The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to the use of memory after it is freed. These vulnerabilities allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the png_image_free function in the PNG bitmap handling library libpng, which allows a hacker to cause a service failure.

The vulnerability of the pngimagefree function in the PNG bitmap handling library libpng is related to the call to the freed memory area by the destructor of pngimagefreefunction. Exploiting this vulnerability could allow an attacker to cause a service failure...

Heap overflow

RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three 3 different Improper Clearing of Heap Memory Before Release vulnerability, also known as 'Heap Inspection vulnerability'. A malicious remote user could potentially exploit this vulnerability to extract informati...

CVE-2019-10082

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown...

About the security content of watchOS 5.3.2

About the security content of watchOS 5.3.2 This document describes the security content of watchOS 5.3.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

curl: Potential invocation of qsort on uninitialized memory during cookie save

Summary: If cookiejar is set, cookies are written to file at exit. That is done by the function cookieoutput in cookie.c. The cookies are sorted before being stored, using qsort on a temporary array. That temporary array is uninitialized gotten from malloc at...

The vulnerability of the Windows operating system’s kernel allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Windows operating system’s kernel is related to memory initialization errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created application...

Remote code execution

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1208...

CVE-2019-1284

CVE-2019-1284 is a DirectX elevation of privilege vulnerability. The issue arises from improper handling of objects in memory within DirectX, allowing a logged-on attacker to run arbitrary code in kernel mode via a specially crafted application, potentially enabling full control over the affected...

CVE-2019-1278

Technical details about CVE-2019-1278 (affected product, vulnerable component, impact, exploitability) are not provided in the supplied documents. Monitor for updates from official advisories.

CURL-CVE-2019-5482 TFTP small blocksize heap buffer overflow

libcurl contains a heap buffer overflow in the function tftpreceivepacket that receives data from a TFTP server. It can call recvfrom with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is controlled b...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to disclose protected information

The vulnerability of the Windows operating system’s kernel is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

CVE-2019-15551

CVE-2019-15551 concerns the Rust smallvec crate prior to 0.6.10. The issue is a double free when growing a SmallVec whose current capacity matches the growth size, potentially enabling use-after-free conditions. Documents from multiple sources (GHSA advisory, Red Hat, SUSE, OSV, Debian, and NVD) ...

CVE-2018-18056

The CVE-2018-18056 entry concerns TI TM4C, MSP432E and MSP432P microcontroller series. The issue stems from the eXecute-Only-Memory (XOM) implementation, which prevents code reads on protected memory by using bus faults, yet allows single-step/breakpoint use in XOM-protected flash. This enables a...

Design/Logic Flaw

An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aacgethbainfo does not initialize the hbainfo structure...

Privilege escalation

An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173, CVE-2019-1174, CVE-2019-1177, CVE-2019-1178, CVE-2019-1179, CVE-2019-1180, CVE-2019-1184,...

KLA11738 Multiple vulnerabilities in Opera

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. DoS vulnerability in V8 component can be exploited remotely via special crafted webpage. 2. OSI...

CVE-2019-1117

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124,...

CVE-2019-2263

This CVE (CVE-2019-2263) affects Qualcomm/Qualcomm Snapdragon kernel components, specifically a use-after-free in the diag driver that can access freed memory during reads. The issue spans numerous Snapdragon generations and device families (e.g., IPQ4019, IPQ8064, MDM9xxx, SDM/SDx series). Root ...

Remote Code Execution (RCE)

ChakraCore is vulnerable to remote code execution RCE. This is due to how the scripting engine handles objects in memory, allowing a remote attacker to execute arbitrary code in the context of the current user. This CVE ID is different from CVE-2019-1062, CVE-2019-1092, CVE-2019-1103 and...