CVE-2017-7653

The CVE-2017-7653 issue affects the Eclipse Mosquitto broker up to version 1.4.15, where the broker does not reject strings that are not valid UTF-8. A malicious client can trigger a denial of service by sending an invalid UTF-8 topic string, causing other clients that reject invalid UTF-8 to dis...

CVE-2007-0454

CVE-2007-0454 describes a format-string vulnerability in the Samba 3.0.6 to 3.0.23d release range, specifically in the afsacl.so VFS module used for AFS file systems. The flaw arises from improper handling of format specifiers in filenames during Windows ACL mapping, enabling a context-dependent ...

CVE-2007-2443

CVE-2007-2443 : MIT Kerberos 5 before or equal to 1.6.1 contains a signedness error in gssrpc__svcauth_unix() within svc_auth_unix.c of the RPC library, which could let a remote attacker execute arbitrary code via a negative length. Connected advisories indicate patches and backports in krb5/libg...

CVE-2008-3142

CVE-2008-3142 involves multiple buffer overflows in Python 2.5.2 and earlier on 32‑bit platforms, caused by incorrect memory allocation during Unicode string processing (related to unicode_resize and the PyMem_RESIZE macro). Attackers could trigger a denial of service (crash) or other unspecified...

CVE-2008-3272

The CVE-2008-3272 issue affects the Linux kernel sound subsystem (sound/core/seq/oss/seq_oss_synth.c). The root cause is that snd_seq_oss_synth_make_info does not verify that the device number lies within the range defined by max_synthdev before returning data, enabling local users to leak sensit...

CVE-2008-3281

libxml2 up to version 2.6.32 is affected by CVE-2008-3281 due to improper detection of recursion during entity expansion in an attribute value, enabling a denial-of-service via crafted XML (memory and CPU consumption). The Gentoo GLSA confirms this, and recommends upgrading to libxml2 >= 2.7.2...

CVE-2011-2192

CVE-2011-2192 affects libcurl 7.10.6–7.21.6 (used by curl and related products): the Curl_input_negotiate function unconditionally delegates GSSAPI credentials during authentication, enabling a remote server to impersonate the client via GSSAPI. Evidence in connected docs shows MiracleLinux advis...

CVE-2012-4428

CVE-2012-4428 concerns OpenSLP: the DoS vulnerability is caused by an out-of-bounds read in the function SLPIntersectStringList(), which can be exploited remotely to disrupt service. Public advisories across multiple distributions confirm OpenSLP-related fixes and upgrade requirements (e.g., Debi...

CVE-2012-5577

CVE-2012-5577 affects the Python keyring library prior to 0.10, where keyring files were created with world-readable permissions. This is the concrete detail available across the connected sources; no additional exploit vectors, systems, or remediation steps are specified in the provided document...

CVE-2014-3468

The CVE concerns GNU Libtasn1 prior to version 3.6, where asn1_get_bit_der does not properly report an error for a negative bit length. This can enable context-dependent attackers to trigger out-of-bounds access via crafted ASN.1 data, potentially impacting applications using libtasn1. Public ref...

CVE-2014-8132

CVE-2014-8132 is a double-free vulnerability in libssh’s ssh_packet_kexinit (kex.c) affecting libssh 0.5.x and 0.6.x prior to 0.6.4. A crafted kexinit packet can cause a denial of service over the network. Remediation is to upgrade to libssh 0.6.4 or later; multiple advisories (SUSE, Debian, Gent...

CVE-2015-2155

CVE-2015-2155 affects tcpdump up to version 4.7.2, where the force printer can be triggered by crafted traffic/pcap to cause a crash or possible arbitrary code execution. Public docs describe the vulnerability in tcpdump’s force printer and note remote exploitation via specially crafted packets. ...

CVE-2015-7542

CVE-2015-7542 affects libgwenhywfar up to version 4.12.0, caused by the use of outdated bundled CA certificates. Multiple sources (NVD entry and downstream advisories) confirm the vulnerability exists due to trust store handling in the library. Exploitation details are not provided in the documen...

CVE-2015-8619

CVE-2015-8619 affects QEMU’s Human Monitor Interface. The issue is an out-of-bounds write that can be exploited remotely to cause a denial-of-service (application crash). Connected advisories confirm QEMU vulnerability details and advise upgrading to patched releases. Debian security advisories l...

CVE-2016-2391

CVE-2016-2391 (Normal): Affects QEMU’s USB OHCI emulation. The vulnerability is in the ohci_bus_start function (hw/usb/hcd-ohci.c) and allows a local privileged user in a guest to trigger a NULL pointer dereference, crashing the QEMU process via vectors related to multiple eof_timers, i.e., a Den...

CVE-2016-6351

CVE-2016-6351 affects QEMU, specifically the ESP/NCR53C9x FSC emulation. The vulnerability is in esp_do_dma (hw/scsi/esp.c) and can let a local, privileged guest OS administrator perform an out-of-bounds write via DMA read into the ESP command buffer, potentially crashing QEMU or enabling arbitra...

CVE-2016-6888

CVE-2016-6888 in QEMU (net_tx_pkt_init in hw/net/net_tx_pkt.c) has an integer overflow when handling the maximum fragmentation count, triggering an unchecked multiplication and a NULL pointer dereference. This allows a local privileged user/guest to cause a denial of service (QEMU process crash)....

CVE-2016-9776

CVE-2016-9776 affects QEMU’s ColdFire Fast Ethernet Controller (mcf_fec_receive) and can trigger an infinite loop when processing received packets. This could allow a privileged guest user to crash the QEMU host process, causing a Denial of Service. Public advisories for related products (PowerKV...

CVE-2016-9830

CVE-2016-9830 affects GraphicsMagick 1.3.25 and earlier; MagickRealloc in memory.c can trigger a denial of service crash when processing JPEGs with large dimensions. Several advisories (e.g., Mageia MGASA-2017-0229, Debian DSA-3746, Amazon ALAS-2017-820) indicate upstream fixes in newer GraphicsM...

CVE-2017-14173

CVE-2017-14173 affects ImageMagick (ImageMagick 7.0.6-10) and specifically the TXT image codec. The vulnerability arises in ReadTXTImage() (coders/txt.c) where an integer overflow can occur on the addition GetQuantumRange(depth)+1 when depth is large, causing an infinite loop when processing a cr...

CVE-2017-14862

CVE-2017-14862 is an Exiv2 0.26 vulnerability where an Invalid memory address dereference in Exiv2::DataValue::read (value.cpp) can cause a segmentation fault and application crash, leading to a denial of service. Connected advisories from Astra Linux, Debian (DLA-3265), Ubuntu USN-3852-1, and Re...

CVE-2017-15386

The CVE-2017-15386 issue affects the Blink component in Google Chrome prior to 62.0.3202.62, where an incorrect implementation could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The connected sources corroborate that this is a UI/content spoofing vulnerability i...

CVE-2017-16546

CVE-2017-16546 affects ImageMagick, where the ReadWPGImage function (coders/wpg.c) does not validate the colormap index in a WPG palette. This can enable an attacker to cause a denial of service by processing a malformed WPG file (potential use of uninitialized data or invalid memory allocation)....

CVE-2017-17854

CVE-2017-17854 affects the Linux kernel's kernel/bpf/verifier.c, with the vulnerability existing in images up to kernel version 4.14.8. The issue arises from unrestricted integer values used in pointer arithmetic, enabling local users to trigger a denial of service (integer overflow and memory co...

CVE-2017-17879

CVE-2017-17879 affects ImageMagick; the vulnerability is a heap-based buffer over-read in ReadOneMNGImage (coders/png.c) caused by an off-by-one error in length calculation. It is observed in ImageMagick 7.0.7-16 Q16 x86_64 (2017-12-21). The connected documents provide concrete details of the fau...

CVE-2017-17935

Wireshark CVE-2017-17935 affects Wireshark up to version 2.2.11. The File_read_line function in epan/wslua/wslua_file.c does not strip trailing newline characters, allowing remote attackers to trigger processing of an empty line via a crafted packet, resulting in a denial of service through a buf...

CVE-2017-5037

CVE-2017-5037: In Chromium/Chromium-based browsers, multiple out-of-bounds writes were reported in the ChunkDemuxer component. A remote attacker could exploit crafted media content to trigger issues; affected versions include Chromium up to 57.0.2987.98.x. Upgrading to 57.0.2987.98 or newer mitig...

CVE-2017-5126

CVE-2017-5126: A use-after-free in PDFium found in the Chromium/Chrome PDF rendering path prior to 62.0.3202.62 allows a remote attacker to cause heap corruption via a crafted PDF file, enabling arbitrary code execution. Affected software/component: PDFium inside Chromium/Chrome on versions

CVE-2017-5127

The CVE-2017-5127 entry describes a use-after-free in the PDFium component of Google Chrome, exploitable via crafted PDF files and affecting Chrome versions prior to 62.0.3202.62. The underlying issue is a PDFium use-after-free that could allow remote code execution (heap corruption). Impact is d...

CVE-2017-7847

Mozilla Thunderbird prior to 52.5.2 is affected by CVE-2017-7847 through crafted CSS in an RSS feed that can leak local path strings (potentially including user names). The underlying issue is leakage via RSS processing of CSS. Impact is information disclosure; exploitation details are not provid...

CVE-2017-8346

CVE-2017-8346 is rejected; this CVE ID is not an active vulnerability entry.

CVE-2017-8350

CVE-2017-8350 is rejected/not used per the description and does not represent an active vulnerability.

CVE-2018-16472

CVE-2018-16472 affects the Node.js module cached-path-relative (versions ≤ 1.0.1). The issue is prototype pollution: an attacker can inject properties on Object.prototype, which are then inherited by all objects and can lead to denial of service. Connected sources confirm the vulnerable component...

CVE-2018-25047

Smarty3 (PHP templating engine) is vulnerable to XSS in smarty_function_mailto when using Smarty <3.1.47 and Smarty 4.x

CVE-2018-6187

In MuPDF 1.12.0, CVE-2018-6187 is a heap-based buffer overflow in do_pdf_save_document (pdf/pdf-write.c) that can be exploited by remote attackers via a crafted PDF to cause a denial of service. Connected advisories (Arch Linux ASA-201805-12, ASA-201805-6, ASA-201805-7, ASA-201805-5, ASA-201805-6...

CVE-2018-9268

Technical details for CVE-2018-9268 are not publicly available in the provided documents; no concrete affected versions, impact, or fixes are described here.

CVE-2019-10018

Xpdf 4.01.01 contains CVE-2019-10018: an FPE in PostScriptFunction::exec (psOpIdiv). Mageia MGASA-2019-0293 documents fixes for this and related CVEs in Xpdf; Debian DLA-2440-1 notes the poppler update fixes CVE-2019-10018 (and others) in Debian 9. Affected remediation details vary by distro (Mag...

CVE-2019-14558

CVE-2019-14558 concerns insufficient control flow management in BIOS firmware for 8th–10th Generation Intel Core and Intel Celeron 4000/5000 Series processors. The vulnerability could allow an authenticated local user to potentially cause a denial of service via adjacent access. The initial entry...

CVE-2019-17341

CVE-2019-17341 : Affected software is Xen up to 4.11.x. The issue is a page-writability race condition during the addition of a passed-through PCI device, exploitable by x86 PV guest OS users. The documented impact is denial of service or privilege escalation on the host, triggered by this race w...

CVE-2019-17559

Apache Traffic Server (ATS) versions affected: 6.0.0–6.2.3, 7.0.0–7.1.8, and 8.0.0–8.0.5. The vulnerability involves a smuggling attack and issues with scheme parsing. Upgrading to ATS 7.1.9 or later or 8.0.6 or later addresses the flaw. References indicate this is a documented vulnerability with...

CVE-2020-6072

CVE-2020-6072 affects libmicrodns 0.1.0 in the label-parsing path. The rr_decode return value is not checked when parsing compressed labels in mDNS messages, leading to a double free that can be exploited to execute arbitrary code. Impact is remote via crafted mDNS traffic; affected components ar...

CVE-2021-28705

CVE-2021-28705 and CVE-2021-28709 concerns Xen hypervisor on x86 HVM/PVH guests running in populate-on-demand (PoD). The issue stems from partial success handling of P2M updates in hypercalls that operate on page ranges; requests may be split into chunks leading to insufficient accounting of part...

CVE-2021-30154

CVE-2021-30154 affects MediaWiki prior to 1.31.12 and 1.32.x through 1.35.x prior to 1.35.2. The issue is an XSS in which the mediastatistics-header-* messages are output in HTML unescaped on Special:NewFiles, enabling potential HTML/JS injection. Root cause: unescaped HTML output in that page fl...

CVE-2021-35474

CVE-2021-35474 is a stack-based buffer overflow in the cachekey plugin of Apache Traffic Server, affecting ATS versions 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. The Connected documents confirm the vulnerability and list affected versions; Debian's advisory DSA-4957-1 notes a fix in Debian for ...

CVE-2021-36411

CVE-2021-36411 affects libde265 v1.0.8, with a root cause in incorrect access control causing a segmentation fault (SEGV) from a READ memory access in derive_boundaryStrength (deblock.cc). This leads to a remote denial of service via application crash. Publicly documented impact is DoS potential;...

CVE-2021-37698

CVE-2021-37698 affects Icinga 2 (versions 2.5.0–2.13.0) where ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer fail to verify the server’s certificate even when a CA is configured. This TLS validation flaw can enable credential exposure or impersonation when connecting to TSDBs...

CVE-2021-42528

CVE-2021-42528 is a NULL pointer dereference in Exempi / XMP Toolkit 2021.07 (and earlier) when parsing a specially crafted file. An unauthenticated attacker could cause an application-denial-of-service in the context of the current user, with user interaction required to open the malicious file....

CVE-2022-31087

CVE-2022-31087 affects LDAP Account Manager (LAM). The underlying issue is that in versions prior to 8.0 the tmp directory under /lam/tmp/ is capable of interpreting PHP files, enabling a writer with www-data privileges to place a web shell and achieve code execution on the host. The accepted rem...

CVE-2022-42319

CVE-2022-42319 concerns Xenstore: Guests can cause xenstored to hold onto large temporary memory, leading to memory exhaustion and DoS. The connected Nessus entry (UNPATCHED_CVE_2022_42319.NASL) identifies this as an unpatched vulnerability affecting Xenstore; it does not provide concrete patch/v...

CVE-2022-43239

CVE-2022-43239 affects libde265 v1.0.8, where a heap-buffer-overflow in mc_chroma (motion.cc) can cause Denial of Service via a crafted video file. The connected advisories/documentation confirm the same root cause and indicate the issue has been addressed by upstream fixes in later libde265 vers...