1) .doc (2) .wri or (3) .rtf Word 97 file that triggers memory corruption as exploited in the wild in December 2008. NOTE: As of 20081210 it is unclear whether this vulnerability is related to a WordPad issue disclosed on 20080925 with a 2008-crash.doc.rar example but there are insufficient details to be sure.


The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to execute arbitrary code via long strings in the two arguments to the DownloadImageFileURL method which trigger memory corruption. NOTE: some of these details are obtained from third party information.


The ActiveX Control (yNotifier.dll) in Yahoo! Assistant 3.6 and earlier allows remote attackers to execute arbitrary code via unspecified vectors in the Ynoifier COM object that trigger memory corruption.


Unspecified vulnerability in the Load method in the IPersistStreamInit interface in the Active Template Library (ATL) as used in the Microsoft Video ActiveX control in msvidctl.dll in DirectShow in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via unknown vectors that trigger memory corruption aka \ATL Header Memcopy Vulnerability \ a different vulnerability than CVE-2008-0015.


Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3 2003 SP2 and SP3 and 2007 SP1 and earlier allows remote attackers to execute arbitrary code via a Publisher file with crafted object header data that triggers memory corruption aka \Publisher Object Handler Validation Vulnerability.\


Word in Microsoft Office 2000 SP3 XP SP3 Office 2003 SP2 and Office Word Viewer 2003 allows remote attackers to execute arbitrary code via crafted fields within the File Information Block (FIB) of a Word file which triggers length calculation errors and memory corruption.


A \memory calculation error\ in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with an invalid picture index that triggers memory corruption aka \Memory Calculation Vulnerability.\


The HxTocCtrl ActiveX control (hxvz.dll) as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 in Windows XP SP2 Server 2003 SP1 and SP2 Vista SP1 and Server 2008 allows remote attackers to execute arbitrary code via malformed arguments which triggers memory corruption.


FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid \number of axes\ field in a Printer Font Binary (PFB) file which triggers a free of arbitrary memory locations leading to memory corruption.


Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3 2003 SP2 and SP3 and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via an HTML document with a large number of Cascading Style Sheets (CSS) selectors related to a \memory handling error\ that triggers memory corruption.


Unspecified vulnerability in the Apple Type Services (ATS) server in Apple Mac OS X 10.5 before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via a crafted embedded font in a PDF document related to memory corruption that occurs during printing.


Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers and user-assisted remote attackers to trigger memory corruption or possibly execute arbitrary code via an \ATTACH;VALUE=URI:S=osumi\ line in a .ics file which triggers a \resource liberation\ bug. NOTE: CVE-2008-2007 was originally used for this issue but this is the appropriate identifier.


Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4 6 through SP1 and 7 allows remote attackers to execute arbitrary code via a crafted data stream that triggers memory corruption as demonstrated using an invalid MIME-type that does not have a registered handler.


Apple QuickTime before 7.4.5 does not properly handle movie media tracks which allows remote attackers to execute arbitrary code via a crafted movie that triggers memory corruption.


A \memory calculation error\ in Microsoft Office PowerPoint 2000 SP3 2002 SP3 2003 SP2 and 2007 through SP1; Office Compatibility Pack for Word Excel and PowerPoint 2007 through SP1; and Office 2004 for Mac allows remote attackers to execute arbitrary code via a PowerPoint file with crafted list values that trigger memory corruption aka \Parsing Overflow Vulnerability.\


Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file which triggers memory corruption.


Unspecified vulnerability in the Open Database Connectivity (ODBC) component in 7T Interactive Graphical SCADA System (IGSS) before 9.0.0.11143 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 20222 which triggers memory corruption related to an \invalid structure being used.\


Microsoft PowerPoint 2002 SP3 2003 SP3 and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; and Office Compatibility Pack for Word Excel and PowerPoint 2007 File Formats SP2 make unspecified function calls during file parsing without proper handling of memory which allows remote attackers to execute arbitrary code via a crafted PowerPoint document aka \Presentation Memory Corruption RCE Vulnerability.\


The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method which triggers memory corruption as demonstrated by Gingerbreak.


The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/codec/subtitles/subsusf.c) in VideoLAN VLC Media Player 1.1 before 1.1.6-rc allows remote attackers to execute arbitrary code via a subtitle with an opening \<\ without a closing \>\ in an MKV file which triggers heap memory corruption as demonstrated using refined-australia-blu720p-sample.mkv.


The U3D component in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a 3D file with an invalid Parent Node count that triggers an incorrect size calculation and memory corruption a different vulnerability than CVE-2011-0590 CVE-2011-0591 CVE-2011-0592 CVE-2011-0593 and CVE-2011-0595.


Microsoft Office 2007 SP3 Office for Mac 2011 Office for Mac 2016 and Word Viewer allow remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Memory Corruption Vulnerability.\


Microsoft Office 2007 SP3 Office 2010 SP2 Office 2013 SP1 Office 2013 RT SP1 and Office 2016 allow remote attackers to execute arbitrary code via a crafted Office document aka \Microsoft Office Memory Corruption Vulnerability.\


Unspecified vulnerability in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a crafted image description atom in a movie file related to \memory corruption.\


Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error.


Unspecified vulnerability in Microsoft Excel 2002 SP3 and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file containing multiple active worksheets which results in memory corruption.


Unspecified vulnerability in Microsoft Agent (msagent\\agentsvr.exe) in Windows 2000 SP4 XP SP2 and Server 2003 2003 SP1 and 2003 SP2 allows remote attackers to execute arbitrary code via crafted URLs which result in memory corruption.


Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via a crafted Cascading Style Sheets (CSS) tag that triggers memory corruption.


Unspecified vulnerability in Microsoft Visio 2002 allows remote user-assisted attackers to execute arbitrary code via a Visio (.VSD VSS .VST) file with a crafted version number that triggers memory corruption.


Unspecified vulnerability in Microsoft Word 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Word document that triggers memory corruption aka \Word Parsing Vulnerability.\


Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 6 6 SP1 and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers memory corruption aka \Data Stream Header Corruption Vulnerability.\


Unspecified vulnerability in Microsoft Office 2000 XP 2003 2004 for Mac and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string that triggers memory corruption.


Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2 Office XP SP3 Office 2000 SP3 and other products allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when it is parsed.


Unspecified vulnerability in Microsoft Excel 2000 2002 and 2003 in Microsoft Office 2000 SP3 and other packages allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description which leads to memory corruption.


Unspecified vulnerability in Microsoft Excel 2000 2002 and 2003 in Microsoft Office 2000 SP3 and other packages allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic which leads to memory corruption.


Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.


Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2 Viewer 2003 and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via crafted Style records that trigger memory corruption.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15 iOS 13.1 and iPadOS 13.1 tvOS 13 macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 watchOS 6. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3 and iPadOS 13.3 watchOS 6.1.1 macOS Catalina 10.15.2 Security Update 2019-002 Mojave and Security Update 2019-007 High Sierra tvOS 13.3. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3 and iPadOS 13.3 watchOS 6.1.1 macOS Catalina 10.15.2 Security Update 2019-002 Mojave and Security Update 2019-007 High Sierra tvOS 13.3. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2 macOS Catalina 10.15.1 iTunes for Windows 12.10.2 iCloud for Windows 11.0 iCloud for Windows 7.15. An application may be able to execute arbitrary code with system privileges.


A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.3 and iPadOS 13.3 watchOS 6.1.1 macOS Catalina 10.15.2 Security Update 2019-002 Mojave and Security Update 2019-007 High Sierra tvOS 13.3. An application may be able to execute arbitrary code with kernel privileges.


A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A malicious application could execute arbitrary code leading to compromise of user information.


A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 iOS 14.8.1 and iPadOS 14.8.1 tvOS 15.1 watchOS 8.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. An application may be able to execute arbitrary code with kernel privileges.