OpenJDK: Excessive memory allocation in TIFF*Decompressor (ImageIO, 8274096)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...

Xen 命令注入漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. A command injection vulnerability exists ...

CVE-2021-34854

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Corel Parallels Desktop 访问控制错误漏洞

Corel Parallels Desktop is a suite of virtual machine software for the macOS platform from Corel Canada. An Access Control Error vulnerability exists in Corel Parallels Desktop Toolgate that stems from a lack of proper validation of user-supplied data in the Toolgate component. This could lead to...

USN-4759-1 glib2.0 vulnerabilities

Krzesimir Nowak discovered that GLib incorrectly handled certain large buffers. A remote attacker could use this issue to cause applications linked to GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2021-27218 Kevin Backhouse discovered that GLib incorrect...

libuv: buffer overflow in realpath

A flaw has been found in libuv. The realpath implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2019-15234

SHAREit through 4.0.6.177 does not check the full message length from the received packet header which is used to allocate memory for the next set of data. This could lead to a system denial of service due to uncontrolled memory allocation. This is different from CVE-2019-14941...

Netty Buffer Overflow Vulnerability

Netty is a non-blocking I/O client-server framework from the Netty community, which is primarily used for developing Java web applications such as protocol servers and clients. A buffer overflow vulnerability exists in ZlibDecoders in versions 4.1.x prior to Netty 4.1.46, which stems from a...

kernel: Null pointer dereference in the sound/usb/line6/pcm.c

A NULL pointer dereference flaw was found in the way the LINE6 drivers in the Linux kernel allocated buffers for USB packets. This flaw allows an attacker with physical access to the system to crash the system...

Design/Logic Flaw

JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a remote invocation of an OOM error message because of Uncontrolled Memory Allocation...

CVE-2019-13112

A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service crash due to an std::badalloc exception via a crafted PNG image file...

PT-2019-5329 · Exiv2 +8 · Exiv2 +8

Name of the Vulnerable Software and Affected Versions: Exiv2 versions prior to 0.27.2 Description: The issue is related to an uncontrolled memory allocation in the PngChunk::parseChunkContent function of the Exiv2 library, which can be exploited by an attacker to cause a denial of service via a...

The vulnerability of the COM object dfact.dll in the MasterSCADA software package allows a hacker to trigger an emergency termination of the program.

The vulnerability of the COM object dfact.dll in the image processing method of the SetImage classes BmpImager, GifImager, AviImager, JpgImager in the MasterSCADA software package arises due to the use of a insecure memory allocation function on the stack allocaprobe16. Exploiting this...

systemd: stack overflow when receiving many journald entries

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash...

CVE-2018-16864

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges...

UBUNTU-CVE-2018-20659

An issue was discovered in Bento4 1.5.1-627. The AP4StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive memory allocation when called from AP4AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp, as demonstrated by mp42hls...

PT-2018-3814

Name of the Vulnerable Software and Affected Versions libpcap versions prior to 1.9.1 Description The issue is related to the sf-pcapng.c component in the libpcap library, which does not properly validate the PHB header length before allocating memory. This allows a remote attacker to impact data...

PoDoFo Denial of Service Vulnerability (CNVD-2018-03969)

PoDoFo is an open source , written in C++ using the PDF file format library . A denial of service vulnerability exists in the 'PdfParser::ReadXRefSubsection' function in the base/PdfParser.cpp file in version 0.9.5 of PoDoFo, which stems from the program's failure to control memory allocation. A...

Huawei DP300 XML Parser Denial of Service Vulnerability

Huawei DP300 is a video conferencing endpoint from Huawei, a Chinese company. A denial of service vulnerability exists in the Huawei DP300 XML parser due to the product's failure to adequately checksum the malloc call to request memory. An authenticated, local attacker could launch a denial of...

OpenJDK: unbounded memory allocation in JAXWSExceptionBase deserialization (JAX-WS, 8181100)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAX-WS. Supported versions that are affected are Java SE: 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protoco...