CVE-2019-14027

CVE-2019-14027 concerns a buffer overflow caused by missing upper-bound checks on a channel length used in a loop, affecting Qualcomm closed-source components (per CVE entries in NVD/Red Hat/CVE feeds). The issue is classified as High severity with local exposure in Snapdragon-related Qualcomm co...

CVE-2019-14027

Buffer overflow due to lack of upper bound check on channel length which is used for a loop. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and...

ppp: Buffer overflow in the eap_request and eap_response functions in eap.c

A buffer overflow flaw was found in the ppp package in versions 2.4.2 through 2.4.8. The bounds check for the rhostname was improperly constructed in the EAP request and response functions which could allow a buffer overflow to occur. Data confidentiality and integrity, as well as system...

kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow

A flaw was found in the Linux kernel's implementation of the RealTek wireless drivers WiFi-direct or WiFi peer-to-peer driver implementation. When the RealTek wireless networking hardware is configured to accept WiFi-Direct or WiFi P2P connections, an attacker within the wireless network...

CVE-2019-17666

rtlp2pnoaie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow...

Out-of-bounds

In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118138797...

EulerOS Virtualization 2.5.1 : kernel (EulerOS-SA-2019-1638)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The recent speculative execution CVEs address three potential attacks across a wide variety of architectures and hardware...

Bound Check Bypass

Mozilla Thunderbird is vulnerable to bound check bypass. It does not properly perform bounds checking when Spectre mitigations are disabled...

kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message

The xfrmmigrate function in the net/xfrm/xfrmpolicy.c file in the Linux kernel built with CONFIGXFRMMIGRATE does not verify if the dir parameter is less than XFRMPOLICYMAX. This allows a local attacker to cause a denial of service out-of-bounds access or possibly have unspecified other impact by...

Out-of-bounds

Incorrect bound check can lead to potential buffer overwrite in WLAN controller in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660...

Out-of-bounds

Incorrect bound check can lead to potential buffer overwrite in WLAN function in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660...

CVE-2018-11880

CVE-2018-11880 affects Qualcomm Snapdragon Mobile WLAN functionality. The root cause is an incorrect bound check that can lead to a buffer overwrite in the WLAN function on devices using SD 835, SD 845, SD 850, and SDA660 chipsets. The entry notes local access as the attack vector with a low atta...

Microsoft Edge Chakra JIT - Bound Check Elimination Bug

Microsoft Edge Chakra JIT - Bound Check Elimination Bug / Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. ...

Microsoft Edge Chakra JIT - Bound Check Elimination Bug Exploit

Exploit for windows platform in category dos / poc / Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. In th...

Microsoft Edge Chakra JIT - Bound Check Elimination Bug

/ Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. In the following code, currentBlock's block number is 4...

openSUSE Security Update : mbedtls (openSUSE-2018-186)

This update for mbedtls fixes the following issues : - CVE-2018-0487: Fixed a buffer overflow in RSASSA-PSS signature verification, which allowed remote attackers to execute arbitrary code or cause a denial of service via a crafted certificate chain. boo1080826 - CVE-2018-0488: Fixed a heap...

WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock Exploit

Exploit for multiple platform in category dos / poc range.mmaxBound range.mmaxBound = data.maddend; range.mmaxOrigin = node-origin.semantic; else if data.maddend origin.semantic; ... The problem is that the check |data.maddend range.mmaxBound| is a signed comparison. PoC: -- function f let arr = ...

WebKit JSC Jit Optimization Check Failure

WebKit: JSC: JIT optimization check failed in IntegerCheckCombiningPhase::handleBlock CVE-2017-2547 When compiling Javascript code into machine code, bound checks for all accesses to a typed array are also inserted. These bound checks are re-optimized and the unnecessary checks are removed, which...

miniupnpc 2.0.20170421 Denial Of Service

Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798 Version: 0.6 Date: May 1st, 2017 Tag: miniupnp miniupnpc getHTTPResponse chunked encoding integer signedness error Overview -------- Name: miniupnpc Vendor: Thomas Bernard References: http://miniupnp.free.fr/ 1 Version:...

Gentoo Security Advisory GLSA 201407-01

Gentoo Linux Local Security Checks GLSA 201407-01 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...