CVE-2015-3239

CVE-2015-3239 affects libunwind 1.1 through multiple advisories, caused by an off-by-one error in dwarf_to_unw_regnum (include/dwarf_i.h). The issue can allow a local attacker to cause a denial of service or execute arbitrary code via invalid dwarf opcodes; IBM’s bulletin notes a heap-based overf...

CVE-2015-3239

Off-by-one error in the dwarftounwregnum function in include/dwarfi.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes...

CVE-2015-3239: Undefined Security Weakness

Off-by-one error in the dwarftounwregnum function in include/dwarfi.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes...

PT-2015-6116

Name of the Vulnerable Software and Affected Versions libunwind version 1.1 Description The issue is related to an off-by-one error in the dwarf to unw regnum function, which could potentially cause an error when reading untrusted binaries or dwarf debug info data. It is unlikely that any...

Kernel: HID: off by one error in various _report_fixup routines

Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled HID reports with an invalid...

Internet Bug Bounty: pngcrush_measure_idat() off-by-one error (CVE-2015-2158)

This is an off-by-one error in the "pngcrushmeasureidat" function in pngcrush.c, introduced by commit http://sourceforge.net/p/pmt/code/ci/e1a36a9639e2db16494d90459c7c2b78677a20bf/ in version 1.7.83. The code in pngcrush.c line 7405: if length = length; ib-- buffib = 0; If length is 0, the last...

CVE-2015-4471

Off-by-one error in the lzxddecompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer under-read and application crash via a crafted CAB archive...

Code injection

Off-by-one error in the READENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted CHM file...

UBUNTU-CVE-2015-4470

Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer over-read and application crash via a crafted CAB archive...

CVE-2015-4471

Off-by-one error in the lzxddecompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer under-read and application crash via a crafted CAB archive...

CVE-2015-4471

Off-by-one error in the lzxddecompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer under-read and application crash via a crafted CAB archive...

CVE-2015-4472

Off-by-one error in the READENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted CHM file...

CVE-2015-4472: Undefined Security Weakness

Off-by-one error in the READENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted CHM file...

CVE-2015-4470: Undefined Security Weakness

Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer over-read and application crash via a crafted CAB archive...

Mandriva Linux Security Advisory : apache-mod_wsgi (MDVSA-2015:180)

Updated apache-modwsgi package fixes security vulnerabilities : apache-modwsgi before 4.2.4 contained an off-by-one error in applying a limit to the number of supplementary groups allowed for a daemon process group. The result could be that if more groups than the operating system allowed were...

CVE-2015-1066

Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app...

Code injection

Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app...

CVE-2015-1066: Undefined Security Weakness

Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app...

PT-2015-1268

Name of the Vulnerable Software and Affected Versions OS X versions through 10.10.2 Description The issue is related to an off-by-one error in the IOAcceleratorFamily component, which allows attackers to execute arbitrary code in a privileged context via a crafted app. This can be exploited by an...

PT-2017-6554

Name of the Vulnerable Software and Affected Versions pngcrush versions prior to 1.7.84 Description The issue is caused by an off-by-one error in the pngcrush measure idat function, which can be exploited by remote attackers using a crafted PNG file. This could lead to a denial of service,...