CWE-125 · Out-of-bounds Read (page 98)
Page 98 of 99 — CVEs classified under CWE-125, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-2370 | Medium | 5.9 | 2017-01-06 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially res… |
CVE-2016-2367 | Medium | 5.9 | 2017-01-06 | An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-o… |
CVE-2016-2366 | Medium | 5.9 | 2017-01-06 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially resu… |
CVE-2016-6891 | High | 7.5 | 2017-01-05 | MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in an X.509 certificat… |
CVE-2016-9935 | Critical | 9.8 | 2017-01-04 | The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-b… |
CVE-2015-8817 | Medium | 5.5 | 2016-12-29 | QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could… |
CVE-2015-8743 | High | 7.1 | 2016-12-29 | QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w… |
CVE-2016-9777 | High | 7.8 | 2016-12-28 | KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privile… |
CVE-2016-9037 | High | 7.5 | 2016-12-23 | An exploitable out-of-bounds array access vulnerability exists in the xrow_header_decode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can… |
CVE-2016-9036 | High | 7.5 | 2016-12-23 | An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3. A specially crafted packet can cause… |
CVE-2016-7502 | High | 7.8 | 2016-12-23 | The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode. |
CVE-2016-7450 | High | 7.8 | 2016-12-23 | The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file. |
CVE-2016-7291 | High | 7.1 | 2016-12-20 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 S… |
CVE-2016-7290 | High | 7.1 | 2016-12-20 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 S… |
CVE-2016-7276 | High | 7.1 | 2016-12-20 | Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain sensitive informatio… |
CVE-2016-7268 | High | 7.1 | 2016-12-20 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word for Mac 2011, Word Automation Services on SharePoint… |
CVE-2016-7265 | High | 7.1 | 2016-12-20 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePo… |
CVE-2016-7264 | High | 7.1 | 2016-12-20 | Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, Excel for Mac 2011, and Excel 2016 for Mac allow remote attackers to obtain sensitive in… |
CVE-2016-5186 | Medium | 5.3 | 2016-12-18 | Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allo… |
CVE-2016-7951 | Critical | 9.8 | 2016-12-13 | Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of ran… |
CVE-2016-7945 | High | 7.5 | 2016-12-13 | Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via v… |
CVE-2016-5407 | Critical | 9.8 | 2016-12-13 | The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operation… |
CVE-2016-6520 | Critical | 9.1 | 2016-12-13 | Buffer overflow in MagickCore/enhance.c in ImageMagick before 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache mor… |
CVE-2016-6491 | High | 8.8 | 2016-12-13 | Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause… |
CVE-2016-5842 | High | 7.5 | 2016-12-13 | MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which… |
CVE-2016-5687 | Critical | 9.8 | 2016-12-13 | The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a craf… |
CVE-2016-9433 | Medium | 6.5 | 2016-12-12 | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (out-of-bounds array access… |
CVE-2016-9918 | High | 7.5 | 2016-12-08 | In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a… |
CVE-2016-9803 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (whic… |
CVE-2016-9797 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corr… |
CVE-2016-9555 | Critical | 9.8 | 2016-11-28 | The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote atta… |
CVE-2016-9539 | Critical | 9.8 | 2016-11-22 | tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092. |
CVE-2016-7917 | Medium | 5.0 | 2016-11-16 | The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large eno… |
CVE-2016-7915 | Medium | 5.5 | 2016-11-16 | The hid_input_field function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information fro… |
CVE-2016-7914 | Medium | 5.5 | 2016-11-16 | The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows… |
CVE-2016-8878 | High | 8.8 | 2016-10-31 | Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbit… |
CVE-2016-8876 | High | 7.5 | 2016-10-31 | Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbit… |
CVE-2016-8875 | Medium | 5.3 | 2016-10-31 | The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of serv… |
CVE-2016-7506 | High | 7.5 | 2016-10-29 | An out-of-bounds read vulnerability was observed in Sp_replace_regexp function of Artifex Software, Inc. MuJS before 5000749f5afe3b956fc916e407309de840997f4a… |
CVE-2016-9017 | High | 7.5 | 2016-10-28 | Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the "op… |
CVE-2016-6905 | Medium | 6.5 | 2016-10-03 | The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds… |
CVE-2016-3658 | High | 7.5 | 2016-10-03 | The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial o… |
CVE-2016-3634 | High | 7.5 | 2016-10-03 | The tagCompare function in tif_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds… |
CVE-2016-3633 | High | 7.5 | 2016-10-03 | The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors re… |
CVE-2016-3631 | High | 7.5 | 2016-10-03 | The (1) cpStrips and (2) cpTiles functions in the thumbnail tool in LibTIFF 4.0.6 and earlier allow remote attackers to cause a denial of service (out-of-bound… |
CVE-2016-3625 | Medium | 6.5 | 2016-10-03 | tif_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image. |
CVE-2016-3621 | High | 8.8 | 2016-10-03 | The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw" option is used, allows remote attackers to cause a den… |
CVE-2016-3620 | High | 7.5 | 2016-10-03 | The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c zip" option is used, allows remote attackers to cause a den… |
CVE-2016-3619 | Medium | 6.5 | 2016-10-03 | The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used, allows remote attackers to… |
CVE-2016-6306 | Medium | 5.9 | 2016-09-26 | The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via craf… |
CVE-2016-4776 | High | 7.1 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or ca… |
CVE-2016-4774 | High | 7.1 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or ca… |
CVE-2016-4773 | High | 7.1 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or ca… |
CVE-2016-5271 | Medium | 6.5 | 2016-09-22 | The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and a… |
CVE-2016-2827 | Medium | 6.5 | 2016-09-22 | The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and ap… |
CVE-2015-8934 | Medium | 5.5 | 2016-09-20 | The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (o… |
CVE-2015-8928 | Medium | 5.5 | 2016-09-20 | The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-b… |
CVE-2015-8927 | Medium | 5.5 | 2016-09-20 | The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-… |
CVE-2015-8925 | Medium | 5.5 | 2016-09-20 | The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via… |
CVE-2015-8924 | Medium | 5.5 | 2016-09-20 | The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of s… |
CVE-2015-8921 | High | 7.5 | 2016-09-20 | The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a craft… |
CVE-2015-8920 | Medium | 5.5 | 2016-09-20 | The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds… |
CVE-2015-8915 | Medium | 5.5 | 2016-09-20 | bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file. |
CVE-2016-7175 | Medium | 5.9 | 2016-09-09 | epan/dissectors/packet-qnet6.c in the QNX6 QNET dissector in Wireshark 2.x before 2.0.6 mishandles MAC address data, which allows remote attackers to cause a d… |
CVE-2016-6263 | High | 7.5 | 2016-09-07 | The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds… |
CVE-2016-6262 | High | 7.5 | 2016-09-07 | idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds… |
CVE-2016-6261 | High | 7.5 | 2016-09-07 | The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash… |
CVE-2015-8948 | High | 7.5 | 2016-09-07 | idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bou… |
CVE-2016-5107 | Medium | 6.0 | 2016-09-02 | The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cau… |
CVE-2016-6214 | Medium | 6.5 | 2016-08-12 | gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. |
CVE-2016-6161 | Medium | 6.5 | 2016-08-12 | The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a craf… |
CVE-2016-6132 | Medium | 6.5 | 2016-08-12 | The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds re… |
CVE-2016-2064 | High | 7.8 | 2016-08-07 | sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android co… |
CVE-2016-5352 | Medium | 5.9 | 2016-08-07 | epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a den… |
CVE-2016-5114 | Critical | 9.1 | 2016-08-07 | sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows a… |
CVE-2016-5093 | High | 8.6 | 2016-08-07 | The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the pre… |
CVE-2013-7456 | High | 7.6 | 2016-08-07 | gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote… |
CVE-2016-3855 | High | 7.8 | 2016-08-06 | drivers/thermal/supply_lm_core.c in the Qualcomm components in Android before 2016-08-05 does not validate a certain count parameter, which allows attackers to… |
CVE-2016-3854 | High | 7.8 | 2016-08-06 | drivers/media/video/msm/msm_mctl_buf.c in the Qualcomm components in Android before 2016-08-05 does not validate the image mode, which allows attackers to caus… |
CVE-2016-1513 | High | 7.8 | 2016-08-05 | The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary… |
CVE-2016-2180 | High | 7.5 | 2016-08-01 | The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h a… |
CVE-2016-6294 | Critical | 9.8 | 2016-07-25 | The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly rest… |
CVE-2016-4652 | Medium | 6.3 | 2016-07-22 | CoreGraphics in Apple OS X before 10.11.6 allows local users to obtain sensitive information from kernel memory and consequently gain privileges, or cause a de… |
CVE-2016-4628 | Medium | 5.5 | 2016-07-22 | IOAcceleratorFamily in Apple iOS before 9.3.3 and watchOS before 2.2.2 allows local users to obtain sensitive information from kernel memory or cause a denial… |
CVE-2016-4523 | High | 7.5 | 2016-06-09 | The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read… |
CVE-2016-1839 | Medium | 5.5 | 2016-05-20 | The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, all… |
CVE-2016-1838 | Medium | 5.5 | 2016-05-20 | The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS… |
CVE-2016-1833 | Medium | 5.5 | 2016-05-20 | The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allo… |
CVE-2016-1823 | High | 7.8 | 2016-05-20 | The IOHIDDevice::handleReportWithTime function in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to… |
CVE-2016-2291 | Medium | 6.5 | 2016-04-06 | Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute… |
CVE-2016-1646 | High | 8.8 | 2016-03-29 | The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data t… |
CVE-2015-8629 | Medium | 5.3 | 2016-02-13 | The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether… |
CVE-2016-2091 | Low | 3.3 | 2016-02-08 | The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted… |
CVE-2015-8783 | Medium | 6.5 | 2016-02-01 | tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image. |
CVE-2015-8397 | High | 8.2 | 2016-01-12 | The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to… |
CVE-2015-2697 | | 2015-11-09 | The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of ser… | |
CVE-2014-9669 | | 2015-02-08 | Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corrupti… | |
CVE-2014-9658 | | 2015-02-08 | The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a d… | |
CVE-2014-9657 | | 2015-02-08 | The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause… | |
CVE-2014-7825 | High | 7.8 | 2014-11-10 | kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allow… |