Buffer overflow in _mprosrv in Progress Software OpenEdge before 9.1E0422 and 10.x before 10.1B01 allows remote attackers to have an unknown impact via a malformed TCP/IP message.


Buffer overflow in Help and Support Center before 4.4 C on HP Windows systems allows remote attackers to read or write arbitrary files via unknown vectors.


Buffer overflow in Hitachi Cosminexus V4 through V7 Processing Kit for XML before 20070511 Developer's Kit for Java before 20070312 and third-party products that use this software allows attackers to have an unknown impact via certain GIF images related to use of GIF image processing APIs by a Java application.


Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+ 9.2.0.7 and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12). NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.


Buffer overflow in MeCab before 0.96 has unknown impact and attack vectors.


Integer signedness error in the NE2000 emulator in QEMU 0.8.2 as used in Xen and possibly other products allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks aka QEMU NE2000 \receive\ integer signedness error. NOTE: this identifier was inadvertently used by some sources to cover multiple issues that were labeled \NE2000 network driver and the socket code \ but separate identifiers have been created for the individual vulnerabilities since there are sometimes different fixes; see CVE-2007-5729 and CVE-2007-5730.


Heap-based buffer overflow in the kernel in NetBSD 3.0 certain versions of FreeBSD and OpenBSD and possibly other BSD derived operating systems allows local users to have an unknown impact. NOTE: this information is based upon a vague pre-advisory with no actionable information. Details will be updated after 20070329.


Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4 XP SP2 and Server 2003 Gold and SP1 and Visual Studio .NET 2002 Gold and SP1 and 2003 Gold and SP1 allows user-assisted remote attackers to have an unknown impact (probably crash) via an RTF file with a malformed OLE object which results in writing two 0x00 characters past the end of szBuffer aka the \MFC42u.dll Off-by-Two Overflow.\ NOTE: this issue is due to an incomplete patch (MS07-012) for CVE-2007-0025.


The Window Image Acquisition (WIA) Service in Microsoft Windows XP SP2 allows local users to gain privileges via unspecified vectors involving an \unchecked buffer \ probably a buffer overflow.


Buffer overflow in swcons in IBM AIX 5.3 allows local users to gain privileges via long input data.


** DISPUTED ** Buffer overflow in the Windows NT Message Compiler (MC) 1.00.5239 on Microsoft Windows XP allows local users to gain privileges via a long MC-filename. NOTE: this issue has been disputed by a reliable third party who states that the compiler is not a privileged program so privilege boundaries cannot be crossed.


Buffer overflow in libvsapi.so in the VSAPI library in Trend Micro VirusWall 3.81 for Linux as used by IScan.BASE/vscan allows local users to gain privileges via a long command line argument a different vulnerability than CVE-2005-0533.


Unspecified vulnerability in Oracle Database 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors related to the Log Miner component and sys.dbms_log_mnr privileges aka DB04. NOTE: Oracle has not disputed a reliable researcher claim that this is a buffer overflow in the ADD_LOGFILE procedure for the SYS.DBMS_LOGMNR package that allows code execution.


Unspecified vulnerability in Oracle HTTP Server 9.0.1.5 Application Server 9.0.4.3 10.1.2.0.0 10.1.2.0.2 and 10.1.2.2; and Collaboration Suite 9.0.4.2 and 10.1.2; has unknown impact and attack vectors related to the Oracle Process Mgmt & Notification component aka OPMN01. NOTE: as of 20070123 Oracle has not disputed claims by a reliable researcher that OPMN01 is for a buffer overflow in Oracle Notification Service (ONS).


Multiple buffer overflows in (1) graphs.c (2) output.c and (3) preserve.c in AWFFull 3.7.1 and earlier have unknown impact and attack vectors. NOTE: some of these details are obtained from third party information. NOTE: There may not be any attack vector that crosses privilege boundaries.


Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 9.2.0.7 and 10.1.0.5 have unknown impact and attack vectors related to (1) the Advanced Queuing component and sys.dbms_aqsys.dbms_aq privileges (DB01) (2) Advanced Replication and sys.dbms_repcat_untrusted (DB07) and (3) Oracle Text and ctxload (DB15). NOTE: Oracle has not publicly claims by reliable researchers that DB01 is for SQL injection in the SYS.DBMS_AQ_INV package and DB07 is for a buffer overflow in the UNREGISTER_SNAPSHOT procedure in the DBMS_REPCAT_UNTRUSTED package.


Multiple unspecified vulnerabilities in Oracle Database 9.2.0.7 and 10.1.0.5 have unknown impact and attack vectors related to (1) Export and sys.dbms_logrep_util (DB08) and (2) Oracle Streams and sys.dbms_capture_adm_internal privileges (DB09). NOTE: Oracle has not disputed reliable researcher claims that DB08 is for a buffer overflow in the GET_OBJECT_NAME procedure in the DBMS_LOGREP_UTIL package and DB09 is for buffer overflows in the CREATE_CAPTURE ALTER_CAPTURE and ABORT_TABLE_INSTANTIATION procedures in SYS.DBMS_CAPTURE_ADM_INTERNAL.


Multiple stack-based buffer overflows in utilities/smb4k_*.cpp in Smb4K before 0.8.0 allow local users when present on the Smb4K sudoers list to gain privileges via unspecified vectors related to the args variable and unspecified other variables in conjunction with the sudo configuration.


Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to \SNMP IP addresses.\


Buffer overflow in drivers/video/fbcmap.c in the Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application aka Android internal bug 28410333 and Qualcomm internal bug CR556471.


Buffer overflow in mpg123 before 1.18.0.


Buffer

overflow

in

the

Qualcomm

components

in

Android

before

on

Nexus

and

devices

allows

attackers

to

gain

privileges

via

a

crafted

application

related

to

and

aka

Android

internal

bug

and

Qualcomm

internal

bug


Multiple

buffer

overflows

in

in

the

Qualcomm

components

in

Android

before

on

Nexus

and

devices

allow

attackers

to

gain

privileges

via

a

crafted

application

aka

Android

internal

bug

and

Qualcomm

internal

bug


Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file. NOTE: this issue was originally incorrectly mapped to CVE-2014-1004; see CVE-2014-1004 for more information.


Multiple buffer overflows in drivers/char/diag/diag_debugfs.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to gain privileges via a crafted application aka Android internal bug 28442449 and Qualcomm internal bug CR585147.


Buffer overflow in drivers/media/radio/radio-iris.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application aka Android internal bug 28769546 and Qualcomm internal bug CR552329.


Heap-based

buffer

overflow

in

in

the

Qualcomm

components

in

Android

before

on

Nexus

and

devices

allows

attackers

to

gain

privileges

via

a

crafted

application

aka

Android

internal

bug

and

Qualcomm

internal

bug


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800 in drmprov_cmd_verify_key() the variable feature_name_length is not validated. There is a check for feature_name_len + filePathLen but there might be an integer wrap when checking feature_name_len + filePathLen. This leads to a buffer overflow.


In TrustZone a buffer overflow vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9625 MDM9635M MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 425 SD 430 SD 615/16/SD 415 SD 625 SD 650/52 SD 808 SD 810 and SD 450 if a client or host sends more than 16k bytes of USB mass storage transfer a buffer overflow occurs.


Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2 4.9.x before 4.9.1 and before 5.0 allows attackers to have unspecified impact via a positive START argument to the \substring-index-ci procedures.\


In

Android

before

or

earlier

security

patch

level

on

Qualcomm

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

and

buffer

overflow

vulnerability

exist

in

Sahara

boot

when

program

header

are

parsing.


In exec.c in zsh before 5.0.7 there is a buffer overflow for very long fds in the \>& fd\ syntax.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205 A buffer overflow can potentially occur in any OpenCL application that calls clBuildProgram() with a device of type CL_DEVICE_TYPE_CPU in its device_list argument.


In utils.c in zsh before 5.0.6 there is a buffer overflow when scanning very long directory paths for symbolic links.


Dassault Systemes Catia V5-6R2013: Stack Buffer Overflow due to inadequate boundary checks


centurystar 7.12 ActiveX Control has a Stack Buffer Overflow


Multiple buffer overflows in PostgreSQL before 8.4.20 9.0.x before 9.0.16 9.1.x before 9.1.12 9.2.x before 9.2.7 and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors a different vulnerability than CVE-2014-0063.


Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux Adobe AIR before 15.0.0.356 Adobe AIR SDK before 15.0.0.356 and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to complete a transition from Low Integrity to Medium Integrity via unspecified vectors.


Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35 TLXCDSTOFS33 - 3.35 TLXCDLUOFS33 - 3.35 TLXCDLTOFS33 - 3.35 and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file.


Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2 cgminer before 4.3.5 and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.


Multiple stack-based buffer overflows in sgminer before 4.2.2 cgminer before 4.3.5 and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.


Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.


SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63 15.5 before ESD#5.4 and 15.0.3 before ESD#4.4 does not properly restrict access which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a crafted RPC message to the hacmpmsgxchg function and possibly other vectors.


Stack-based buffer overflow in dsmtca in the client in IBM Tivoli Storage Manager (TSM) 5.4 through 5.4.3.6 5.5 through 5.5.4.3 6.1 through 6.1.5.6 6.2 before 6.2.5.4 and 6.3 before 6.3.2.3 on UNIX Linux and OS X allows local users to gain privileges via unspecified vectors.


Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7 11.2.0.3 11.2.0.4 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that this is a stack-based buffer overflow in DBMS_AW.EXECUTE which allows code execution via a long Current Directory Alias (CDA) command.


Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv0 and backtrace information which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program as demonstrated by a setuid program that contains a stack-based buffer overflow error related to the __fortify_fail function in debug/fortify_fail.c and the __stack_chk_fail (aka stack protection) and __chk_fail (aka FORTIFY_SOURCE) implementations.


Stack-based buffer overflow in the Remote Procedure Call Subsystem (RPCSS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted LPC message that requests an LRPC connection from an LPC server to a client aka \LPC Message Buffer Overrun Vulnerability.\


Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c.


Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows local users to gain privileges via vectors related to improper memory allocation for copies from user mode aka \Win32k Buffer Overflow Vulnerability.\


The php_mysqlnd_read_error_from_line function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to be used.


Buffer overflow in sa_snap in the bos.esagent fileset in IBM AIX 6.1 5.3 and earlier and VIOS 2.1 1.5 and earlier allows local users to leverage system group membership and gain privileges via unspecified vectors.


Buffer overflow in the Routing and Remote Access NDProxy component in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application related to the Routing and Remote Access service (RRAS) and improper copying from user mode to the kernel aka \Kernel NDProxy Buffer Overflow Vulnerability.\


mysqlnd_wireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read sensitive memory via a modified length value which is not properly handled by the php_mysqlnd_ok_read function; or (2) trigger a heap-based buffer overflow via a modified length value which is not properly handled by the php_mysqlnd_rset_header_read function.


Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files.


Multiple stack-based buffer overflows in hsolinkcontrol in hsolink 1.0.118 allow local users to gain privileges via long command-line arguments a different vulnerability than CVE-2010-1671. NOTE: some of these details are obtained from third party information.


The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1 when running on big-endian 64-bit platforms calls the asn1_read_value with a pointer to the wrong data type and the wrong length value which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate related to extraction of a serial number.


Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18 5.0 Update 23 1.4.2_25 and 1.3.1_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow that allows arbitrary code execution via a crafted image.


Buffer overflow in qosmod in bos.net.tcp.server in IBM AIX 6.1 and VIOS 2.1 allows local users to gain privileges via unspecified vectors.


Buffer overflow in qoslist in bos.net.tcp.server in IBM AIX 6.1 and VIOS 2.1 allows local users to gain privileges via unspecified vectors.


Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18 5.0 Update and 23 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.


Heap-based buffer overflow in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to discover process memory locations via crafted data to TCP port 80 as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106 this disclosure has no actionable information. However because the VulnDisco author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18 5.0 Update 23 1.4.2_25 and 1.3.1_27 allows remote attackers to affect confidentiality integrity and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow in a decoding routine used by the JPEGImageDecoderImpl interface which allows code execution via a crafted JPEG image.


Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to have an unspecified impact via an image file containing crafted data that triggers improper processing within the (1) longimagedata or (2) expandrow function.


The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain _PAGE_EXEC_4U bit and consequently does not properly implement a non-executable stack which makes it easier for context-dependent attackers to exploit stack-based buffer overflows via a crafted application.


Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .dll file and possibly have unspecified other impact via unknown vectors as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.


** DISPUTED ** In the Linux kernel before 2.6.34 a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least one Linux maintainer believes that this CVE is incorrectly assigned and should be rejected because the value is hard coded and are not user-controllable where it is used.


The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method utilizing an EIP-overwrite buffer overflow.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 RealPlayer Enterprise 2.1.2 and Mac RealPlayer 11.0 through 12.0.0.1444 allows remote attackers to have an unspecified impact via a crafted AAC file.


Unspecified vulnerability in Oracle Solaris 8 9 and 10 allows remote attackers to affect confidentiality integrity and availability related to CDE Calendar Manager Service Daemon and RPC. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from other software vendors that this affects other operating systems such as HP-UX or claims from a reliable third party that this is a buffer overflow in rpc.cmsd via long XDR-encoded ASCII strings in RPC call 10.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 RealPlayer Enterprise 2.1.2 Mac RealPlayer 11.0 through 11.1 Linux RealPlayer 11.0.2.1744 and possibly HelixPlayer 1.0.6 and other versions allows remote attackers to have an unspecified impact via a crafted SIPR file.


The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\\0' character which allows local users to conduct buffer overflow attacks and gain privileges or possibly obtain sensitive information from kernel memory via a SOUND_MIXER_SETLEVELS ioctl call.


Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10 5.4.x before 5.4.3.4 5.5.x before 5.5.2.10 and 6.1.x before 6.1.3.1 on Unix and Linux allows local users to gain privileges by specifying a long LANG environment variable and then sending a request over a pipe.


Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows local users to gain privileges and bypass the User Account Control (UAC) feature via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key aka \Driver Improper Interaction with Windows Kernel Vulnerability.\


Multiple heap-based buffer overflows in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 RealPlayer Enterprise 2.1.2 Linux RealPlayer 11.0.2.1744 and possibly HelixPlayer 1.0.6 and other versions allow remote attackers to have an unspecified impact via a crafted RealMedia file.


Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.4 allows remote attackers to affect availability via unknown vectors related to Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party researcher that this is a buffer overflow via a crafted XML soap request and a value that does not contain the expected 0x20 terminator character.


Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.4 RealPlayer Enterprise 2.1.2 Mac RealPlayer 11.0 through 12.0.0.1444 Linux RealPlayer 11.0.2.1744 and possibly HelixPlayer 1.0.6 and other versions allows remote attackers to have an unspecified impact via a crafted RA5 file.


In GNOME Epiphany before 41.4 and 42.x before 42.2 an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.


Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow.


A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.


Heap-based

Buffer

Overflow

in

in

GitHub

repository

prior

to

This

vulnerability

is

heap

overflow

and

may

be

exploitable.

For

more

general

description

of

heap

buffer

overflow

see


MP4Box is a component of GPAC-2.0.0 which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file it calls the function `diST_box_read()` to read from video. In this function it allocates a buffer `str` with fixed length. However content read from `bs` is controllable by user so is the length which causes a buffer overflow.


Heap

buffer

overflow

in

in

GitHub

repository

prior

to

If

address

sanitizer

is

disabled

during

the

compiling

the

program

should

executes

into

the

function.

Therefore

I

think

it

is

very

likely

to

be

exploitable.

For

more

general

description

of

heap

buffer

overflow

see


Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line


Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically this can allow attackers to read sensitive information from other memory locations or cause a crash.


Improper

Validation

of

Array

Index

in

GitHub

repository

prior

to

This

vulnerability

is

heap

overflow

and

may

be

exploitable.

For

more

general

description

of

heap

buffer

overflow

see


Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.


Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically this can allow attackers to read sensitive information from other memory locations or cause a crash.


Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET request.


Tenda

US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin

is

vulnerable

to

Buffer

Overflow.

The

stack

overflow

vulnerability

lies

in

the

interface

of

the

web.

The

sent

post

data

startip

and

endip

are

copied

to

the

stack

using

the

sanf

function

resulting

in

stack

overflow.

Similarly

this

vulnerability

can

be

used

together

with


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a heap-based buffer overflow vulnerability due to insecure handling of a crafted .pdf file potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file


The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client crafted client requests can remotely trigger this vulnerability.


Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


In galois_2p8 before 0.1.2 PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.


Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA for the 'subform colSpan=\-2\' and 'draw colSpan=\1\' substrings.


The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability whereby user input len is copied into a fixed buffer &attr->val.integer without any bound checks. If the client connects to the server and sends a large radius packet a buffer overflow vulnerability will be triggered.


PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that uses PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.


PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print() pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.


Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.


In HTMLDOC 1.9.14 an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow.


Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h.


Espruino 2v11 release was discovered to contain a stack buffer overflow via src/jsvar.c in jsvGetNextSibling.


The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs leading to stack-based buffer overflow.


Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.


slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement. NOTE: privilege separation and pledge can prevent exploitation.


MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size which is exploited via specially crafted SQL statements.


scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion.


FreeType

commit

was

discovered

to

contain

a

heap

buffer

overflow

via

the

function


Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c.


A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a stack-based buffer overflow vulnerability due to insecure processing of a font potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file


engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation.


In cifs-utils through 6.14 a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.


nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.


In

WebKitGTK

through

(and

WPE

WebKit)

there

is

a

heap-based

buffer

overflow

in

WebCore::TextureMapperLayer::setContentsLayer

in


GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file the program will allocate for a huge amount of memory resulting in insufficient memory or program crash.


nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.


Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine.


Digi Passport Firmware through 1.5.1 1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint allowing him to force an overflow when the string is concatenated to the HTML body.


Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.


GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.


In nbd-server in nbd before 3.24 there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.


Digi Passport Firmware through 1.5.1 1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.


Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.


st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.


Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.


Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions parse_hello_subtlv parse_ihu_subtlv and parse_update_subtlv in babeld/message.c.


Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called indirectly by tools/lou_checktable.c).


A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P3 (All versions prior to V30.205)


NXP LPC55S66JBD64 LPC55S66JBD100 LPC55S66JEV98 LPC55S69JBD64 LPC55S69JBD100 and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.


IBM Sterling Secure Proxy 6.0.3.0 6.0.2.0 and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow due to the Jetty based GUI in the Secure Zone not properly validating the sizes of the form content and/or HTTP headers submitted. A local attacker positioned inside the Secure Zone could submit a specially crafted HTTP request to disrupt service. IBM X-Force ID: 219133.


A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101)


A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


Adobe Photoshop versions 22.5.4 (and earlier) and 23.1 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted file potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in Photoshop.


Adobe Illustrator version 26.0.3 (and earlier) is affected by a buffer overflow vulnerability due to insecure handling of a crafted file potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in Illustrator.


A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document.


A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted malicious file potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted malicious file in Illustrator.


Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument which triggers a stack-based buffer overflow.


Heap-based buffer overflow in ibmdiradm in IBM Tivoli Directory Server (TDS) 6.0 on Linux allows remote attackers to have an unspecified impact via unknown vectors that trigger heap corruption as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information about the originally requested URL.


Buffer overflow on the ASUS WL-500W wireless router has unknown impact and remote attack vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in Sun Java System Web Server 7.0 Update 6 has unspecified impact and remote attack vectors as demonstrated by the vd_sjws module in VulnDisco Pack Professional 8.12. NOTE: as of 20091105 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Buffer overflow in lib/load_http.c in ippool in Darren Reed IPFilter (aka IP Filter) 4.1.31 allows local users to gain privileges via vectors involving a long hostname in a URL.


Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 10.0 MP1 9.2 MP3 9.1 9.0 8.1 SP6 and 7.0 SP7 allows remote authenticated users to affect confidentiality integrity and availability related to IIS. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow involving an unspecified Server Plug-in and a crafted SSL certificate.


Buffer overflow in VUPlayer allows user-assisted attackers to have an unknown impact via a long file as demonstrated by a file composed entirely of 'A' characters.


Buffer overflow in pppdial in IBM AIX 5.3 and 6.1 allows local users to gain privileges via a long \input string.\


Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet and then sending the remainder of the packet with crafted values in the header related to use of uninitialized memory in a validation check.


Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.


Buffer overflow in klim5.sys in Kaspersky Anti-Virus for Workstations 6.0 and Anti-Virus 2008 allows local users to gain privileges via an IOCTL 0x80052110 call.


Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 allows remote attackers to have an unknown impact via a STATS line with a long email field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Buffer overflow in SUSE blinux (aka sbl) in SUSE openSUSE 10.3 through 11.0 has unknown impact and attack vectors related to \incoming data and authentication-strings.\


Buffer overflow on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to have an unspecified impact via long IKE attributes aka Bug ID CSCsu43121.


Buffer overflow in Hitachi Cosminexus V4 through V8 Processing Kit for XML and Developer's Kit for Java as used in products such as uCosminexus Electronic Form Workflow Groupmax and IBM XL C/C++ Enterprise Edition 7 and 8 allows remote attackers to have an unknown impact via vectors related to the use of GIF image processing APIs by a Java application and a different issue from CVE-2007-3794.


Buffer overflow in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite 1.5.4 and earlier might allow local users to gain privileges via crafted SCARD_CONTROL message data which is improperly demarshalled. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0407.


overkill has buffer overflow via long player names that can corrupt data on the server machine


In Novell NetWare before 6.5 SP8 a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthenticated attackers to execute code because a length field was incorrectly trusted.


Multiple buffer overflows in man-db 2.4.1 and earlier when installed setuid allow local users to gain privileges via (1) MANDATORY_MANPATH MANPATH_MAP and MANDB_MAP arguments to add_to_dirlist in manp.c (2) a long pathname to ult_src in ult_src.c (3) a long .so argument to test_for_include in ult_src.c (4) a long MANPATH environment variable or (5) a long PATH environment variable.


Buffer overflow in libIM library (libIM.a) for National Language Support (NLS) on AIX 4.3 through 5.2 allows local users to gain privileges via several possible attack vectors including a long -im argument to aixterm.


Buffer overflow in db2dart in IBM DB2 Universal Data Base 7.2 before Fixpak 10 allows local users to gain root privileges via a long command line argument.


Multiple buffer overflows in kermit in HP-UX 10.20 and 11.00 (C-Kermit 6.0.192 and possibly other versions before 8.0) allow local users to gain privileges via long arguments to (1) ask (2) askq (3) define (4) assign and (5) getc some of which may share the same underlying function \doask \ a different vulnerability than CVE-2001-0085.


Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.


Buffer overflow in xtokkaetama allows local users to gain privileges via a long -nickname command line argument a different vulnerability than CVE-2003-0611.


Buffer overflow in xaos 3.0-23 and earlier when running setuid allows local users to gain root privileges via a long -language option.


Buffer overflow in dtprintinfo on HP-UX 11.00 and possibly other operating systems allows local users to gain root privileges via a long DISPLAY environment variable.


Buffer overflow in Uptime Client (UpClient) 5.0b7 and possibly other versions allows local users to gain privileges via a long -p argument.


Buffer overflow in (1) nethack 3.4.0 and earlier and (2) falconseye 1.9.3 and earlier which is based on nethack allows local users to gain privileges via a long -s command line option.


Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3 OpenBSD 3.2 and earlier and possibly other operating systems allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name.


Buffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.


Buffer overflow in db2licm in IBM DB2 Universal Data Base 7.2 before Fixpak 10a allows local users to gain root privileges via a long command line argument.


Buffer overflow in youbin allows local users to gain privileges via a long HOME environment variable.


Buffer overflow in Eterm 0.9.2 allows local users to gain privileges via a long ETERMPATH environment variable.


Buffer overflow in xbl 1.0k and earlier allows local users to gain privileges via a long -display command line option.


Buffer overflow in les for ATM on Linux (linux-atm) before 2.4.1 if used setuid allows local users to gain privileges via a long -f command line argument.


A \potential buffer overflow in ruleset parsing\ for Sendmail 8.12.9 when using the nonstandard rulesets (1) recipient (2) final or (3) mailer-specific envelope recipients has unknown consequences.


The screen saver in MacOS X allows users with physical access to cause the screen saver to crash and gain access to the underlying session via a large number of characters in the password field possibly triggering a buffer overflow.


Buffer overflow in freesweep in Debian GNU/Linux 3.0 allows local users to gain \games\ group privileges when processing environment variables.


Buffer overflow in marbles 1.0.2 and earlier allows local users to gain privileges via a long HOME environment variable.


Buffer overflow in rcp for AIX 4.3.3 5.1 and 5.2 allows local users to gain privileges.


Buffer overflow gds_lock_mgr of Interbase Database 6.x allows local users to gain privileges via a long ISC_LOCK_ENV environment variable (INTERBASE_LOCK).


Buffer overflow in xconq 7.4.1 allows local users to become part of the \games\ group via the (1) USER or (2) DISPLAY environment variables.


Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges as identified by Sun BugID 4659277 a different vulnerability than CVE-2003-1082.


Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges as identified by Sun BugID 4705891 a different vulnerability than CVE-2003-1068.


Buffer overflow in Opera 7.02 Build 2668 allows remote attackers to crash Opera via a long HTTP request ending in a .ZIP extension.


Buffer overflow in stmkfont utility of HP-UX 10.0 through 11.22 allows local users to gain privileges via a long command line argument.


Buffer overflow in rexec on HP-UX B.10.20 B.11.00 and B.11.04 when setuid root may allow local users to gain privileges via a long -l option.


Buffer overflow in Elm 2.4 and earlier allows local users to gain privileges via a long TERM environmental variable.


Buffer overflow in (1) pluggable authentication module (PAM) on Solaris 2.5.1 and 2.5 and (2) unix_scheme in Solaris 2.4 and 2.3 allows local users to gain root privileges via programs that use these modules such as passwd yppasswd and nispasswd.


Buffer overflow in libsocks5 library of Socks 5 (socks5) 1.0r5 allows local users to gain privileges via long environmental variables.


Buffer overflow in CrackLib 2.5 may allow local users to gain root privileges via a long GECOS field.


Buffer overflow in Kerberos IV compatibility libraries as used in Kerberos V allows local users to gain root privileges via a long line in a kerberos configuration file which can be specified via the KRB_CONF environmental variable.


Buffer overflow in kppp in KDE allows local users to gain root access via a long PATH environmental variable.


Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter.


Buffer overflow in kscreensaver in KDE klock allows local users to gain root privileges via a long HOME environmental variable.


Buffer overflow in /usr/bin/write in Solaris 2.6 and 7 allows local users to gain privileges via a long string in the terminal name argument.


Buffer overflow in faxalter in hylafax 4.0.2 allows local users to gain privileges via a long -m command line argument.


Buffer overflows in CDROM Confidence Test program (cdrom) allow local users to gain root privileges.


Buffer overflow in linuxconf 1.11r11-rh2 on Red Hat Linux 5.1 allows local users to gain root privileges via a long LANG environmental variable.


Buffer overflow in ping in AIX 4.2 and earlier allows local users to gain root privileges via a long command line argument.


Buffer overflow in ppp program in FreeBSD 2.1 and earlier allows local users to gain privileges via a long HOME environment variable.


Buffer overflow in kppp in KDE allows local users to gain root access via a long -c (account_name) command line argument.


Buffer overflow in sar for SCO OpenServer 5.0.0 through 5.0.5 may allow local users to gain root privileges via a long -f parameter a different vulnerability than CVE-1999-1570.


Buffer overflow in chkey in Solaris 2.5.1 and earlier allows local users to gain root privileges via a long command line argument.


Buffer overflow in GNOME libraries 1.0.8 allows local user to gain root access via a long --espeaker argument in programs such as nethack.


Buffer overflow in SCO mscreen allows local users to gain root privileges via a long terminal entry (TERM) in the .mscreenrc file.


Buffer overflow in nss_nisplus.so.1 library in NIS+ in Solaris 2.3 and 2.4 allows local users to gain root privileges.


Buffer overflow in mail command in Solaris 2.7 and 2.7 allows local users to gain privileges via a long -m argument.


Buffer overflow in at program in Digital UNIX 4.0 allows local users to gain root privileges via a long command line argument.


Buffer overflow in chfn command in HP-UX 9.X through 10.20 allows local users to gain privileges via a long command line argument.


Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.


Buffer overflow in mscreen on SCO OpenServer 5.0 and SCO UNIX 3.2v4 allows a local user to gain root access via (1) a long TERM environmental variable and (2) a long entry in the .mscreenrc file.


Buffer overflow in Korn Shell (ksh) suid_exec program on IRIX 6.x and earlier and possibly other operating systems allows local users to gain root privileges.


Buffer overflow in cidentd ident daemon allows local users to gain root privileges via a long line in the .authlie script.


Buffer overflow in (1) nlservd and (2) rnavc in Knox Software Arkeia backup product allows local users to obtain root access via a long HOME environmental variable.


Buffer overflow in SysVInit in Red Hat Linux 5.1 and earlier allows local users to gain privileges.


Buffer overflow in TestChip function in XFree86 SuperProbe in Slackware Linux 3.1 allows local users to gain root privileges via a long -nopr argument.


The snprintf function in the db library 1.85.4 ignores the size parameter which could allow attackers to exploit buffer overflows that would be prevented by a properly implemented snprintf.


Vulnerability in StackGuard before 1.21 allows remote attackers to bypass the Random and Terminator Canary security mechanisms by using a non-linear attack which directly modifies a pointer to a return address instead of using a buffer overflow to reach the return address entry itself.


Buffer overflow in run-time linkers (1) ld.so or (2) ld-linux.so for Linux systems allows local users to gain privileges by calling a setuid program with a long program name (argv0) and forcing ld.so/ld-linux.so to report an error.


Buffer overflow in bash 2.0.0 1.4.17 and other versions allows local attackers to gain privileges by creating an extremely large directory name which is inserted into the password prompt via the \\w option in the PS1 environmental variable when another user changes into that directory.


Buffer overflow in eeprom in Solaris 2.5.1 and earlier allows local users to gain root privileges via a long command line argument.


Buffer overflow in VDO Live Player allows remote attackers to execute commands on the VDO client via a malformed .vdo file.


Buffer overflow in Vixie Cron on Red Hat systems via the MAILTO environmental variable.


Buffer overflow in FuseMAIL POP service via long USER and PASS commands.


Buffer overflow in BIND 8.2 via NXT records.


Buffer overflow in WU-FTPD and related FTP servers allows remote attackers to gain root privileges via MAPPING_CHDIR.


Buffer overflow in War FTP allows remote execution of commands.


Buffer overflow in Windows NT 4.0 help file utility via a malformed help file.


Buffer overflow in Fujitsu Chocoa IRC client via IRC channel topics.


Buffer overflow in Mediahouse Statistics Server allows remote attackers to execute commands.


Buffer overflow in Source Code Browser Program Database Name Server Daemon (pdnsd) for the IBM AIX C Set ++ compiler.


Buffer overflows in Mars NetWare Emulation (NWE mars_nwe) package via long directory names.


Buffer overflow in HPUX passwd command allows local users to gain root privileges via a command line option.


Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases.


SGI IRIX buffer overflow in xterm and Xaw allows root access.


Buffer overflow in Xi Graphics Accelerated-X server allows local users to gain root access via a long display or query parameter.


Buffer overflow in VMWare 1.0.1 for Linux via a long HOME environmental variable.


Arbitrary command execution via IMAP buffer overflow in authenticate command.


Buffer overflow in AIX ftpd in the libc library.


Buffer overflow in Sun's ping program can give root access to local users.


Digital Unix 4.0 has a buffer overflow in the inc program of the mh package.


The Sun sdtcm_convert calendar utility for OpenWindows has a buffer overflow which can gain root access.


Buffer overflow in Accept command in Netscape Enterprise Server 3.6 with the SSL Handshake Patch.


Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges.


Buffer overflow in OpenLink 3.2 allows remote attackers to gain privileges via a long GET request to the web configurator.


The cancel command in Solaris 2.6 (i386) has a buffer overflow that allows local users to obtain root access.


Buffer overflow in Xshipwars xsw program.


Buffer overflow in Yamaha MidiPlug via a Text variable in an EMBED tag.


Buffer overflow in Qpopper (qpop) 3.0 allows remote root access via AUTH command.


Buffer overflow in gnuplot in Linux version 3.5 allows local users to obtain root access.


Buffer overflow in ProFTPD wu-ftpd and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.


Buffer overflow in statd allows root privileges.


Buffer overflow in Infoseek Ultraseek search engine allows remote attackers to execute commands via a long GET request.


root privileges via buffer overflow in df command on SGI IRIX systems.


MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4.


Buffer overflow in bootpd on OpenBSD FreeBSD and Linux systems via a malformed header type.


Buffer overflow in AIX dtterm program for the CDE.


Buffer overflow in NFS server on Linux allows attackers to execute commands via a long pathname.


Buffer overflow in ALMail32 POP3 client via From: or To: headers.


Buffer overflow in CommuniGatePro via a long string to the HTTP configuration port.


Arbitrary command execution via buffer overflow in Count.cgi (wwwcount) cgi-bin program.


Buffer overflow in NIS+ in Sun's rpc.nisd program.


Buffer overflow in POP servers based on BSD/Qualcomm's qpopper allows remote attackers to gain root access using a long PASS command.


Buffer overflow in Skyfull mail server via MAIL FROM command.


Buffer overflow in OpenBSD ping.


Buffer overflow in Samba smbd program via a malformed message command.


Buffer overflows in Sun libnsl allow root access.


Buffer overflow in INN inews program.


Buffer overflows in HP Software Distributor (SD) for HPUX 10.x and 11.x.


Buffer overflow in NFS mountd gives root access to remote attackers mostly in Linux systems.


Buffer overflow in hybrid-6 IRC server commonly used on EFnet allows remote attackers to execute commands via m_invite invite option.


Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file.


The printers program in IRIX has a buffer overflow that gives root access to local users.


Buffer overflow in uum program for Canna input system allows local users to gain root privileges.


Buffer overflow in ToxSoft NextFTP client through CWD command.


Buffer overflow in OpenBSD procfs and fdescfs file systems via uio_offset in the readdir() function.


Buffer overflow in WFTPD FTP server allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.


Buffer overflow in RSAREF2 via the encryption and decryption functions in the RSAREF library.


Buffer overflow in SGI IRIX mailx program.


Buffer overflow in sccw allows local users to gain root access via the HOME environmental variable.


Buffer overflow in ffbconfig in Solaris 2.5.1.


SuSE 5.2 PLP lpc program has a buffer overflow that leads to root compromise.


Buffer overflow in SunOS/Solaris ps command.


Buffer overflow in cfingerd allows local users to gain root privileges via a long GECOS field.


Buffer overflow in UnixWare xauto program allows local users to gain root privilege.


Buffer overflow in canuum program for Canna input system allows local users to gain root privileges.


Solaris ufsrestore buffer overflow.


Local user gains root privileges via buffer overflow in rdist via expstr() function.


Buffer overflow in PHP cgi program php.cgi allows shell access.


Buffer overflow in OmniHTTPd CGI program imagemap.exe allows remote attackers to execute commands.


Netmanager Chameleon SMTPd has several buffer overflows that cause a crash.


Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file.


Buffer overflow in AIX and Solaris \gethostbyname\ library call allows root access through corrupt DNS host names.


Buffer overflow in Berkeley automounter daemon (amd) logging facility provided in the Linux am-utils package and others.


Buffer overflow in BNC IRC proxy allows remote attackers to gain privileges.


Execute commands as root via buffer overflow in Tooltalk database server (rpc.ttdbserverd).


Buffer overflow in blackd.exe for BlackICE PC Protection 3.6 and other versions before 3.6.ccb with application protection off allows local users to gain system privileges by modifying the .INI file to contain a long packetLog.fileprefix value.


Buffer overflow in GNU make for IBM AIX 4.3.3 when installed setgid allows local users to gain privileges via a long CC argument.


The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencrypted password for a Windows domain account) via four \stuffit /f:stuffit.dat\ invocations possibly due to a buffer overflow.


The pnm_get_chunk function in xine 0.99.2 and earlier and other packages such as MPlayer that use the same code does not properly verify that the chunk size is less than the PREAMBLE_SIZE which causes a read operation with a negative length that leads to a buffer overflow via (1) RMF_TAG (2) DATA_TAG (3) PROP_TAG (4) MDPR_TAG and (5) CONT_TAG values a different vulnerability than CVE-2004-1187.


The buffer overflow trigger in Cisco Security Agent (CSA) before 4.0.3 build 728 waits five minutes for a user response before terminating the process which could allow remote attackers to bypass the buffer overflow protection by sending additional buffer overflow attacks within the five minute timeout period.


Buffer overflow in qwik-smtpd allows remote attackers to use the server as an SMTP spam relay via a long HELO command which overwrites the adjacent localIP data buffer.


Buffer overflow in (1) ncplogin and (2) ncpmap in nwclient.c for ncpfs 2.2.4 and possibly other versions may allow local users to gain privileges via a long -T option.


crawl before 4.0.0 beta23 does not properly \apply a size check\ when copying a certain environment variable which may allow local users to gain privileges possibly as a result of a buffer overflow.


Buffer

overflow

in

allows

local

users

to

gain

'games'

group

privileges

via

a

large

HOME

environment

variable

to

editor.c

theme.c

manager.c

config.c

game.c

levels.c

or

main.c.


A \potential\ buffer overflow exists in the panic() function in Linux 2.4.x although it may not be exploitable due to the functionality of panic.


Buffer overflow in Samba 2.2.x to 2.2.9 and 3.0.0 to 3.0.4 when the \mangling method = hash\ option is enabled in smb.conf has unknown impact and attack vectors.


Buffer overflow in TruBlueEnvironment in Mac OS X 10.3.x and 10.2.x allows local users to gain privileges via a long environment variable.


Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.


The e1000 driver for Linux kernel 2.4.26 and earlier does not properly initialize memory before using it which allows local users to read portions of kernel memory. NOTE: this issue was originally incorrectly reported as a \buffer overflow\ by some sources.


IBM Informix Dynamic Server 12.1 could allow an authenticated user to cause a buffer overflow that would write large assertion fail files to the server. Done enough times this could use large parts of the file system and cause the server to crash. IBM X-Force ID: 125569.


libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.


OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread as demonstrated by the 4-buf-overflow-readData-memcpy test case.


A kernel driver namely DLMFENC.sys bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to allocate sufficient memory on the kernel heap to contain a user supplied string as such the string is copied into a buffer of constant size (0x1000-bytes) and thus an overflow condition results. Access to the kernel driver is permitted through an obfuscated interface whereby bytes of user supplied message are \authenticated\ via an obfuscation routine employing a linear equation.


Buffer overflow in ccn-lite-ccnb2xml.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors involving the vallen and len variables.


In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree 4.12-stable tree 3.18-stable tree and 4.4-stable tree.


A network interface of the novi_process_manager_daemon service included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices can be inadvertently exposed if an operator attempts to modify ACLs because of a bug when ACL modifications are applied. This could be leveraged by remote unauthenticated attackers to gain resultant privileged (root) code execution on the switch because incoming packet data can contain embedded OS commands and can also trigger a stack-based buffer overflow.


Network interfaces of the cliengine and noviengine services included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices can be inadvertently exposed if an operator attempts to modify ACLs because of a bug when ACL modifications are applied. This could be leveraged by remote unauthenticated attackers to gain resultant privileged (root) code execution on the switch because there is a stack-based buffer overflow during unserialization of packet data.


Buffer overflow in util/ccnl-common.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging incorrect memory allocation.


A local buffer overflow vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.


OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used possibly resulting in code execution.


A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14 Disk Savvy Enterprise 9.9.14 Sync Breeze Enterprise 9.9.16 and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request.


In libMtkOmxVdec.so there is a possible heap buffer overflow. This could lead to a remote elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38308024. References: M-ALPS03495789.


Several protocol parsers in tcpdump before 4.9.2 could cause a buffer overflow in util-print.c:bittok2str_internal().


A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified in which the application does not verify string size before copying to memory; the attacker may then be able to crash the application or run arbitrary code.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel there is a potential buffer overflow vulnerability in hdd_parse_setrmcenable_command and hdd_parse_setrmcactionperiod_command APIs as buffers defined in this API can hold maximum 32 bytes but data more than 32 bytes can get copied.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing a user supplied sparse image a buffer overflow vulnerability could occur if the sparse header block size is equal to 4294967296.


On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware aka B-V2017061204.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel when the pktlogconf tool gives a pktlog buffer of size less than the minimal possible source data size in the host driver a buffer overflow can potentially occur.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash.


soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code execution via a crafted PSM File that triggers use of the same sample slot for two samples.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel currently the value of SIR_MAC_AUTH_CHALLENGE_LENGTH is set to 128 which may result in buffer overflow since the frame parser allows challenge text of length up to 253 bytes but the driver can not handle challenge text larger than 128 bytes.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel when qos map set IE of length less than 16 is received in association response or in qos map configure action frame a buffer overflow can potentially occur in ConvertQosMapsetFrame().


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel camera application triggers \user-memory-access\ issue as the Camera CPP module Linux driver directly accesses the application provided buffer which resides in user space. An unchecked userspace value (ioctl_ptr->len) is used to copy contents to a kernel buffer which can lead to kernel buffer overflow.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel possible buffer overflow or information leak in the functions \sme_set_ft_ies\ and \csr_roam_issue_ft_preauth_req\ due to incorrect initialization of WEXT callbacks and lack of the checks for buffer size.


A stack buffer overflow vulnerability exists in the ISO parsing functionality of Power Software Ltd PowerISO 6.8. A specially crafted ISO file can cause a vulnerability resulting in potential code execution. An attacker can send a specific ISO file to trigger this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted PPT file can cause a stack corruption resulting in arbitrary code execution. An attacker can send/provide malicious PPT file to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10000 can cause a buffer overflow resulting in overwriting arbitrary data.


An exploitable code execution vulnerability exists in the OpenProducer functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in code execution. An attacker can send a malicious packet to trigger this vulnerability.


The emerg_data driver in CAM-L21C10B130 and earlier versions CAM-L21C185B141 and earlier versions has a buffer overflow vulnerability. An attacker with the root privilege of the Android system can tricks a user into installing a malicious application on the smart phone and send given parameter to smart phone to crash the system or escalate privilege.


When processing a record type of 0x3c from a Workbook stream from an Excel file (.xls) JustSystems Ichitaro Office trusts that the size is greater than zero subtracts one from the length and uses this result as the size for a memcpy. This results in a heap-based buffer overflow and can lead to code execution under the context of the application.


A buffer overflow vulnerability exists in the ISO parsing functionality of EZB Systems UltraISO 9.6.6.3300. A specially crafted .ISO file can cause a vulnerability resulting in potential code execution. An attacker can provide a specific .ISO file to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.


Adobe Acrobat Reader versions 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable buffer overflow / underflow vulnerability in the image conversion module related to parsing tags in TIFF files. Successful exploitation could lead to arbitrary code execution.


Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions earlier than VTR-AL00C00B123 versions have a buffer overflow vulnerability. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the next system reboot causing continuous system reboot or arbitrary code execution.


An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.


An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted UPnP discovery response can cause a buffer overflow resulting in overwriting arbitrary data. An attacker needs to be in the same subnetwork and reply to a discovery message to trigger this vulnerability.


The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability. An attacker tricks a user into installing a malicious application which has the system privilege of the Android system and sends a specific parameter to the driver of the smart phone causing a system crash or privilege escalation.


Buffer overflow in TS-WPTCAM firmware version 1.18 and earlier TS-WPTCAM2 firmware version 1.00 TS-WLCE firmware version 1.18 and earlier TS-WLC2 firmware version 1.18 and earlier TS-WRLC firmware version 1.17 and earlier TS-PTCAM firmware version 1.18 and earlier TS-PTCAM/POE firmware version 1.18 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.


An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37 a specially crafted HTTP request can cause a buffer overflow.


An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.


The goldeneye driver in NMO-L31C432B120 and earlier versions NEM-L21C432B100 and earlier versions NEM-L51C432B120 and earlier versions KNT-AL10C746B160 and earlier versions VNS-L21C185B142 and earlier versions CAM-L21C10B130 and earlier versions CAM-L21C185B141 and earlier versions has buffer overflow vulnerability. An attacker with the root privilege of the Android system can tricks a user into installing a malicious application on the smart phone and send given parameter to smart phone to crash the system or escalate privilege.


An exploitable code execution vulnerability exists in the NewProducerStream functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in code execution. An attacker can send a malicious packet to trigger this vulnerability.


When copying filedata into a buffer JustSystems Ichitaro Office 2016 Trial will calculate two values to determine how much data to copy from the document. If both of these values are larger than the size of the buffer the application will choose the smaller of the two and trust it to copy data from the file. This value is larger than the buffer size which leads to a heap-based buffer overflow. This overflow corrupts an offset in the heap used in pointer arithmetic for writing data and can lead to code execution under the context of the application.


An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.


An exploitable Code Execution vulnerability exists in the RequestForPatientInfoEEGfile functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a stack-based buffer overflow resulting in potential code execution. An attacker can provide a specially crafted XCF file to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10000 can cause a buffer overflow resulting in overwriting arbitrary data.


The boot loaders in Honor 5A smart phones with software Versions earlier than CAM-TL00C01B193 Versions earlier than CAM-TL00HC00B193 Versions earlier than CAM-UL00C00B193 have a buffer overflow vulnerability. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the next system reboot causing continuous system reboot or arbitrary code execution.


An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simply send an http request to the device to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.


Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions earlier than VTR-AL00C00B123 versions have a buffer overflow vulnerability. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the next system reboot causing continuous system reboot or arbitrary code execution.


An exploitable code execution vulnerability exists in the SavePatientMontage functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in code execution. An attacker can a malicious packet to trigger this vulnerability.


The ddr_devfreq driver in versions earlier than GRA-UL00C00B197 has buffer overflow vulnerability. An attacker with the root privilege of the Android system can tricks a user into installing a malicious application on the smart phone and send given parameter to smart phone to crash the system or escalate privilege.


An exploitable heap-based buffer overflow exists in the Hangul Word Processor component (version 9.6.1.4350) of Hancom Thinkfree Office NEO 9.6.1.4902. A specially crafted document stream can cause an integer underflow resulting in a buffer overflow which can lead to code execution under the context of the application. An attacker can entice a user to open up a document in order to trigger this vulnerability.


Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.


In BlackBerry QNX Software Development Platform (SDP) 6.6.0 the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks.


Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in the web administration interface HNAP service.


When Antiy Antivirus Engine before 5.0.0.05171547 scans a special ZIP archive it crashes with a stack-based buffer overflow because a fixed path length is used.


When GraphicsMagick 1.3.25 processes an RGB TIFF picture (with metadata indicating a single sample per pixel) in coders/tiff.c a buffer overflow occurs related to QuantumTransferMode.


Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.


Buffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.


A buffer overflow vulnerability in Junos OS CLI may allow a local authenticated user with read only privileges and access to Junos CLI to execute code with root privileges. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D46 on EX2200/VC EX3200 EX3300/VC EX4200 EX4300 EX4550/VC EX4600 EX6200 EX8200/VC (XRE) QFX3500 QFX3600 QFX5100; 14.1X53 versions prior to 14.1X53-D130 on QFabric System; 14.2 versions prior to 14.2R4-S9 14.2R6; 15.1 versions prior to 15.1F5 15.1R3; 15.1X49 versions prior to 15.1X49-D40 on SRX Series; 15.1X53 versions prior to 15.1X53-D47 on NFX150 NFX250; 15.1X53 versions prior to 15.1X53-D65 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5110 QFX5200.


On Insteon Hub 2245-222 devices with firmware version 1012 specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. A strcpy overflows the buffer insteon_pubnub.channel_ak which has a size of 16 bytes. An attacker can send an arbitrarily long \ak\ parameter in order to exploit this vulnerability.


An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.


In

the

function

wma_unified_power_debug_stats_event_handler()

in

Android

for

MSM

Firefox

OS

for

MSM

and

QRD

Android

before

if

the

value

received

from

the

FW

command

buffer

is

close

to

max

of

then

the

computation

performed

using

this

variable

to

calculate

may

overflow

to

a

smaller

value

leading

to

less

than

required

memory

allocated

for

and

potentially

a

buffer

overflow

while

copying

the

FW

buffer

to

local

buffer.


Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login.


An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the URL parameter during a firmware update request leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.


Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely.


An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this vulnerability.


An exploitable buffer overflow vulnerability exists in the PubNub message handler for the \control\ channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. A strcpy overflows the buffer insteon_pubnub.channel_cc_r which has a size of 16 bytes. An attacker can send an arbitrarily long \c_r\ parameter in order to exploit this vulnerability. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability.


A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Userspace can pass IEs to the host driver and if multiple append commands are received then the integer variable that stores the length can overflow and the subsequent copy of the IE data may potentially lead to a heap buffer overflow.


tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file a related issue to CVE-2016-6160.


On Insteon Hub 2245-222 devices with firmware version 1012 specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. A strcpy overflows the buffer insteon_pubnub.channel_ad_r which has a size of 16 bytes. An attacker can send an arbitrarily long \ad_r\ parameter in order to exploit this vulnerability.


LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.


In

Android

for

MSM

Firefox

OS

for

MSM

QRD

Android

with

all

Android

releases

from

CAF

using

the

Linux

kernel

wma_unified_link_peer_stats_event_handler

function

has

a

variable

which

represents

the

sum

of

all

the

The

current

behavior

in

this

function

is

to

validate

only

the

of

the

first

peer

stats

against

but

not

the

sum

of

all

the

peer's

which

may

lead

to

a

buffer

overflow

when

the

firmware

buffer

is

copied

in

to

the

allocated

buffer

as

the

size

for

the

memory

allocation

is

based

on


An exploitable buffer overflow vulnerability exists in the PubNub message handler for the 'ad' channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability.


FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.


FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.


A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer leading to a crash or possible code execution.


Google

gRPC

before

has

an

out-of-bounds

write

caused

by

a

heap-based

buffer

overflow

related

to

the

function

in


A Stack-Based Buffer Overflow issue was discovered in Digital Canal Structural Wind Analysis versions 9.1 and prior. An attacker may be able to run arbitrary code by remotely exploiting an executable to perform a denial-of-service attack.


A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Thunderbird < 52.5.2 Firefox ESR < 52.5.2 and Firefox < 57.0.2.


Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c.


Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting into denial-of-service by crashing the process or potential hijack of the process running with administrative privileges triggered by specially crafted input string.


LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.


FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c.


International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.


FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.


FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.


FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.


GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream potentially leading to a program crash.


A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.


GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script leading to a program crash. This relates to lack of '\\0' termination of a name field in ldlex.l.


A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.


LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source/gdi/svmconverter.cxx.


A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


A

stack-based

buffer

overflow

issue

was

discovered

in

NXP

i.MX

i.MX

i.MX

i.MX

i.MX

i.MX

i.MX

i.MX

i.MX

i.MX

i.MX

i.MX

Vybrid

Vybrid

and

Vybrid

When

the

device

is

configured

in

security

enabled

configuration

SDP

could

be

used

to

download

a

small

section

of

code

to

an

unprotected

region

of

memory.


FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c.


The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection which trigger a buffer overflow.


Wi-Fi in Apple iOS before 10.3.1 does not prevent CVE-2017-6956 stack buffer overflow exploitation via a crafted access point. NOTE: because an operating system could potentially isolate itself from CVE-2017-6956 exploitation without patching Broadcom firmware functions there is a separate CVE ID for the operating-system behavior.


A Heap-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vulnerability causes a buffer overflow when a maliciously crafted project file is run by the system.


Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files. An attacker could exploit these vulnerabilities by providing a user with a malicious ARF file via email or URL and convincing the user to launch the file. Exploitation of these vulnerabilities could cause an affected player to crash and in some cases could allow arbitrary code execution on the system of a targeted user. The Cisco WebEx Network Recording Player is an application that is used to play back WebEx meeting recordings that have been recorded on the computer of an online meeting attendee. The player can be automatically installed when the user accesses a recording file that is hosted on a WebEx server. The following client builds are affected by this vulnerability: Cisco WebEx Business Suite (WBS29) client builds prior to T29.13.130 Cisco WebEx Business Suite (WBS30) client builds prior to T30.17 Cisco WebEx Business Suite (WBS31) client builds prior to T31.10. Cisco Bug IDs: CSCvc47758 CSCvc51227 CSCvc51242.


The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1 2c and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3 the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve54313.


readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations leading to a heap-based buffer overflow.