CVE-2019-20170

GPAC version 0.8.0 and 0.9.0-development-20191109 contains an invalid pointer dereference in GF_IPMPX_AUTH_Delete() (odf/ipmpx_code.c). The connected advisories (e.g., Debian DLA-2072, MGASA, OpenVAS/Nessus entries) corroborate CVE-2019-20170, but no explicit impact or remediation details are pro...

CVE-2022-20796

CVE-2022-20796 affects ClamAV scanning library versions 0.103.4/0.103.5/0.104.1/0.104.2, where an authenticated, local attacker could cause a denial-of-service on affected devices. Connected advisories confirm the issue across multiple distributions and indicate remediation by upgrading to later ...

CVE-2019-14533

CVE-2019-14533 affects VideoLAN VLC media player 3.0.7.1, where the control function of demux/asf/asf.c has a use-after-free vulnerability. Public sources in the connected documents confirm this specific ASF demuxer use-after-free (notable in the 3.0.7.1 release) and document that the issue has b...

CVE-2020-13696

The CVE-2020-13696 issue affects LinuxTV xawtv before 3.107. The dev_open() function in v4l-conf.c fails to sufficiently validate the target path, enabling a local attacker with access to the setuid-root v4l-conf binary to probe for file existence and trigger opens on arbitrary files (e.g., via a...

CVE-2020-16302

Ghostscript 9.50 contains a buffer overflow in jetp3852_print_page() (devices/gdev3852.c) that could let a remote attacker escalate privileges via a crafted PDF. The issue is fixed in Ghostscript 9.51. Connected sources (CVE-2020-16302) corroborate the flaw and its remediation across distribution...

CVE-2020-17367

Firejail vulnerable to command injection via CLI handling: CVE-2020-17367 occurs because the end-of-options indicator is not honored after --output, allowing manipulation of a sandboxed app’s command line; CVE-2020-17368 also exists, where output redirection via --output/--output-stderr concatena...

CVE-2020-22020

CVE-2020-22020 is a buffer overflow in FFmpeg 4.2 affecting libavfilter/vf_fieldmatch.c (build_diff_map). A remote attacker could exploit crafted input to cause a Denial of Service. Public advisories (Ubuntu USN-5472-1, Debian DSA-4990) list FFmpeg upgrades to patched builds (e.g., FFmpeg 4.2.x w...

CVE-2020-27670

CVE-2020-27670 affects the Xen hypervisor (through 4.14.x) where an AMD IOMMU page-table entry can be half-updated. This may allow a local x86 guest to cause data corruption, data leaks, or possibly privilege escalation. The vulnerability targets the IOMMU paging path and is described as a local ...

CVE-2020-27671

CVE-2020-27671 affects Xen 4.14.x and earlier on x86 HVM/PVH guests. The issue arises from mishandling coalescing of per-page IOMMU TLB flushes in the Xen IOMMU path, enabling a guest OS user to cause denial of service (data corruption), data leaks, or potentially a privilege escalation. Connecte...

CVE-2020-29566

CVE-2020-29566 affects Xen 4.14.x and earlier on x86, where a device model operation could be signalled as completed before completion, causing a re-schedule loop and potential stack overflow. This could enable a malicious or buggy stubdomain serving an HVM guest to crash the Xen host, resulting ...

CVE-2020-6062

CVE-2020-6062 affects coturn’s web server POST handling, where a crafted HTTP POST request can trigger a server crash and denial of service. The connected advisories confirm the same issue across multiple distributions and show the root cause as improper handling of POST requests. Affected produc...

CVE-2021-20275

CVE-2021-20275 (privoxy) is a DoS vulnerability in Privoxy before version 3.0.32 caused by an invalid read of size two in chunked_body_is_complete(). Exploitation can lead to denial of service. Public advisories across distributions (e.g., openSUSE/SUSE, various Linux vendors) patch this issue by...

CVE-2022-2905

CVE-2022-2905 is an out-of-bounds memory read in the Linux kernel’s BPF subsystem, exploitable by a local user via bpf_tail_call with a map key larger than max_entries. The Debian LTS advisory DLA-3173-1 (linux-5.10) lists CVE-2022-2905 among others and notes that an update to linux-5.10-149-2~de...

CVE-2022-31002

Sofia-SIP (Session Initiation Protocol library) is affected by CVE-2022-31002: before 1.13.8, processing a SDP message with a URL ending in % can trigger a crash. Version 1.13.8 contains the patch for this issue. Public advisories (Debian/Ubuntu Gentoo Mageia and other Nessus/Gentoo entries) refe...

CVE-2023-46838

CVE-2023-46838 affects Xen’s virtualization networking path where multi‑part transmitted requests can include zero‑length parts. If all parts of an SKB are zero length, the Linux networking code may dereference NULL, potentially enabling local or guest‑to‑host disruption. Public advisories ( Xen/...

CVE-2023-4874

CVE-2023-4874 affects mutt and is a null pointer dereference vulnerability triggered when viewing a specially crafted email (and also when composing from a crafted draft) in Mutt versions older than 2.2.12. The issue can lead to denial of service (crash) and is rated with availability impact in t...

CVE-2023-6857

CVE-2023-6857 describes a race condition when resolving symlinks in Firefox on Unix-based OSes, where the buffer passed to readlink may be too small. Affects Firefox and Thunderbird components (Firefox ESR <115.6, Firefox <121, Thunderbird

CVE-2024-38588

Summary of CVE-2024-38588 (Linux kernel) : A use-after-free in ftrace_location was reported by KASAN and fixed. The race occurs when ftrace_location accesses ftrace pages of a module that is being freed during module unloading (ftrace_release_mod). The root cause is a window where ftrace_location...

CVE-2025-23146

The CVE-2025-23146 issue affects the Linux kernel mfd: ene-kb3930 driver, where a NULL pointer dereference could occur because off_gpios may be NULL. The kb3930_probe() lacked a NULL check, fixed in the resolved update (similar to backlight: hx8357 NULL pointer fix). Impact is local, with potenti...

CVE-2025-37997

CVE-2025-37997 affects the Linux kernel netfilter ipset region locking for hash types. The root cause is an incorrect ahash_region() mapping, which can cause a race between the garbage collector and adding new elements to sets with timeouts. The connected advisories confirm fixes to region lockin...

CVE-2010-3702

The CVE-2010-3702 issue affects the Xpdf PDF parser (Gfx::getPos) in Xpdf

CVE-2015-0242

CVE-2015-0242 is a PostgreSQL vulnerability affecting Windows builds of PostgreSQL prior to 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1. It causes a stack-based buffer overflow in the printf implementations when handling a floating-point number wit...

CVE-2015-3209

CVE-2015-3209 : Heap-based buffer overflow in the QEMU PCNET network device allows remote code execution via crafted packet sequences (TXSTATUS_STARTPACKET then TXSTATUS_DEVICEOWNS). This is a QEMU vulnerability discussed in multiple advisories (notably Arista/Security Advisory 0013 and F5/Multi-...

CVE-2015-7498

CVE-2015-7498 is a heap-based buffer overflow in the xmlParseXmlDecl function of libxml2’s parser.c, affecting versions before 2.9.3. The underlying issue enables context-dependent attackers to trigger a denial of service via crafted XML data, related to an encoding conversion failure. Affected p...

CVE-2015-7852

CVE-2015-7852 is an off-by-one vulnerability in ntpq’s cookedprint() which can allow a crafted mode 6 packet to cause a buffer overflow and crash ntpd. Public references (Debian DSA-3388-1, CentOS advisories) confirm ntpq/cookedprint as the vulnerable component and describe a DoS via remote craft...

CVE-2016-0616

CVE-2016-0616 is an unspecified vulnerability in MySQL/MariaDB related to the Optimizer that allows remote authenticated users to affect availability. Affected products/versions include Oracle MySQL 5.5.46 and earlier; MariaDB before 5.5.47; MySQL 10.0.x before 10.0.23; and 10.1.x before 10.1.10....

CVE-2016-7440

The CVE-2016-7440 issue affects the wolfSSL (formerly CyaSSL) C library’s AES Encryption/Decryption implementation prior to 3.9.10. The vulnerability enables local users to potentially discover AES keys by exploiting cache-bank timing differences during AES operations. The available connected doc...

CVE-2016-7568

CVE-2016-7568 is a vulnerability in the GD Graphics Library (libgd/libgd2) ≤ 2.2.3, used by PHP up to 7.0.11. The flaw is an integer overflow in the gdImageWebpCtx function (gd_webp.c) that can cause a heap-based buffer overflow, enabling a remote attacker to trigger a denial of service and possi...

CVE-2017-5429

CVE-2017-5429 involves memory safety bugs in Mozilla Firefox (52 and ESR 45.8/52) and Thunderbird 52. Some bugs show memory corruption and could be exploited to run arbitrary code. Affected: Thunderbird < 52.1; Firefox ESR < 45.9, < 52.1; Firefox

CVE-2017-6512

CVE-2017-6512 affects the Perl File-Path module prior to 2.13. A race condition in the rmtree and remove_tree functions can let an attacker loosen directory permissions to set the mode on arbitrary files. Impact is limited to permission changes on targeted files; no direct data-exfiltration vecto...

CVE-2017-7818

Summary: CVE-2017-7818 is a use-after-free vulnerability in Thunderbird (and Firefox/ESR components) involving manipulation of ARIA element arrays via the DOM, leading to a potentially exploitable crash. The connected sources confirm the issue affects Thunderbird prior to 52.4.0 and related Mozil...

CVE-2018-1000222

CVE-2018-1000222 affects libgd (GD Graphics Library). A double-free in gdImageBmpPtr can enable remote code execution when processing a specially crafted JPEG. The issue is fixed in a later commit (ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5); multiple advisories reference this CVE and note patches ...

CVE-2018-10839

CVE-2018-10839 affects QEMU when built with the NE2000 NIC emulation. The vulnerability is an integer overflow in the NE2000 emulation path that can cause a buffer overflow when processing received network packets inside a guest, leading to a DoS by crashing the QEMU process. The original descrip...

CVE-2018-10860

CVE-2018-10860 affects perl-Archive-Zip (Archive::Zip). A directory traversal flaw arises from improper path sanitization when extracting zip archives, enabling a remote attacker to write/overwrite arbitrary files in the Perl interpreter’s context. Publicly available advisories confirm fixes in v...

CVE-2018-16802

Artifex Ghostscript prior to 9.25 is affected by CVE-2018-16802: incorrect “restoration of privilege” checking when stack overflows during exception handling could allow code execution via crafted PostScript using the pipe operator. This stems from an incomplete fix for CVE-2018-16509. The issue ...

CVE-2018-19968

CVE-2018-19968 affects phpMyAdmin prior to 4.8.4. An attacker can leak the contents of a local file due to an error in the transformation feature. Exploitation requires access to the phpMyAdmin Configuration Storage tables (which can be created by the attacker in any database they can access) and...

CVE-2018-20175

CVE-2018-20175 affects rdesktop up to and including v1.8.3. The vulnerability stems from several Integer Signedness errors in mcs.c that cause Out-of-Bounds Reads, leading to Denial of Service (segfault). Connected advisories confirm the issue across multiple distributions and indicate fixes in l...

CVE-2018-5127

The CVE-2018-5127 issue is a memory-safety buffer overflow in the SVG path handling (svg animatedPathSegList) triggered via script, allowing a potentially exploitable crash. Affected products and versions include Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2018-5996

The CVE-2018-5996 entry affects 7-Zip (and p7zip) with a flaw in NCompress::NRar3::CDecoder::Code prior to version 18.00 that allows remote attackers to trigger memory corruptions in the PPMd code via a crafted RAR archive, potentially causing a denial of service or arbitrary code execution. Conn...

CVE-2018-8791

CVE-2018-8791 affects the rdesktop RDP client (versions up to and including 1.8.3). The vulnerability is an out-of-bounds read in the function rdpdr_process(), leading to information leakage when connecting to a malicious server. Several advisory sources confirm the issue and note that upstream f...

CVE-2019-11007

GraphicsMagick 1.4 snapshot-20190322 Q8 is affected by a heap-based buffer over-read in the ReadMNGImage function (coders/png.c), enabling denial of service or information disclosure via image colormaps. Public disclosures and multiple advisories link CVE-2019-11007 to this issue. Impact details ...

CVE-2019-13626

SDL2 2.x up to 2.0.9 contains a heap-based buffer over-read in Fill_IMA_ADPCM_block caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c (CVE-2019-13626). Multiple connected advisories (openSUSE/SUSE, Debian LTS, Nessus plugins, and related vendor pages) indicate this issue was...

CVE-2019-15143

CVE-2019-15143 affects DjVuLibre 3.5.27 and is caused by a denial-of-service vulnerability in the bitmap reader. A crafted image can trigger a GBitmap::read_rle_raw infinite loop, leading to resource exhaustion. Affected components include libdjvu/DjVmDir.cpp and libdjvu/GBitmap.cpp. Public advis...

CVE-2019-9215

CVE-2019-9215 affects LIVE555: malformed headers can cause invalid memory access in parseAuthorizationHeader. CVE-2019-7314 (also in LIVE555) enables Use-After-Free during RTSP termination. Documents indicate affected versions before 2019.06.28 and show remediation via updating to 2019.06.28 or l...

CVE-2020-11082

In Kaminari, versions prior to 1.2.1 are affected by a vulnerability that could allow an attacker to inject arbitrary code into pages with pagination links. This issue has been fixed in version 1.2.1, per multiple connected advisories (e.g., Debian DSA/DSA-2763-1 and related Nessus/OpenVAS entrie...

CVE-2020-14001

The vulnerability CVE-2020-14001 affects the kramdown Ruby gem prior to 2.3.0, where the template option is processed by default in Kramdown documents. This can allow unintended read access (e.g., template="/etc/passwd") or unintended embedded Ruby code execution (e.g., template="string://<%= ...

CVE-2020-15563

CVE-2020-15563 – Xen inverted code path DoS (XSA-319) Affected: Xen hypervisor (versions 4.8 and newer; 4.7 and older are not affected). Only x86 HVM guests using shadow paging are vulnerable; x86 PV guests and HAP-backed guests are not. The issue arises from an inverted conditional in x86 HVM gu...

CVE-2020-16289

CVE-2020-16289 describes a buffer overflow in Ghostscript 9.50, specifically in cif_print_page() within devices/gdevcif.c, which could allow a remote attacker to cause a denial of service by processing a crafted PDF. The issue is fixed in Ghostscript 9.51. Affected product: Artifex Software Ghost...

CVE-2020-22022

FFmpeg 4.2 contains a heap-based Buffer Overflow in filter_frame (libavfilter/vf_fieldorder.c) that can cause memory corruption. The CVE is CVE-2020-22022. Affected products in connected advisories include FFmpeg packages in Ubuntu and Debian ecosystems; remediation guidance points to upgrading F...

CVE-2020-22026

CVE-2020-22026 describes a Buffer Overflow in FFmpeg 4.2, located in config_input() in libavfilter/af_tremolo.c, which could allow a remote attacker to cause a Denial of Service. The connected documents consistently tie this issue to FFmpeg 4.2 and confirm the DoS impact; exploitation details are...