Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR 52.8, Thunderbird 52.8, and...

undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)

It was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value...

perl: heap read overflow in regexec.c

A heap buffer over read flaw was found in the way Perl regular expression engine handled inputs with invalid UTF-8 characters. An attacker able to provide a specially crafted input to be matched against a regular expression could cause Perl interpreter to crash or disclose portion of its memory...

CVE-2017-17454

Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting XSS vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid...

CVE-2017-17784

In GIMP 2.8.22, there is a heap-based buffer over-read in loadimage in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data...

UBUNTU-CVE-2017-17784

In GIMP 2.8.22, there is a heap-based buffer over-read in loadimage in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data...

CVE-2017-17484

The ucnvUTF8FromUTF8 function in ucnvu8.cpp in International Components for Unicode ICU for C/C++ through 60.1 mishandles ucnvconvertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly hav...

expat: buffer over-read and crash in big2_toUtf8() on XML with malformed UTF-8 sequences

The big2toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service application crash via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlo...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read. The parseryyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service invalid write or read or possibly have unspecified other impact via a crafted Ruby script, related to the...

Invision Power Services Community Suite IPS UTF8 Converter Cross Site Scripting Vulnerability

Invision Power Services IPS Community Suite is an integrated application for building communities on the web.IPS UTF8 Converter is one of these transcoders. A cross-site scripting vulnerability exists in IPS UTF8 Converter version 1.1.18 in IPS Community Suite 4.1.19.2 and earlier. A remote...

tnef Integer Overflow Vulnerability

tnef is a set of programs for decompressing MIME attachments. An integer overflow vulnerability exists in the 'unicodetoutf8' function in tnef version 1.4.14. An attacker can exploit this vulnerability to cause an invalid write...

SQL injection vulnerability in type parameter of Ocean CMS admin_collect_news.php page

Ocean CMS is an open source website builder. An SQL injection vulnerability exists in the admincollectnews.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'type' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about...

CVE-2016-4303

The parsestring function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service crash or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow...

DEBIAN-CVE-2016-6263

The stringpreputf8nfkcnormalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via crafted UTF-8 data...

DEBIAN-CVE-2016-6855

Eye of GNOME aka eog 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service out-of-bounds write and crash via vectors involving passing invalid UTF-8 to GMarkup...

USN-3069-1 eog vulnerability

It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code...

UBUNTU-CVE-2016-6855

Eye of GNOME aka eog 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service out-of-bounds write and crash via vectors involving passing invalid UTF-8 to GMarkup...

UBUNTU-CVE-2016-6263

The stringpreputf8nfkcnormalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via crafted UTF-8 data...

The vulnerability of the Flash Player software allows a malicious attacker to execute arbitrary code or cause a service failure.

The Flash Player software contains a vulnerability in the “PCRE” component, which stems from insufficient data validation when processing the “\c” control sequence followed by a character in UTF-8 encoding. This vulnerability can be exploited by malicious actors using a specially crafted swf file...

The vulnerability of the Firefox browser, which allows a malicious actor to compromise the accessibility of protected information

The vulnerability in Mozilla Firefox allows malicious actors operating remotely to cause a service failure certificate processing failure using a specially crafted certificate. In this case, the UTF-8 character encoding is not used in the relevant context...