CVE-2025-47806

CVE-2025-47806 affects the GStreamer base plugins’ subparse plugin, specifically the parse_subrip_time function, which can write past the bounds of a stack buffer in releases up to 1.26.1. This may cause a crash/DoS. Public advisories confirm fixes in downstream packaging: Debian 11 bullseye (gst...

CVE-2025-47808

CVE-2025-47808 affects GStreamer’s subparse plugin (part of gst-plugins-base1.0) up to version 1.26.1, where tmplayer_parse_line may dereference a NULL pointer, causing a crash. Connected advisories confirm the same issue in the subparse plugin and list fixes across distributions: Debian LTS DLA-...

CVE-2023-49809

Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled...

Design/Logic Flaw

Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled...

CVE-2023-49809

Mattermost exposes a vulnerability CVE-2023-49809 where handling a null request body on the /add endpoint can crash the plugin after repeated requests. Connected sources corroborate that this affects Mattermost and results in a denial of service-like behavior (plugin disabled after several attemp...

PT-2023-31365 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to handle a null request body in the "/add" endpoint. This allows a simple member to send a request with a null request body to the endpoint,...

CVE-2023-28812

There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers installed with this plug-in, which could lead to arbitrary code execution or cause process exception of the plug-in...

CVE-2023-5967

Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin...

CVE-2020-23558

IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptionsW+0x0000000000007f4b...

DEBIAN-CVE-2017-8073

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the ircctcpdccfilenamewithoutquotes function during quote removal, with a buffer overflow...

USN-3044-1 firefox vulnerabilities

Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtain sensitive information. CVE-2016-0718...

Fedora 21 : webkitgtk-2.4.8-1.fc21 / webkitgtk3-2.4.8-1.fc21 (2015-0500)

Fix SSL connection issues with some websites after the POODLE vulnerability fix. - Fix a crash when loading flash plugins. - Fix build on GNU Hurd - Fix build on OS X. - Fix documentation of webkitprintoperationgetpagesetup. - Security fixes: CVE-2014-1344, CVE-2014-1384, CVE-2014-1385,...

Scientific Linux Security Update : nspluginwrapper on SL6.x i386/x86_64 (20121113)

It was not possible for plug-ins wrapped by nspluginwrapper to discover whether the browser was running in Private Browsing mode. This flaw could lead to plug-ins wrapped by nspluginwrapper using normal mode while they were expected to run in Private Browsing mode. CVE-2011-2486 This update also...

pidgin: Client abort in the MSN protocol plug-in by attempt to display certain, not UTF-8 encoded text

The msnoimreporttouser function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service application crash via an OIM message that lacks UTF-8 encoding...

flash-plugin: crash and potential arbitrary code execution (APSB11-07)

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll aka AuthPlayLib.bundle in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x...

CVE-2011-0992

Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service plugin crash or obtain sensitive information via vectors related to member data in a resurrected MonoThread instance...

CVE-2011-0989

The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which allows remote attackers to modify internal read-only data structures, and cause a denial of service plugin crash or...

CVE-2011-0990

Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to trigger a buffer overflow and modify internal data structures, and cause a denial of service plugin crash or...

flash-plugin: "possible player crash" affects also v9.x versions of Adobe Flash Player

Adobe Flash Player 9 before 9.0.277.0 on unspecified UNIX platforms allows attackers to cause a denial of service via unknown vectors...

CVE-2009-3932

The Gears plugin in Google Chrome before 3.0.195.32 allows user-assisted remote attackers to cause a denial of service memory corruption and plugin crash or possibly execute arbitrary code via unspecified use of the Gears SQL API, related to putting "SQL metadata into a bad state."...