CWE-190 · Integer Overflow or Wraparound (page 19)
Page 19 of 34 — CVEs classified under CWE-190, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24838 | High | 7.5 | 2021-02-10 | An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obt… |
CVE-2021-26825 | High | 7.8 | 2021-02-08 | An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in I… |
CVE-2020-36242 | Critical | 9.1 | 2021-02-07 | In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer over… |
CVE-2020-13579 | High | 7.8 | 2021-02-04 | An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specia… |
CVE-2020-28895 | High | 7.3 | 2021-02-03 | In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual mem… |
CVE-2021-0355 | Medium | 6.7 | 2021-02-03 | In kisd, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges… |
CVE-2021-0354 | Medium | 6.7 | 2021-02-03 | In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2020-11216 | Critical | 9.8 | 2021-01-21 | Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti… |
CVE-2020-11197 | Critical | 9.8 | 2021-01-21 | Possible integer overflow can occur when stream info update is called when total number of streams detected are zero while parsing TS clip with invalid data in… |
CVE-2020-11167 | Critical | 9.8 | 2021-01-21 | Memory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-11137 | Critical | 9.8 | 2021-01-21 | Integer multiplication overflow resulting in lower buffer size allocation than expected causes memory access out of bounds resulting in possible device instabi… |
CVE-2020-14409 | High | 7.8 | 2021-01-19 | SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a… |
CVE-2021-0312 | Medium | 6.5 | 2021-01-11 | In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote information disclosure wi… |
CVE-2020-16040 | Medium | 6.5 | 2021-01-08 | Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2021-1059 | High | 7.8 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflow, which in turn ma… |
CVE-2019-25005 | High | 7.5 | 2020-12-31 | An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext. |
CVE-2020-35738 | Medium | 6.1 | 2020-12-28 | WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties cl… |
CVE-2020-29361 | High | 7.5 | 2020-12-16 | An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and… |
CVE-2020-27051 | High | 7.8 | 2020-12-15 | In NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of pr… |
CVE-2020-0495 | Medium | 5.5 | 2020-12-15 | In decode_Huffman of JBig2_SddProc.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local information disclosure wit… |
CVE-2020-35457 | High | 7.8 | 2020-12-14 | GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is "Rea… |
CVE-2020-0458 | High | 7.8 | 2020-12-14 | In SPDIFEncoder::writeBurstBufferBytes and related methods of SPDIFEncoder.cpp, there is a possible out of bounds write due to an integer overflow. This could… |
CVE-2020-17444 | High | 7.5 | 2020-12-11 | An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IPv6 extension headers are valid) doesn't… |
CVE-2020-17443 | High | 7.5 | 2020-12-11 | An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter t… |
CVE-2020-17442 | High | 7.5 | 2020-12-11 | An issue was discovered in picoTCP 1.7.0. The code for parsing the hop-by-hop IPv6 extension headers does not validate the bounds of the extension header lengt… |
CVE-2020-13988 | High | 7.5 | 2020-12-11 | An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packe… |
CVE-2020-13985 | High | 7.5 | 2020-12-11 | An issue was discovered in Contiki through 3.0. A memory corruption vulnerability exists in the uIP TCP/IP stack component when handling RPL extension headers… |
CVE-2020-27350 | Medium | 5.7 | 2020-12-10 | APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/… |
CVE-2020-27758 | Low | 3.3 | 2020-12-08 | A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in th… |
CVE-2020-27757 | Low | 3.3 | 2020-12-08 | A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the r… |
CVE-2020-27754 | Low | 3.3 | 2020-12-08 | In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick proc… |
CVE-2020-27751 | Low | 3.3 | 2020-12-08 | A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined… |
CVE-2020-25676 | Medium | 5.5 | 2020-12-08 | In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCor… |
CVE-2020-25675 | Low | 3.3 | 2020-12-08 | In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefi… |
CVE-2020-27911 | High | 7.8 | 2020-12-08 | An integer overflow was addressed through improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud… |
CVE-2020-27906 | High | 8.8 | 2020-12-08 | Multiple integer overflows were addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A remote attacker may be able to cause u… |
CVE-2020-25666 | Low | 3.3 | 2020-12-08 | There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rg… |
CVE-2020-27772 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in th… |
CVE-2020-27776 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha… |
CVE-2020-27775 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavi… |
CVE-2020-27774 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha… |
CVE-2020-27771 | Low | 3.3 | 2020-12-04 | In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for th… |
CVE-2020-27770 | Medium | 5.5 | 2020-12-04 | Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to applicatio… |
CVE-2020-27767 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavi… |
CVE-2020-27766 | High | 7.8 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha… |
CVE-2020-27764 | Low | 3.3 | 2020-12-03 | In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range v… |
CVE-2020-27762 | Medium | 5.5 | 2020-12-03 | A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in th… |
CVE-2020-27761 | Low | 3.3 | 2020-12-03 | WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsi… |
CVE-2020-27759 | Low | 3.3 | 2020-12-03 | In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of t… |
CVE-2020-25693 | High | 8.1 | 2020-12-03 | A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted i… |
CVE-2020-27813 | High | 7.5 | 2020-12-02 | An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a de… |
CVE-2020-29384 | Medium | 5.5 | 2020-11-30 | An issue was discovered in PNGOUT 2020-01-15. When compressing a crafted PNG file, it encounters an integer overflow. |
CVE-2019-2392 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negat… |
CVE-2019-14562 | Medium | 5.5 | 2020-11-23 | Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-27484 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the at… |
CVE-2020-8760 | High | 7.8 | 2020-11-12 | Integer overflow in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 14.0.45 may allow a privileged user to potentially enable… |
CVE-2020-8746 | Medium | 6.5 | 2020-11-12 | Integer overflow in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentiall… |
CVE-2020-11205 | High | 7.8 | 2020-11-12 | u'Possible integer overflow to heap overflow while processing command due to lack of check of packet length received' in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-11196 | Critical | 9.8 | 2020-11-12 | u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2020-11184 | Critical | 9.8 | 2020-11-12 | u'Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industri… |
CVE-2020-11131 | High | 7.8 | 2020-11-12 | u'Possible buffer overflow in WMA message processing due to integer overflow occurs when processing command received from user space' in Snapdragon Auto, Snapd… |
CVE-2020-11127 | High | 7.8 | 2020-11-12 | u'Integer overflow can cause a buffer overflow due to lack of table length check in the extensible boot Loader during the validation of security metadata while… |
CVE-2020-0452 | Critical | 9.8 | 2020-11-10 | In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a thir… |
CVE-2020-0409 | High | 7.8 | 2020-11-10 | In create of FileMap.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no addition… |
CVE-2020-28371 | Critical | 9.8 | 2020-11-09 | An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to preven… |
CVE-2020-15986 | Medium | 6.5 | 2020-11-03 | Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15975 | High | 8.8 | 2020-11-03 | Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15974 | High | 8.8 | 2020-11-03 | Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2020-11169 | Critical | 9.1 | 2020-11-02 | u'Buffer over-read while processing received L2CAP packet due to lack of integer overflow check' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit… |
CVE-2019-16127 | Critical | 9.1 | 2020-10-22 | Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow. |
CVE-2020-9875 | High | 7.8 | 2020-10-22 | An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watc… |
CVE-2020-26682 | High | 8.8 | 2020-10-16 | In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow. |
CVE-2020-0408 | High | 7.8 | 2020-10-14 | In remove of String16.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additio… |
CVE-2020-16124 | High | 7.3 | 2020-10-13 | Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated network traffic to… |
CVE-2020-24397 | High | 7.2 | 2020-10-02 | An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in… |
CVE-2020-24213 | High | 7.5 | 2020-09-23 | An integer overflow was discovered in YGOPro ygocore v13.51. Attackers can use it to leak the game server thread's memory. |
CVE-2020-6569 | Medium | 6.3 | 2020-09-21 | Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit hea… |
CVE-2020-0309 | Medium | 6.7 | 2020-09-18 | In the Bluetooth server, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System privi… |
CVE-2020-0369 | High | 7.8 | 2020-09-17 | In libavb, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution pr… |
CVE-2020-0346 | High | 7.8 | 2020-09-17 | In Mediaserver, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if integer sanitization we… |
CVE-2020-0328 | Medium | 4.4 | 2020-09-17 | In the camera, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privile… |
CVE-2020-0264 | High | 8.8 | 2020-09-17 | In libstagefright, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution pr… |
CVE-2020-0432 | High | 7.8 | 2020-09-17 | In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no a… |
CVE-2020-0381 | High | 7.5 | 2020-09-17 | In Parse_wave of eas_mdls.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote information disclosure in a highly c… |
CVE-2020-6116 | High | 7.8 | 2020-09-17 | An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a… |
CVE-2020-6113 | High | 7.8 | 2020-09-17 | An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-referenc… |
CVE-2020-3990 | Medium | 6.5 | 2020-09-16 | VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an integer overflow issue in… |
CVE-2020-25574 | High | 7.5 | 2020-09-14 | An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infin… |
CVE-2020-14363 | High | 7.8 | 2020-09-11 | An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled w… |
CVE-2020-6327 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the appli… |
CVE-2020-3624 | High | 7.8 | 2020-09-08 | u'A potential buffer overflow exists due to integer overflow when parsing handler options due to wrong data type usage in operation' in Snapdragon Auto, Snapdr… |
CVE-2020-3620 | Medium | 5.5 | 2020-09-08 | u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport can lead to corruption and pote… |
CVE-2019-14074 | High | 7.8 | 2020-09-08 | u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi… |
CVE-2019-14056 | High | 7.8 | 2020-09-08 | u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-13999 | High | 7.8 | 2020-09-08 | u'Lack of check for integer overflow for round up and addition operations result into memory corruption and potential information leakage' in Snapdragon Auto… |
CVE-2019-13998 | High | 7.8 | 2020-09-08 | u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size results into memory corruption and potential… |
CVE-2019-13995 | High | 7.8 | 2020-09-08 | u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can lead to memory corruption and potential… |
CVE-2019-13994 | High | 7.8 | 2020-09-08 | u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory are less than the actual packet size can l… |
CVE-2019-10615 | High | 7.8 | 2020-09-08 | u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of keymaster bob which can lead… |
CVE-2020-12829 | Low | 3.8 | 2020-08-31 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO wr… |