CVE-2021-44482

An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to doverify in srunix/doverify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer...

CVE-2021-44482

CVE-2021-44482 affects YottaDB up to r1.32 and V7.0-000. The issue is a lack of input validation in calls to do_verify in sr_unix/do_verify.c, which can allow an attacker to jump to a NULL pointer by corrupting a function pointer. Documented impact includes potential high availability concerns du...

CVE-2021-44482

An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to doverify in srunix/doverify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer...

CVE-2021-44481

An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of parameter validation in calls to memcpy in checkandsettimeout in srunix/ztimeoutroutines.c allows attackers to attempt to read from a NULL pointer...

CVE-2021-44481

CVE-2021-44481 affects YottaDB (r1.32 and V7.0-000) and is caused by missing parameter validation in memcpy in sr_unix/ztimeoutroutines.c (function check_and_set_timeout), enabling an attempt to read from a NULL pointer. The available connected documents specify the vulnerable component and root ...

CVE-2021-44481

An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of parameter validation in calls to memcpy in checkandsettimeout in srunix/ztimeoutroutines.c allows attackers to attempt to read from a NULL pointer...

PT-2022-12135 · Yottadb · Yottadb

Name of the Vulnerable Software and Affected Versions: YottaDB versions prior to r1.32 and V7.0-000 Description: An issue was discovered that allows attackers to control the size and input to calls to memcpy in op fnfnumber in sr port/op fnfnumber.c using crafted input. This can lead to memory...

PT-2022-12137

Name of the Vulnerable Software and Affected Versions YottaDB versions through r1.32 and V7.0-000 Description An issue was discovered where attackers can cause a calculation of the size of calls to memset in op fnj3 in sr port/op fnj3.c to result in an extremely large value. This can cause a...

CVE-2021-44503: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause a call to vaarg on an empty variadic parameter list, most likely causing a memory segmentation fault...

CVE-2021-44497: Use After Free

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, can cause the bounds of a for loop to be miscalculated, which leads to a use after free condition a pointer is pushed into previously free memory by the loop...

CVE-2021-44509: Integer Underflow (Wrap or Wraparound)

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, attackers can cause an integer underflow of the size of calls to memset in opfnj3 in srport/opfnj3.c in order to cause a segmentation fault and crash the application...

CVE-2021-44496: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can control the size variable and buffer that is passed to a call to memcpy. An attacker can use this to overwrite key data structures and gain control of the flow of execution...

CVE-2021-44485: NULL Pointer Dereference

An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of NULL checks in tripgen in srport/emitcode.c allows attackers to crash the application by dereferencing a NULL pointer...

CVE-2021-44500: Divide By Zero

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. A lack of input validation in calls to ebdiv in srport/ebmuldiv.c allows attackers to crash the application by performing a divide by zero...

CVE-2021-44492: NULL Pointer Dereference

An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, attackers can cause a type to be incorrectly initialized in the function fincr in srport/fincr.c and cause a crash due to a NULL pointer dereference...

CVE-2021-44502: Allocation of Resources Without Limits or Throttling

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can control the size of a memset that occurs in calls to utilformat in srunix/utiloutput.c...

YottaDB 输入验证错误漏洞

YottaDB is a real-time database from YottaDB, Inc. A security vulnerability exists in YottaDB due to a lack of input validation when calling ebdiv in srport/ebmuldiv.c. An attacker could exploit this vulnerability to crash the application by performing a division by zero...

CVE-2021-44490: Incorrect Calculation

An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in opfnj3 in srport/opfnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application. This is a "- di...

CVE-2021-44482: Improper Input Validation

An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to doverify in srunix/doverify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer...

PT-2022-12133

Name of the Vulnerable Software and Affected Versions YottaDB versions through r1.32 and V7.0-000 Description An issue was discovered that allows attackers to manipulate the value of a function pointer used in op write in sr port/op write.c using crafted input, which can lead to control of the fl...