CVE-2018-13785

In libpng 1.6.34, a wrong calculation of rowfactor in the pngcheckchunklength function pngrutil.c may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service...

UBUNTU-CVE-2018-5848

In the function wmisetie, the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ielen' argument can cause a buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

UBUNTU-CVE-2017-1000450

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier...

ALPINE-CVE-2017-5953

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow...

Internet Bug Bounty: 3 heap corruptions in PHP

73208 integer overflow in imap8bit caused heap corruption https://bugs.php.net/bug.php?id=73208 73082 string length overflow in mbencode function https://bugs.php.net/bug.php?id=73082 73174 heap overflow in phppcrereplaceimpl https://bugs.php.net/bug.php?id=73174 If you want to verify email...

Halliburton LogView Pro Remote Code Execution Vulnerability

Halliburton LogView is a comprehensive file format processing software. A remote code execution vulnerability exists in Halliburton LogView Pro. Due to a dynamic link library AXCGMV.ocx in the software in the call to process the file, the file reading is not controlled for the length of the file,...

Tomcat/JBossWeb: Request smuggling via malicious content length header

It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the...

openSUSE Security Update : kernel (openSUSE-SU-2013:1971-1)

The Linux Kernel was updated to fix various security issues and bugs. - sctp: Use correct sideffect command in duplicate cookie handling bnc826102, CVE-2013-2206. - Drivers: hv: util: Fix a bug in util version negotiation code bnc838346. - vmxnet3: prevent div-by-zero panic when ring resizing...

DEBIAN-CVE-2013-6487

Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu gg parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow...

UBUNTU-CVE-2013-5018

The isasn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1length function, which allows remote attackers to cause a denial of service segmentation fault via a 1 XAuth username, 2 EAP identity, or 3 PEM encoded file that starts with a 0x04, 0x30,...

ruby: integer overflow in rb_ary_splice/update/replace() - beg + rlen

Integer overflow in the 1 rbarysplice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2; and 2 the rbaryreplace function in 1.6.x allows context-dependent attackers to trigger memory corruption, aka the "beg +...

MailEnable HTTPMail < 1.2 Content-Length Overflow Vulnerability - Active Check

MailEnable is prone to a Content-Length overflow vulnerability. SPDX-FileCopyrightText: 2004 George A. Theall Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MySQL < 4.0.21 Buffer Overflow Vulnerability

MySQL is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mysql:mysql"; ifdescription...

Apache mod_proxy Content-Length Overflow

The remote web server appears to be running a version of Apache that is older than version 1.3.32. This version is reportedly vulnerable to a heap-based buffer overflow in proxyutil.c for modproxy. This issue may lead remote attackers to cause a denial of service and possibly execute arbitrary co...

MySQL < 4.0.21 mysql_real_connect() Function Remote Overflow

The remote host is running a version of MySQL that is older than 4.0.21. MySQL is a database that runs on both Linux/BSD and Windows platforms. This version is vulnerable to a length overflow within it's mysqlrealconnect function. The overflow is due to an error in the processing of a return Doma...