CVE-2016-9427

CVE-2016-9427 is an integer overflow in the GC library (bdwgc) involving GC_MALLOC_ATOMIC, reported as a heap overflow that could crash the client and potentially allow arbitrary code execution. The issue affects multiple distributions; public details in documents include: before 2016-09-27 (bdwg...

CVE-2018-19865

CVE-2018-19865: A keystroke-logging issue was discovered in Qt’s Virtual Keyboard. Affected: Qt 5.7.x–5.11.x prior to 5.11.3. Root cause: verbose keypress logging in the Virtual Keyboard. Impact: possible leakage of keystrokes; no exploit details provided in the documents. Mitigation: update to Q...

CVE-2016-0753

CVE-2016-0753 affects Active Model in Rails up to 5.x (4.1.x < 4.1.14.1, 4.2.x < 4.2.5.1, 5.x

CVE-2016-6261

CVE-2016-6261 affects libidn: the idna_to_ascii_4i function in lib/idna.c within libidn before 1.33 allows context-dependent attackers to cause a denial of service via 64 bytes of input (out-of-bounds read and crash). Connected advisories indicate patches/mitigations exist (upgrading libidn to a ...

CVE-2016-8667

CVE-2016-8667 affects QEMU (rc4030_write in hw/dma/rc4030.c). It allows a local guest OS administrator to trigger a divide-by-zero and QEMU process crash by loading an excessively large interval timer value, causing a denial of service with partial impact on availability. The provided documents d...

CVE-2017-13084

CVE-2017-13084 describes a vulnerability in WPA/WPA2 where the Station-To-Station-Link (STK) key can be reinstalled during the PeerKey handshake. An attacker within wireless range may replay, decrypt, or spoof frames by exploiting STSL STK reinstallation. Public sources confirm this as part of th...

CVE-2019-2850

CVE-2019-2850 affects Oracle VM VirtualBox (Virtualization, Core subcomponent). Affected products/versions are VirtualBox prior to 5.2.32 and prior to 6.0.10. The issue is exploitable by a low-privilege user who has logon to the infrastructure where VirtualBox runs and requires user interaction; ...

CVE-2015-8567

CVE-2015-8567 describes a memory leak in the QEMU vmxnet3 device emulator (net/vmxnet3.c) that could allow a remote attacker to cause a denial of service via memory exhaustion. The vulnerability is part of multiple CVEs in QEMU; Debian security advisories report fixes in stable Jessie to version ...

CVE-2016-0606

CVE-2016-0606 is an unspecified vulnerability in Oracle MySQL Server and MariaDB related to encryption that can be exploited by remote authenticated users to affect integrity. Affected versions include MySQL 5.5.46 and earlier, 5.6.27 and earlier, 5.7.9 and MariaDB before 5.5.47; also 10.0.x befo...

CVE-2016-2818

CVE-2016-2818 corresponds to memory safety bugs in the Mozilla Firefox browser engine that could allow remote code execution or denial of service. The connected IBM advisories indicate the vulnerability affecting IBM products shipped with Firefox (IBM SONAS and IBM Storwize V7000 Unified), with a...

CVE-2016-2829

CVE-2016-2829 affects Mozilla Firefox prior to 47.0. A crafted website that rapidly triggers multiple permission requests (e.g., microphone or geolocation) can cause the notification icon to be incorrect, enabling spoofing of permission prompts. This could mislead users into granting access to re...

CVE-2019-20787

The CVE-2019-20787 issue affects Teeworlds prior to 0.7.4, where an integer overflow occurs when computing a tilemap size. The connected advisories confirm this vulnerability and its mitigation: upgrading Teeworlds to 0.7.5 (or later) fixes the overflow. Multiple distributions (Mageia, openSUSE/o...

CVE-2019-9775

CVE-2019-9775 affects GNU LibreDWG 0.7 and 0.7.1645 and describes an out-of-bounds read in the function dwg_dxf_BLOCK_CONTROL at dwg.spec. The connected advisories confirm this vulnerability is addressed in newer LibreDWG releases (e.g., libredwg 0.9.x series; OpenSUSE/SUSE advisories reference 0...

CVE-2015-7218

CVE-2015-7218 affects Mozilla Firefox before 43.0. The HTTP/2 implementation allows remote DoS via a single-byte header frame that triggers integer underflow and incorrect memory allocation, leading to an assertion and application exit. Public advisories (e.g., Mageia/OpenSUSE/Fedora/Nessus-docum...

CVE-2016-9105

CVE-2016-9105 applies to QEMU, describing a memory leak in the v9fs_link function of hw/9pfs/9p.c that can be triggered by a reference to the source fid object, leading to denial of service via memory consumption. The IBM PowerKVM bulletin notes a fix in PowerKVM: version 3.1.0.2 (and PowerKVM 2....

CVE-2017-14804

Summary (CVE-2017-14804) : The vulnerability affects the build package prior to 20171128, which fails to validate directory names during extraction of build results, enabling writes outside the target buildroot. This is documented in multiple sources (OpenSUSE SUSE announcements, OSS updates, and...

CVE-2017-16232

CVE-2017-16232 affects LibTIFF 4.0.8, which is reported to have multiple memory‑leak vulnerabilities that can lead to memory exhaustion/DoS. The initial entry notes third parties could not reproduce the issue. Connected advisories reference LibTIFF-related CVEs and indicate that fixes exist in la...

CVE-2013-6393

CVE-2013-6393 affects LibYAML: the yaml_parser_scan_tag_uri function in scanner.c of LibYAML before 0.1.5 performs an incorrect cast, enabling a heap-based buffer overflow that can crash the application and possibly allow arbitrary code execution via crafted YAML tags. The initial description and...

CVE-2017-5334

CVE-2017-5334: Double-free vulnerability in GnuTLS in gnutls_x509_ext_import_proxy triggered by X.509 certificates with a Proxy Certificate Information extension. Affected upstream: GnuTLS < 3.3.26 and

CVE-2015-7216

Mozilla Firefox before 43.0 on Linux GNOME platforms is affected by CVE-2015-7216 due to gdk-pixbuf configuration that incorrectly enables the JasPer JPEG-2000 decoder. A crafted JPEG 2000 image can cause a denial of service and possibly other impact. The vulnerability is tied to the 43.x Firefox...

CVE-2016-6128

CVE-2016-6128 affects the GD Graphics Library (libgd), specifically the gdImageCropThreshold function in gd_crop.c, with vulnerable pre-2.2.3 releases used by PHP prior to 7.0.9. Exploitation can cause an application crash (denial of service) via an invalid color index. Public advisories and vend...

CVE-2016-8689

CVE-2016-8689 affects libarchive 3.2.1, where the read_Header function in archive_read_support_format_7zip.c allows an out-of-bounds read via multiple EmptyStream attributes in a 7zip header, leading to denial of service. Public docs confirm this as a libarchive vulnerability and cite affected ve...

CVE-2019-9771

The CVE-2019-9771 issue affects GNU LibreDWG 0.7 and 0.7.1645, caused by a NULL pointer dereference in bit_convert_TU (bits.c). Public docs show remediation in libredwg releases up to 0.9.3, with OpenSUSE/SUSE advisories (e.g., openSUSE-SU-2020:0068-1/0095-1) noting fixes that address null pointe...

CVE-2015-7203

Mozilla Firefox before 43.0 contains a buffer overflow in DirectWriteFontInfo::LoadFontFamilyData within gfx/thebes/gfxDWriteFontList.cpp that could be triggered by a crafted font-family name, potentially causing a denial of service. The issue is documented under CVE-2015-7203; related advisories...

CVE-2016-1942

CVE-2016-1942 (address bar spoofing) affects Mozilla Firefox prior to 44.0. The public OpenSUSE/NSS/OpenSUSE advisories describe the vulnerability as address bar spoofing when handling certain URIs. In practice, the issue arises if a user pastes a wyciwyg: or resource: URI, enabling a remote atta...

CVE-2017-5335

GnuTLS CVE-2017-5335 affects the OpenPGP certificate handling in lib/opencdk/read-packet.c: streams reading certificates can trigger an out-of-memory crash via crafted OpenPGP data. Affected versions are GnuTLS before 3.3.26 and 3.5.x before 3.5.8. Multiple external advisories (CentOS, Red Hat, U...

CVE-2019-9777

CVE-2019-9777 affects GNU LibreDWG 0.7 and 0.7.1645 and is a heap-based buffer over-read in dxf_header_write (header_variables_dxf.spec). Connected documents link this CVE to the libredwg project and confirm fixes in later releases; openSUSE/SUSE advisories state libredwg 0.9.3 (and related updat...

CVE-2016-1937

The CVE-2016-1937 issue concerns Firefox’s protocol-handler dialog, where a crafted page could trigger a single-click action intended as a double-click. OpenSUSE advisories document the fix as part of Mozilla Firefox updates to version 44.0 (on GA media), with NSS updated to 3.21 and NSPR to 4.11...

CVE-2016-2807

CVE-2016-2807 is a set of memory-safety issues in Mozilla Firefox’s browser engine affecting Firefox, ESR 38.x and ESR 45.x branches. Connected advisories indicate these flaws could allow memory corruption and a potential arbitrary-code execution or DoS. Remediation across sources centers on upgr...

CVE-2016-5116

The CVE applies to the GD Graphics Library (libgd) prior to version 2.2.0, used in certain PHP 5.5.x configurations. The flaw in gd_xbm.c allows a long XBM image name to read process memory or trigger a stack-based buffer under-read, causing potential information disclosure or denial of service. ...

CVE-2016-8669

CVE-2016-8669 affects QEMU: the serial_update_parameters function in hw/char/serial.c can be triggered by a divider value greater than baud base to cause a divide-by-zero and QEMU process crash. It is a local privilege vulnerability (guest to host) with denial of service as the impact. The connec...

CVE-2016-9104

CVE-2016-9104 affects QEMU’s 9pfs/9p.c (v9fs_xattr_read and v9fs_xattr_write). The issue is multiple integer overflows that can trigger out-of-bounds access, enabling a local attacker to cause a denial of service (QEMU process crash). Public docs in the connected set confirm the 9pfs-related over...

CVE-2016-2798

The CVE-2016-2798 issue affects the Graphite2 font library (Graphite 2) prior to version 1.3.6 used by Mozilla Firefox/Firefox ESR. The vulnerability arises in Graphite2::GlyphCache::Loader::Loader, allowing a remote attacker to trigger a denial of service via a crafted Graphite font, with potent...

CVE-2019-9774

CVE-2019-9774 concerns an out-of-bounds read in GNU LibreDWG 0.7 and 0.7.1645, specifically in bit_read_B (bits.c). Connected documents show downstream fixes in libredwg/OpenSUSE releases, notably a 0.9.x line with multiple CVEs fixed (e.g., CVE-2019-9774 and related issues) and security updates ...

CVE-2016-0655

CVE-2016-0655 is an InnoDB-related issue in Oracle MySQL Server affecting 5.6.29 and earlier and 5.7.11 and earlier, and in MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14. The connected Debian advisories confirm this cluster of CVEs and state the fix is to upgrade MariaDB to 10.0.25 (and...

CVE-2016-1704

CVE-2016-1704 affects Google Chrome before 51.0.2704.103. The Debian advisory and Chrome release notes indicate multiple issues identified by the Chrome development team during internal audits and fuzzing, fixed in 51.0.2704.103. The NVD description notes a potential denial-of-service or other im...

CVE-2016-1933

CVE-2016-1933 affects Mozilla Firefox and was fixed by upgrading to Firefox 44.0 (NSS/NSPR updated to 3.21). The vulnerability is described as an Out of Memory crash when parsing GIF format images, arising from an integer overflow in the image deinterlacing/GIF parsing path. OpenSUSE security adv...

CVE-2016-1956

The CVE describes a vulnerability in Mozilla Firefox on Linux when using Intel graphics drivers. Triggering a WebGL shader can cause a remote denial of service via memory exhaustion or heap/stack memory corruption. Affected product: Firefox prior to 45.0 on Linux with Intel video drivers. Root ca...

CVE-2016-2793

CVE-2016-2793 affects the Graphite 2 font library (CachedCmap.cpp) up to version 1.3.5 used by Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. A crafted Graphite font can trigger a buffer over-read, potentially causing a denial of service or other impact. Remediation, where availabl...

CVE-2016-2824

CVE-2016-2824 involves ANGLE used by Mozilla Firefox on Windows and caused an out-of-bounds write in a WebGL shader, leading to denial of service (crash) or other impact. OpenSUSE/SUSE advisories indicate this was fixed in Firefox ESR updates (e.g., 45.3.0 ESR) and NSS-related patches; Mozilla MF...

CVE-2019-9770

The CVE-2019-9770 entry concerns GNU LibreDWG before, specifically versions 0.7 and 0.7.1645, which have a heap-based buffer overflow in dwg_decode_eed_data (decode.c) for the y dimension. The vulnerability is caused by improper handling in decoding EED data, leading to a potential overflow. Seve...

CVE-2016-2795

Graphite 2 vulnerability CVE-2016-2795 affects the Graphite font engine library. The function graphite2::FileFace::get_table_fn in Graphite 2 before 1.3.6 does not initialize memory for an unspecified data structure, enabling a remote attacker to cause denial of service (and possibly other impact...

CVE-2016-9106

CVE-2016-9106 is a memory leak in v9fs_write (hw/9pfs/9p.c) of QEMU. A local guest administrator can cause DoS by exhausting memory. The IBM PowerKVM bulletin notes fixes for PowerKVM 2.1/3.1 via PowerKVM 3.1.0.2; other public advisories reference the vulnerability as part of broader QEMU issues ...

CVE-2015-2697

CVE-2015-2697 affects MIT Kerberos 5 (krb5) prior to 1.14. The issue is triggered via a remote authenticated TGS request where the realm field starts with a null byte, enabling an out-of-bounds condition that can crash the KDC (denial of service). The connected document confirms the vulnerability...

CVE-2015-7215

CVE-2015-7215 affects Mozilla Firefox before 43.0 (and ESR 38.x) via the Web Workers importScripts implementation. The underlying issue is that triggering no-cors fetch via importScripts can bypass the Same Origin Policy, leading to information disclosure after a rethrow. Impact reported across m...

CVE-2016-0503

CVE-2016-0503 is an unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 that allows remote authenticated users to affect availability via vectors related to DML; it is a different vulnerability than CVE-2016-0504.

CVE-2016-2317

GraphicsMagick’s SVG processing for CVE-2016-2317 comprises stack and heap buffer overflows in MVG/SVG rendering (TracePoint, GetToken, GetTransformTokens). Connected advisories confirm this was addressed in newer GraphicsMagick packages across distros (e.g., Debian Jessie: 1.3.20-3+deb8u2; Stret...

CVE-2019-9778

CVE-2019-9778 affects GNU LibreDWG 0.7 and 0.7.1645, with a heap-based buffer over-read in the function dwg_dxf_LTYPE in dwg.spec. Public records (SUSE/openSUSE and OSV entries) indicate that fixes were delivered in libredwg releases up to 0.9.3 and related updates, addressing multiple overflow/n...

CVE-2019-9779

CVE-2019-9779 affects GNU LibreDWG 0.7 and 0.7.1645, due to a NULL pointer dereference in the function dwg_dxf_LTYPE (dwg.spec). The issue is mitigated by upgrading to the libredwg release series that fixes NULL pointer dereferences, with references showing the fix in the 0.9.x line (notably 0.9....

CVE-2016-2799

CVE-2016-2799 is a heap-based buffer overflow in graphite2::Slot::setAttr in Graphite2 up to 1.3.6, impacting Firefox <45.0 and Firefox ESR =1.3.7) to remediate. Monitor vendor advisories for exact fixed versions per distribution.