LeeJet Stable Diffusion.cpp buffer error vulnerability

The leejet stable-diffusion.cpp contains a buffer error vulnerability. This vulnerability arises because the safetensors loader in src/modelio/safetensorsio.cpp only verifies that nbytes equals end-begin before trusting the dataoffsets within the tensor. A specially crafted .safetensors file can...

UNISOC Bootloader buffer error vulnerability

The UNISOC Bootloader contains a buffer error vulnerability. This vulnerability arises because the bootloader download module fails to reset global offset variables during a firmware update session, resulting in out-of-bounds writes. This may lead to heap memory corruption, system crashes, or...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.2 contain a buffer error vulnerability. This vulnerability arises because freerdpbitmapplanarcontextreset submits a new size to the buffer before successful buffer reallocation. Additionally, ResetGraphics fails and is only logged; however, a malicious RDP server...

IBM MQ buffer error vulnerability

Buffer error vulnerabilities exist in IBM MQ versions 9.4.0.0 through 9.4.0.26, 9.4.1.0 through 9.4.5.3, and 10.0.0.1 through 10.0.0.5. These vulnerabilities stem from improper validation of the length field in the message header structure, potentially allowing authenticated attackers to obtain...

Zephyr buffer error vulnerability

Versions Zephyr 4.4.0 through 4.5.0 contain a buffer error vulnerability. This vulnerability stems from the user-space system call verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c, which copies i2sconfig from user memory. When frameclkfreq is set to 0, ownership, type checks, and blocksize...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.2 contain a buffer error vulnerability. This vulnerability arises from the failure to verify the product of surface dimensions in gdiCreateSurface when processing RDPGFX CREATESURFACE PDUs. As a result, integer wrap-around and heap buffer overflow may occur,...

HDF Group HDF5 buffer error vulnerability

Versions of HDF Group’s HDF5 prior to 2.3.0 contain a buffer error vulnerability. This vulnerability arises because H5Zfilterszip fails to verify that the length of a szip compression block is at least 4 bytes before decoding it; as a result, length calculations wrap around and lead to...

Ben Hoyt buffer error vulnerability

Versions of Ben Hoyt prior to r63 contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds read in the stack buffer under i.n.i.parsestream in ini.c. Attackers can exploit this by embedding NUL bytes after excessively long lines, thereby reading abyss-1 and resulting i...

Scribus buffer error vulnerability

Versions of Scribus prior to 1.6.7 contain a buffer error vulnerability. This vulnerability arises because the importsvm plugin fails to verify whether bitmap and transparency mask sizes match. Attackers can supply specially crafted SVM files with mismatched mask sizes, triggering heap read/write...

Blender buffer error vulnerability

Versions prior to Blender 4.5.15 and versions prior to 5.2.3 contain a buffer error vulnerability. This vulnerability arises because the readfiledna function fails to validate the declared length of GLOB block fields when reading them; as a result, attackers can trigger heap-based out-of-bounds...

GNU GCC buffer error vulnerability

GNU GCC contains a buffer error vulnerability. This vulnerability arises from an excessively small internal buffer in the parallel search implementation of libstdc++, leading to an out-of-bounds memory access. Local attackers can cause a process to crash by providing specially crafted search data...

Phillip Hellewell AFFLIB buffer error vulnerability

Phillip Hellewell: Versions 3.7.22 and earlier of AFFLIB contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds write in the afgetpage function. By providing a specially crafted AFF image where the page size does not match the sector size, attackers can trigger a...

KeePassXC buffer error vulnerability

Versions 2.3.0 through 2.8.0 of KeePassXC contain a buffer error vulnerability. This vulnerability arises because the browser uses a fixed 1 MiB output vector for encryption in its integration within src/browser/BrowserMessageBuilder.cpp when generating authorization responses. Additionally,...

RT-Labs p-net buffer error vulnerability

Versions prior to RT-Labs p-net 1.0.3 contain a buffer error vulnerability. This vulnerability arises because pfethrecv fails to validate the length of incoming Ethernet frames before reading the EtherType, VLAN tag, and PROFINET FrameID. Additionally, there is no upper limit on the number of VLA...

Apache Qpid Proton C buffer error vulnerability

Apache Qpid Proton C versions 0.40.0 and earlier contain a buffer error vulnerability. This vulnerability arises from a misconfigured wildcard TLS certificate, leading to a stack read overflow...

DNSmasq buffer error vulnerability

dnsmasq has a buffer error vulnerability. This vulnerability arises because the DNSSEC validator writes beyond the bounds of the name buffer during domain name and DNS record format conversion, potentially overwriting adjacent heap metadata...

Polkit buffer error vulnerability

Polkit contains a buffer error vulnerability. This vulnerability arises when processing input starting with an empty byte; an arithmetic error in the authentication proxy helper leads to an integer underflow in buffer length calculations. This results in an out-of-bounds memory read. Attackers ca...

Jack Lloyd Botan buffer error vulnerability

Versions 2.1.0 through 3.13.0 of Jack Lloyd Botan contain a security vulnerability. This vulnerability arises because the Botan C API function botanblockcipherblocksize fails to perform boundary checks when converting a sizet block size to an int. In applications that receive external algorithm...

RT-Labs p-net buffer error vulnerability

Versions prior to RT-Labs p-net 1.0.3 contain a buffer error vulnerability. This vulnerability arises from a failure to verify whether the received data of DCP Set and Identify requests includes a complete block header. When reading the next block, an out-of-bounds read of the block length may...

RT-Labs p-net buffer error vulnerability

Versions prior to RT-Labs p-net 1.0.3 contain a buffer error vulnerability. This vulnerability arises from the failure to validate the LengthPeerStationName field within the CheckPeers block in getcheckpeer. The maximum permissible length is 255; however, this value is used to copy data into a pe...