CVE-2018-5178

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR 52.8, Thunderbird 52.8, and...

Debian DLA-2080-1 : iperf3 security update

An issue has been found in iperf3, an Internet Protocol bandwidth measuring tool. Bad handling of UTF8/16 strings in an embedded library could cause a denial of service crash or execution of arbitrary code by putting special characters in a JSON string, which triggers a heap-based buffer overflow...

[SECURITY] [DLA 2080-1] iperf3 security update

Package : iperf3 Version : 3.0.7-1+deb8u1 CVE ID : CVE-2016-4303 Debian Bug : 827116 An issue has been found in iperf3, an Internet Protocol bandwidth measuring tool. Bad handling of UTF8/16 strings in an embedded library could cause a denial of service crash or execution of arbitrary code by...

AZL-7275 CVE-2019-17362 affecting package libtomcrypt for versions less than 1.18.2-9

In LibTomCrypt through 1.18.2, the derdecodeutf8string function in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service out-of-bounds read and crash or read information from other memory locations via...

UBUNTU-CVE-2019-1010176

JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function litchartoutf8bytes jerry-core/lit/lit-char-helpers.c:377. The attack vector is: executing crafted...

PT-2019-11495

Name of the Vulnerable Software and Affected Versions: JerryScript versions prior to the version after commit 505dace719aebb3308a3af223cfaa985159efae0 Description: The issue is related to a buffer overflow, which can lead to denial of service and possibly arbitrary code execution. This occurs whe...

Denial Of Service (DoS)

flask is vulnerable to denial of service. An attacker is able to crash the application from an unexpected memory usage by submitting malicious JSON data containing non-UTF8 charatcers...

PT-2019-13105

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.4 Description The issue is a buffer over-read in the nxt utf8 decode function located in nxt/nxt utf8.c. This problem arises after the fix for a previous issue is applied. Recommendations For versions prior to 0.3.4,...

PT-2019-12698

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.2 Description The issue is related to a heap-based buffer over-read in the nxt utf8 decode function, located in nxt/nxt utf8.c. This function is part of njs, which is used in NGINX. Recommendations For versions prior ...

PT-2019-12697

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.2 Description The issue is a heap-based buffer overflow in the nxt utf8 encode function in nxt utf8.c. This function is part of njs, which is used in NGINX. Recommendations For versions prior to 0.3.2, update to versi...

PT-2019-12520

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.2 Description The issue is related to a segmentation fault in String.prototype.toBytes for negative arguments. It is connected to the functions nxt utf8 next in nxt/nxt utf8.h and njs string offset in njs/njs string.c...

FreeBSD : dovecot -- json encoder crash (a64aa22f-61ec-11e9-85b9-a4badb296695)

Aki Tuomi reports : CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject...

dovecot -- json encoder crash

Aki Tuomi reports: CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject...

Cross-site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of validation of UTF8 on the filename, allowing a remote attacker to inject arbitrary Javascript into a victim's browser...

UBUNTU-CVE-2019-9687

PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp...

DEBIAN-CVE-2018-20763

In GPAC 0.7.1 and earlier, gftextgetutf8line in mediatools/textimport.c in libgpacstatic.a allows an out-of-bounds write because of missing szLineConv bounds checking...

CVE-2019-6691

phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...

PT-2019-18076

Name of the Vulnerable Software and Affected Versions DedeCMS version V57 UTF8 SP2 Description The issue allows remote attackers to execute arbitrary PHP code by uploading a file with a safe file extension and then renaming it with a mixed-case variation of the .php extension. For example, using...

CVE-2018-20430

GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function historyextract in plugins/ole2extractor.c, related to EXTRACTORcommonconverttoutf8 in common/convert.c...

PT-2019-5481

Name of the Vulnerable Software and Affected Versions GPAC versions 0.7.1 and earlier Description The issue is related to the gf text get utf8 line function in the GPAC multimedia platform, which allows an out-of-bounds write due to missing bounds checking for szLineConv. This can potentially...