UBUNTU-CVE-2018-20673

The demangletemplate function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability for "Create an array for saving the template argument values" that can trigger a heap-based buffer overflow, as demonstrated by nm...

SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2018:2305-1)

This update for ffmpeg fixes the following issues: Security issues fixed : - CVE-2018-13302: Fixed out of array access issue bsc1100356. - CVE-2018-1999010: Fixed multiple out of array access vulnerabilities in the mms protocol that could result in accessing out of bound data via specially crafte...

WebKit JSC - 'AbstractValue::set' Use-After-Free

indexingType; mtype = speculationFromStructurestructure.get; mvalue = JSValue; checkConsistency; assertIsRegisteredgraph; It works out marrayModes using structure-indexingType instead of structure-indexingMode. As structure-indexingType masks out the CopyOnWrite flag, which indicates that the...

WebKit JSC - AbstractValue::set Use-After-Free

WebKit JSC - AbstractValue::set Use-After-Free indexingType; mtype = speculationFromStructurestructure.get; mvalue = JSValue; checkConsistency; assertIsRegisteredgraph; It works out marrayModes using structure-indexingType instead of structure-indexingMode. As structure-indexingType masks out the...

WebKit JSC AbstractValue::set Use-After-Free Exploit

WebKit: JSC: A bug in AbstractValue::set CVE-2018-4443 void AbstractValue::setGraph& graph, RegisteredStructure structure RELEASEASSERTstructure; mstructure = structure; marrayModes = asArrayModesstructure-indexingType; mtype = speculationFromStructurestructure.get; mvalue = JSValue;...

WebKit JSC JSArray::shiftCountWithArrayStorage Out-Of-Band Read / Write Exploit

WebKit: JSC: A bug in JSArray::shiftCountWithArrayStorage CVE-2018-4441 bool JSArray::shiftCountWithArrayStorageVM& vm, unsigned startIndex, unsigned count, ArrayStorage storage unsigned oldLength = storage-length; RELEASEASSERTcount hasHoles && this-structurevm-holesMustForwardToPrototypevm, thi...

Security feature bypass

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supplied value in PHP's GET global variable array using PHP's strcmp function. By adding "" to the end of "key" in the URL when accessing API functions...

CVE-2018-20486

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...

The vulnerability of the Qualcomm operating system Android component, which allows a hacker to trigger a buffer overflow in memory

The vulnerability of the Qualcomm Android operating system is related to array indexing errors. Exploiting this vulnerability can allow attackers to cause buffer overflows in memory by using malicious XML data in the firehose directory...

CVE-2018-20421

Go Ethereum aka geth 1.8.19 allows attackers to cause a denial of service memory consumption by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly mstore " followed by a "c0xC800000 =...

CVE-2018-20421

Go Ethereum aka geth 1.8.19 allows attackers to cause a denial of service memory consumption by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly mstore " followed by a "c0xC800000 =...

Go Ethereum Denial of Service Vulnerability (CNVD-2019-04903)

Go Ethereum aka geth is an open source implementation of the Ether protocol written in the Go language. A security vulnerability exists in Go Ethereum version 1.8.19. An attacker can exploit this vulnerability to cause a denial of service memory consumption by overwriting the length of a dynamic...

CVE-2018-19507

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

CVE-2018-19507

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

CVE-2018-20196

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the SM array is mishandled...

DEBIAN-CVE-2018-20196

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the SM array is mishandled...

Stack overflow

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the SM array is mishandled...

UBUNTU-CVE-2018-20196

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the SM array is mishandled...

CVE-2018-20196

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the SM array is mishandled...

CVE-2018-20196

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the SM array is mishandled...