20 matches found
CVE-2026-27144 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime...
CVE-2026-27144
CVE-2026-27144 is a Go compiler issue where a no-op interface conversion can bypass overlap checking, potentially causing memory corruption at runtime during memory moves. The public advisories tie this to Go 1.26 (and related 1.25 branch updates) and list it under SUSE security fixes as CVE-2026...
GO-2026-4867 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime...
CVE-2019-19907
HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy during parsing of ICal data...
SUSE CVE-2011-0990
Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to trigger a buffer overflow and modify internal data structures, and cause a denial of service plugin crash or...
CVE-2020-17361
An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided instead of throwing an exception. This could result in data being lost during the copy, with varying consequences depending on the subsequen...
CVE-2020-17361
An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided instead of throwing an exception. This could result in data being lost during the copy, with varying consequences depending on the subsequen...
PT-2020-14922 · Readytalk · Readytalk Avian
Name of the Vulnerable Software and Affected Versions: ReadyTalk Avian version 1.2.0 Description: An issue was discovered in the vm::arrayCopy method defined in classpath-common.h, which contains multiple boundary checks to prevent out-of-bounds memory read/write. However, two of these boundary...
CVE-2019-19907
HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy during parsing of ICal data...
Design/Logic Flaw
HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy during parsing of ICal data...
CVE-2019-19907
HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy during parsing of ICal data...
CVE-2019-19907
CVE-2019-19907 affects Kopano Groupware Core (Kopano Core) before 8.7.7. The vulnerability arises in HrAddFBBlock implemented in libfreebusy/freebusyutil.cpp, where an array copy during ICal data parsing can cause out-of-bounds access. Descriptions from NVD document a CVSS v3.1 base score of 9.8 ...
shopify-scripts: SIGSEGV in array_copy - array.c:71
File 2 as input causes a segfault in mruby. mruby crashes in arycopy array.c:71: Program received signal SIGSEGV, Segmentation fault. 0x000000000040e088 in arraycopy src=, size=, dst= at /tmp/mruby/src/array.c:71 71 dsti = srci; Test platform: Linux 3.16.0-4-amd64 1 SMP Debian 3.16.39-1+deb8u1...
shopify-scripts: Invalid memory write caused by incorrect upper bound in array_copy
Ok, here is a weird one! It only crashes in mruby, and can't be made to crash in mruby-engine as max memory possible to extend to is 256M which this requires more. The file is: values = 3,5,8 test = 1,6 results,= 1.2 values.each do |value| case value when test results 0x10000222d : movq %rdx, %ra...
CVE-2015-2504: Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to 1 execute arbitrary code via a crafted XAML browser application XBAP or 2 bypass Code Access Security restrictions via a crafted...
PT-2015-2030 · Microsoft · .Net Framework
Name of the Vulnerable Software and Affected Versions: Microsoft .NET Framework versions 2.0 SP2 through 4.6 Description: The issue is caused by improper object counting before performing an array copy, allowing remote attackers to execute arbitrary code or bypass Code Access Security restriction...
chromium-browser: memory corruption in V8
hydrogen.cc in Google V8, as used Google Chrome before 40.0.2214.91, does not properly handle arrays with holes, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via crafted JavaScript code that triggers an array copy...
Memory corruption
hydrogen.cc in Google V8, as used Google Chrome before 40.0.2214.91, does not properly handle arrays with holes, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via crafted JavaScript code that triggers an array copy...
OpenJDK: System.arraycopy() element race condition (Hotspot, 8029858)
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot...