PT-2018-10401 · Tinyxml2 +2 · Tinyxml2 +2

Name of the Vulnerable Software and Affected Versions: TinyXML2 version 6.2.0 Description: The issue is related to a heap-based buffer over-read in the XMLDocument::Parse function. However, the developers of TinyXML2 have determined that the reported issue is due to improper use of the library an...

php: heap-based buffer over-read in DateInterval

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash...

DEBIAN-CVE-2014-0044

The opuspacketgetsamplesperframe function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service crash via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read aka "out-of-bounds array...

UBUNTU-CVE-2014-0044

The opuspacketgetsamplesperframe function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service crash via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read aka "out-of-bounds array...

UBUNTU-CVE-2013-7205

Off-by-one error in the processcgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service crash via a long string in the last key value in the variable list,...

freetype: heap buffer over-read in BDF parsing _bdf_parse_glyphs() (#37906)

The bdfparseglyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read...

kdelibs: Heap-based buffer over-read when calculating dimensions of the canvas within the scale loop

khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service crash and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read...

Mozilla: Out-of-bounds read in format-number in XSLT (MFSA 2012-65)

The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that...

Mozilla: Out-of-bounds read in format-number in XSLT (MFSA 2012-65)

The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that...

freetype: heap buffer over-read in BDF parsing _bdf_is_atom() (#35597, #35598)

FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid heap read operation and memory corruption or possibly execute arbitrary code via crafted property data in a BDF font...

freetype: heap buffer over-read in BDF parsing _bdf_parse_glyphs() (#35599, #35600)

FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid heap read operation and memory corruption or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font...

freetype: heap buffer over-read in Type1 parser parse_subrs() (#35606)

FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid heap read operation and memory corruption or possibly execute arbitrary code via crafted dictionary data in a Type 1 font...