CVE-2023-37343

CVE-2023-37343 affects Kofax Power PDF: JP2 file parsing flaw allows out-of-bounds write, enabling remote code execution. Root cause: insufficient validation of JP2 data leading to write past the end of an allocated object during parsing. Impact is high (code execution in target process) with loc...

CVE-2023-37342

CVE-2023-37342 affects Kofax Power PDF. The flaw is a heap-based buffer overflow in PNG file parsing due to insufficient validation of user-supplied data length, enabling remote code execution when a user opens a malicious PNG or visits a crafted page. The issue impacts parsing logic in Power PDF...

CVE-2023-37338

Kofax Power PDF GIF file parsing vulnerability (CVE-2023-37338) allows local or remote code execution via an out-of-bounds write during GIF parsing. The flaw stems from insufficient validation of GIF data, enabling a write past the end of an allocated object and arbitrary code execution in the pr...

CVE-2023-37335

CVE-2023-37335 affects Kofax Power PDF BMP file parsing. The flaw is a heap-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying it into a fixed-length heap buffer. This can allow an attacker to execute arbitrary code in the context of the cur...

CVE-2023-37333

Kofax Power PDF is affected by a memory corruption vulnerability in the PCX file parsing path that can lead to remote code execution. The flaw arises from insufficient validation of user-supplied PCX data, allowing an attacker to execute code in the context of the vulnerable process. Exploitation...

CVE-2023-37329

CVE-2023-37329 concerns a heap-based buffer overflow in GStreamer’s SRT subtitle file parsing. The flaw stems from insufficient validation of the length of user-supplied data before copying to a heap buffer, enabling remote code execution in the affected process. This is tied to ZDI-CAN-20968. Co...

CVE-2023-37328

GStreamer PGS subtitle parsing flaw (CVE-2023-37328) causes a heap-based buffer overflow that can enable remote code execution. It affects gstreamer1-plugins-base and related GStreamer components; the issue arises from inadequate validation of user-supplied data length during PGS subtitle parsing...

CVE-2023-37326

CVE-2023-37326 affects D-Link DAP-2622 routers due to a stack-based buffer overflow in the DDP Set Wireless Info Password pathway. The flaw arises from improper validation of user-supplied data length before copying into a fixed-length stack buffer, enabling remote code execution with root privil...

CVE-2023-37327

Consolidated: CVE-2023-37327 targets GStreamer, specifically the FLAC file parsing path. The flaw is an integer overflow while handling FLAC data, leading to a heap overwrite and remote code execution. The issue affects gstreamer1-plugins-good (and related GStreamer components) and has had vendor...

CVE-2023-37321

CVE-2023-37321 affects D-Link DAP-2622 routers via the DDP set SSID List RADIUS Secret, caused by a stack-based buffer overflow due to improper validation of user-supplied data length. This allows network-adjacent attackers to execute arbitrary code with root privileges, without authentication. T...

CVE-2023-37317

The CVE-2023-37317 entry concerns D-Link DAP-2622 routers with a stack-based buffer overflow in the DDP service when processing IPv6 Address Primary DNS data. The flaw arises from insufficient validation of user-supplied data prior to copying into a fixed-length stack buffer, enabling a network-a...

CVE-2023-37315

CVE-2023-37315 affects D-Link DAP-2622 routers. The DDP Set IPv6 Address Authentication Password vulnerability stems from improper validation of user-supplied data length copied into a fixed-length stack buffer, enabling remote code execution as root. Exploitation appears possible over a network-...

CVE-2023-37313

CVE-2023-37313 affects D-Link DAP-2622 routers. The DDP service fails to validate the length of user-supplied data when handling the IPv4 address/auth username, causing a stack-based buffer overflow that allows remote code execution with root privileges. This vulnerability can be exploited by net...

CVE-2023-37311

DVE-2023-37311 affects D-Link DAP-2622 routers. The DDP service allows a stack-based buffer overflow on user-supplied data, enabling remote code execution with root privileges and no authentication. Public documentation consistently cites this as a stack-based overflow in the DDP Set Device Info ...

CVE-2023-35754

CVE-2023-35754 affects D-Link DAP-2622 routers, via a stack-based buffer overflow in the DDP Set AG Profile NMS URL. The flaw arises from improper validation of user-supplied data length before copying to a fixed-length stack buffer, allowing network-adjacent attackers to execute code with root p...

CVE-2023-35752

CVE-2023-35752 affects D-Link DAP-2622 via the DDP service, due to improper validation of user-supplied data leading to a stack-based buffer overflow and remote code execution with root privileges. Attack requires network adjacency and no authentication. Documented CVSS v3.1/3.0 score: 8.8 (HIGH)...

CVE-2023-35751

Affected product: D-Link DAP-2622 (DDP service). Vulnerability: Stack-based buffer overflow caused by improper validation of the length of user-supplied data prior to copying it into a fixed-length stack buffer, leading to remote code execution in the context of root. Impact/conditions: Remote co...

CVE-2023-35750

CVE-2023-35750 affects D-Link DAP-2622 routers. The flaw resides in the DDP service, enabling information disclosure via lack of authentication. An unauthenticated, network-adjacent attacker can access credentials stored by the device, with potential to further compromise. Public metrics indicate...

CVE-2023-35746

CVE-2023-35746 affects the D-Link DAP-2622 DDP firmware. The flaw resides in the DDP service where insufficient validation of user-supplied data length leads to a stack-based buffer overflow, enabling remote code execution with root privileges. The attack is network-adjacent and requires no authe...

CVE-2023-35747

CVE-2023-35747 – D-Link DAP-2622 DDP vulnerability : The flaw is in the DDP service of the DAP-2622 routers, caused by improper validation of user-supplied data length before copying to a fixed-length stack-based buffer. This leads to a stack-based buffer overflow with the potential for Remote Co...