Memory corruption

Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch...

Design/Logic Flaw

An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

ALPINE-CVE-2016-5199

An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

CVE-2016-5199

CVE-2016-5199 is a heap corruption issue in the FFmpeg MP4 decoder used by Chromium/Chrome. The off-by-one error can lead to a 0-size allocation and heap-pointer corruption via a crafted video file, potentially allowing remote code execution. Affected software includes Chrome as shipped on Mac, W...

CVE-2016-10145

Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy...

CVE-2016-9809

Off-by-one error in the gsth264parsesetcaps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read...

CVE-2016-9809

Off-by-one error in the gsth264parsesetcaps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read...

CVE-2016-9809

Off-by-one error in the gsth264parsesetcaps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read...

CVE-2016-10094

Off-by-one error in the t2preadwritepdfimagetile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image...

PT-2016-3137 · Imagemagick +2 · Imagemagick +2

Name of the Vulnerable Software and Affected Versions: ImageMagick affected versions not specified Description: The issue is caused by an off-by-one error in the coders/wpg.c component of ImageMagick. This error allows remote attackers to have an unspecified impact via vectors related to a string...

Design/Logic Flaw

QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...

CVE-2015-8701

QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...

CVE-2015-8701

QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...

CVE-2015-8701

CVE-2015-8701 affects QEMU with Rocker switch emulation. Affected path is tx_consume processing of TX descriptors; if a descriptor has more than ROCKER_TX_FRAGS_MAX (16) fragments, an off-by-one error can cause memory leakage on the host or crash the QEMU process, leading to DoS. Exploitation det...

CVE-2015-8701

QEMU aka Quick Emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit tx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16 fragments. A privileged user inside guest coul...

CVE-2016-5199

An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

UBUNTU-CVE-2016-5199

An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

CVE-2016-6676

Off-by-one error in CORE/HDD/src/wlanhddcfg.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service buffer overflow via a crafted application that makes a GETCFG ioctl call, aka Android intern...

CVE-2016-6675

Off-by-one error in CORE/HDD/src/wlanhddhostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service buffer overflow via a crafted application that makes a linkspeed ioctl call, aka Android...

CVE-2016-3882

Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service reboot via an access point that provides a crafted 1 Venue Group or 2 Venue Type value, aka internal bug 29464811...