CVE-2017-9052: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarfformsdata is due to a failure to check a pointer for being in bounds in a few places in this function and a failure in a check in dwarfattrlist...

PT-2017-18672

Name of the Vulnerable Software and Affected Versions libdwarf affected versions not specified Description A heap-based buffer over-read issue was discovered in the dwarf read loc expr op function due to a failure to check a pointer for being in bounds. Recommendations At the moment, there is no...

CVE-2017-9053: Out-of-bounds Read

An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarfreadlocexprop is due to a failure to check a pointer for being in bounds in a few places in this function...

PT-2017-18664

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.28 Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, by providing a crafted ELF file. This is related to the mishandling of MIPS...

PT-2017-18673

Name of the Vulnerable Software and Affected Versions libdwarf version 2017-03-21 Description A heap-based buffer over-read issue was discovered in the dwarf decode s leb128 chk function, where a byte pointer was dereferenced before being checked for bounds, leading to the over-read...

PT-2017-18674

Name of the Vulnerable Software and Affected Versions libdwarf affected versions not specified Description A heap-based buffer over-read issue was discovered in the dwarf formsdata function due to unchecked data types, leading to an out-of-bounds access. Recommendations At the moment, there is no...

PT-2017-18675

Name of the Vulnerable Software and Affected Versions ytnef versions prior to 1.9.3 ALT Linux affected versions not specified Description The issue is related to a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c. Recommendations For ytnef...

PT-2017-18671

Name of the Vulnerable Software and Affected Versions libdwarf version 2017-03-21 Description A heap-based buffer over-read issue was discovered in the dwarf formsdata function due to a failure to check a pointer for being in bounds and a failure in a check in the dwarf attr list function...

PT-2017-18661

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.28 Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer over-read and application crash, via a crafted ELF file. This is related to the byte get little endian...

CVE-2017-9038: Out-of-bounds Read

GNU Binutils 2.28 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted ELF file, related to the bytegetlittleendian function in elfcomm.c, the getunwindsectionword function in readelf.c, and ARM unwind information that contains inval...

CVE-2017-9058: Out-of-bounds Read

In libytnef in ytnef through 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c...

CVE-2017-9049: Out-of-bounds Read

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398...

CVE-2017-9050: Out-of-bounds Read

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839...

Copy-Paste Vulnerability (CPV) Through Libxml2

nokogiri uses the libxml2 C library. The version that nokogiri uses is vulnerable to CVE-2016-1838 which allows a malicious user to pass a XML document to the application, triggering a heap-based buffer over-read causing it to crash. This is triggered through the xmlPArserPrintFileContextInternal...

Debian DLA-942-1 : jbig2dec security update

CVE-2017-7885 Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service application crash or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2decodesymboldict function in jbig2symboldict.c in libjbig2dec.a during...

CVE-2016-10349

The archivele32dec function in archiveendian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file...

CVE-2016-10350

The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file...

Heap overflow

The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service heap-based buffer over-read or possibly have unspecified other impact via a crafted PDF file...

CVE-2017-8787

The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service heap-based buffer over-read or possibly have unspecified other impact via a crafted PDF file...

CVE-2017-8787

The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service heap-based buffer over-read or possibly have unspecified other impact via a crafted PDF file...