The vulnerability of the bmp2tiff component in the LibTIFF library allows a hacker to gain access to data beyond the buffer boundaries allocated in dynamic memory.

The vulnerability of the bmp2tiff component in the LibTIFF library arises from insufficient checking of the input parameters biWidth and biHeight in the bitmap-information header of the BMP image. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data beyo...

USN-3380-1 freerdp vulnerabilities

It was discovered that FreeRDP incorrectly handled certain width and height values. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS. CVE-2014-0250 It was discovered...

CVE-2017-12131

The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens...

CVE-2017-12131: Improper Neutralization of Input During Web Page Generation

The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens...

Tor: Scrollbar Width permits detecting browser platform

In April 2017 shortly before this bug bounty program went live, I repeatedly attempted to report this information disclosure vulnerability. However, my emails to the Tor Project's official vulnerability disclosure address went unanswered. It was not until I posted a public blog entry -- with a...

The vulnerability of the `gdImageWebPtr` function in the GD Graphics Library allows attackers to exert undefined effects.

The vulnerability of the gdImageWebPtr function in the GD Graphics Library is related to the repeated release of memory. Exploiting this vulnerability can allow an attacker, operating remotely, to cause unpredictable effects by using large values for width and height...

UBUNTU-CVE-2017-10799

When GraphicsMagick 1.3.25 processes a DPX image with metadata indicating a large width in coders/dpx.c, a denial of service OOM can occur in ReadDPXImage...

DEBIAN-CVE-2017-10799

When GraphicsMagick 1.3.25 processes a DPX image with metadata indicating a large width in coders/dpx.c, a denial of service OOM can occur in ReadDPXImage...

CVE-2017-9995

libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted file...

libquicktime Denial of Service Vulnerability (CNVD-2017-11753)

libquicktime is a library for reading and writing files in quicktime, avi and mp4 formats. A security vulnerability exists in the 'quicktimevideowidth' function of the lqtquicktime.c file in libquicktime version 1.2.4. A remote attacker can exploit this vulnerability to cause a denial of service...

Silicon Graphics LibTIFF Heap Buffer Overflow Vulnerability (CNVD-2017-07752)

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A heap buffer overflow vulnerability exists in bmp2tiff in Silicon Graphics LibTIFF version...

DEBIAN-CVE-2017-9117

In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the...

UBUNTU-CVE-2017-9117

In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the...

Adobe Flash - Out-of-Bounds Read in Getting TextField Width Exploit

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1211 The attached swf causes an out-of-bounds read in getting the width of a TextField. Proof of Concept:...

Adobe Flash - Out-of-Bounds Read in Getting TextField Width

Adobe Flash - Out-of-Bounds Read in Getting TextField Width Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1211 The attached swf causes an out-of-bounds read in getting the width of a TextField. Proof of Concept:...

Adobe Flash - Out-of-Bounds Read in Getting TextField Width

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1211 The attached swf causes an out-of-bounds read in getting the width of a TextField. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42019.zip...

Mozilla: Out-of-bounds read during glyph processing (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Mozilla: Out-of-bounds read during glyph processing (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2017-7696

SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service memory consumption via large values in the width and height parameters to otplogonuiresources/qr, aka SAP Security Note 2389042...

APNGDis 2.8 - image width / height chunk Heap Buffer Overflow Exploit

Exploit for multiple platform in category dos / poc Exploit Title: APNGDis image width / height Buffer Overflow Date: 14-03-2017 Exploit Author: Alwin Peppels Vendor Homepage: http://apngdis.sourceforge.net/ Software Link: https://sourceforge.net/projects/apngdis/files/2.8/ Version: 2.8 Tested on...