CVE-2017-7223: Improper Restriction of Operations within the Bounds of a Memory Buffer

GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow of size 1 while attempting to unget an EOF character from the input stream, potentially leading to a program crash...

sqlite3: Global-buffer-overflow in sqlite3VdbeMemPrettyPrint

Detailed report: https://oss-fuzz.com/testcase?key=6749820112863232 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x000002b188a8 Crash State:...

sqlite3: Global-buffer-overflow in sqlite3VdbeMemPrettyPrint

Detailed report: https://oss-fuzz.com/testcase?key=6475706777206784 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000000860150 Crash State:...

sqlite3: Global-buffer-overflow in translateColumnToCopy

Detailed report: https://oss-fuzz.com/testcase?key=4848090467008512 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000002a01c3c Crash State:...

libreoffice: Global-buffer-overflow in ImplUnicodeToDBCS

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5976843305877504 Project: libreoffice Fuzzer: libFuzzerlibreofficewmffuzzer Fuzz target binary: wmffuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

libtsm: Global-buffer-overflow in vte_write_debug

Project: git://people.freedesktop.org/dvdhrm/libtsm Detailed report: https://oss-fuzz.com/testcase?key=4633251605905408 Project: libtsm Fuzzer: libFuzzerlibtsmfuzzer Fuzz target binary: libtsmfuzzer Job Type: libfuzzerasanlibtsm Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash...

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo firstChild; The function expects that the first child is going to be of type...

libtsm: Global-buffer-overflow in vte_write_debug

Project: git://people.freedesktop.org/dvdhrm/libtsm Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6258143222824960 Project: libtsm Fuzzer: libFuzzerlibtsmfuzzer Fuzz target binary: libtsmfuzzer Job Type: libfuzzerasanlibtsm Platform Id: linux Crash Type:...

libreoffice: Global-buffer-overflow in ImplDBCSToUnicode

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5695345388421120 Project: libreoffice Fuzzer: libFuzzerlibreofficewmffuzzer Fuzz target binary: wmffuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type...

openSUSE Security Update : w3m (openSUSE-2016-1457)

This update for w3m fixes the following security issues bsc1011293 : - CVE-2016-9622: w3m: null deref bsc1012021 - CVE-2016-9623: w3m: null deref bsc1012022 - CVE-2016-9624: w3m: near-null deref bsc1012023 - CVE-2016-9625: w3m: stack overflow bsc1012024 - CVE-2016-9626: w3m: stack overflow...

CVE-2016-9632

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service global buffer overflow and crash via a crafted HTML page...

CVE-2016-9630

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service global buffer overflow and crash via a crafted HTML page...

CVE-2016-9630: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service global buffer overflow and crash via a crafted HTML page...

CVE-2016-9632

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service global buffer overflow and crash via a crafted HTML page...

PT-2016-7802

Name of the Vulnerable Software and Affected Versions w3m versions prior to 0.5.3-33 Description An issue in w3m allows remote attackers to cause a denial of service, resulting in a global buffer overflow and crash, via a crafted HTML page. Recommendations For versions prior to 0.5.3-33, update t...

CVE-2016-9632

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service global buffer overflow and crash via a crafted HTML page...

libass: Global-buffer-overflow in ass_strtod

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5423111939817472 Target: libass Fuzzer: libFuzzerlibassfuzzer Fuzzer binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Global-buffer-overflow READ 8...

libtsm: Global-buffer-overflow in vte_write_debug

Project: git://people.freedesktop.org/dvdhrm/libtsm Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5429041452548096 Target: libtsm Fuzzer: libFuzzerlibtsmfuzzer Fuzzer binary: libtsmfuzzer Job Type: libfuzzerasanlibtsm Platform Id: linux Crash Type: Global-buffer-overflow...

libtsm: Global-buffer-overflow in vte_write_debug

Project: git://people.freedesktop.org/dvdhrm/libtsm Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5397754897498112 Target: libtsm Fuzzer: libFuzzerlibtsmfuzzer Fuzzer binary: libtsmfuzzer Job Type: libfuzzerasanlibtsm Platform Id: linux Crash Type: Global-buffer-overflow...

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 =...