GNU Binutils Out-of-Bounds Read Vulnerability

GNU Binutils is a set of programming tools for creating and managing binary programs, object files, libraries, profile data and assembly source code. An out-of-bounds read vulnerability exists in the Binary File Descriptor BFD library i.e. libbfd used in GNU Binutils 2.32. An attacker can exploit...

MATIO out-of-bounds read and SEGV vulnerabilities (CNVD-2019-28411)

matio is a C library for reading and writing MATLAB MAT files. An out-of-bounds read and SEGV vulnerability exists in the MatVarReadNextInfo5 function in mat5.c in libmatio.a in matio 1.5.13. No detailed vulnerability details are provided at this time...

UBUNTU-CVE-2019-9074

An issue was discovered in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfdgetl32 in libbfd.c, when called from pex64getruntimefunction in pei-x8664.c...

DEBIAN-CVE-2019-9032

An issue was discovered in libmatio.a in matio aka MAT File I/O Library 1.5.13. There is an out-of-bounds write problem causing a SEGV in the function MatVarFree in mat.c...

UBUNTU-CVE-2019-9029

An issue was discovered in libmatio.a in matio aka MAT File I/O Library 1.5.13. There is an out-of-bounds read with a SEGV in the function MatVarReadNextInfo5 in mat5.c...

UBUNTU-CVE-2019-9032

An issue was discovered in libmatio.a in matio aka MAT File I/O Library 1.5.13. There is an out-of-bounds write problem causing a SEGV in the function MatVarFree in mat.c...

UBUNTU-CVE-2019-9038

An issue was discovered in libmatio.a in matio aka MAT File I/O Library 1.5.13. There is an out-of-bounds read problem with a SEGV in the function ReadNextCell in mat5.c...

MGASA-2019-0093 Updated zziplib packages fix security vulnerability

In ZZIPlib 0.13.67, there is a segmentation fault caused by invalid memory access in the zzipdiskfread function zzip/mmapped.c because the size variable is not validated against the amount of file-stored data CVE-2018-6381. An unaligned memory access bug was found in the way ZZIPlib handled ZIP...

Updated giflib packages fix security vulnerability

Null dereferences in main of gifclrmp. Heap Buffer Overflow-2 in function DGifDecompressLine in cgif.c. CVE-2018-11490 Segmentation fault in PrintCodeBlock. Segmentation fault of giftool reading a crafted file. Floating point exception in giftext utility. Heap buffer overflow in DumpScreen2RGB in...

Updated zziplib packages fix security vulnerability

In ZZIPlib 0.13.67, there is a segmentation fault caused by invalid memory access in the zzipdiskfread function zzip/mmapped.c because the size variable is not validated against the amount of file-stored data CVE-2018-6381. An unaligned memory access bug was found in the way ZZIPlib handled ZIP...

MGASA-2019-0096 Updated giflib packages fix security vulnerability

Null dereferences in main of gifclrmp. Heap Buffer Overflow-2 in function DGifDecompressLine in cgif.c. CVE-2018-11490 Segmentation fault in PrintCodeBlock. Segmentation fault of giftool reading a crafted file. Floating point exception in giftext utility. Heap buffer overflow in DumpScreen2RGB in...

MatrixSSL 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates

MatrixSSL 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates I happened to notice that a public X.509 certificate testcase for CVE-2014-1569 caused a stack buffer overflow in MatrixSSL. I cleaned up the testcase a bit, to make a better demonstration. You can test it with the certValidate...

Oracle Java Runtime Environment - Heap Out-of-Bounds glyph_CloseContour

Oracle Java Runtime Environment - Heap Out-of-Bounds Read During OTF Font Rendering in glyphCloseContour ---------------------------------------------------------------------------------- A heap-based out-of-bounds read was observed in Oracle Java Runtime Environment version 8u202 latest at the...

Oracle Java Runtime Environment - Heap Out-of-Bounds Read During OTF Font Rendering in glyph_CloseContour

A heap-based out-of-bounds read was observed in Oracle Java Runtime Environment version 8u202 latest at the time of this writing while fuzz-testing the processing of OpenType fonts. It manifests itself in the form of the following crash with AFL's libdislocator: --- cut --- gdb$ c Continuing...

Oracle Java Runtime Environment - Heap Out-of-Bounds Read During TTF Font Rendering in ExtractBitMap_blocClass

Oracle Java Runtime Environment - Heap Out-of-Bounds Read During TTF Font Rendering in ExtractBitMapblocClass A heap-based out-of-bounds read was observed in Oracle Java Runtime Environment version 8u202 latest at the time of this writing while fuzz-testing the processing of TrueType fonts. It...

Oracle Java Runtime Environment - Heap Out-of-Bounds Read During TTF Font Rendering in OpenTypeLayoutEngine::adjustGlyphPositions

A heap-based out-of-bounds read was observed in Oracle Java Runtime Environment version 8u202 latest at the time of this writing while fuzz-testing the processing of TrueType fonts. It manifests itself in the form of the following or similar crash: --- cut --- $ bin/java -cp . DisplaySfntFont...

CVE-2019-8378

An issue was discovered in Bento4 1.5.1-628. A heap-based buffer over-read exists in AP4BitStream::ReadBytes in Codecs/Ap4BitStream.cpp, a similar issue to CVE-2017-14645. It can be triggered by sending a crafted file to the aac2mp4 binary. It allows an attacker to cause a Denial of Service...

Null pointer dereference

An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in AP4Track::GetSampleIndexForTimeStampMs located in Core/Ap4Track.cpp. It can triggered by sending a crafted file to the mp4audioclip binary. It allows an attacker to cause a Denial of Service Segmentation fault or...

CVE-2019-8383

An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function advpngunfilter8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service Segmentation fault or possibly have unspecified other...

CVE-2019-8377

An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function getipv6l4proto located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service Segmentation fault or possibly hav...