CWE-193 · Off-by-one Error (page 2)
Page 2 of 3 — CVEs classified under CWE-193, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38440 | High | 7.5 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in… |
CVE-2024-36957 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from u… |
CVE-2024-36025 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is a… |
CVE-2021-47373 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In its_vpe_irq_domain_alloc, when its… |
CVE-2022-48672 | High | 7.8 | 2024-05-03 | In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflatten_dt_nodes() Commit 78c44d910d3e ("drivers/of: F… |
CVE-2023-44444 | High | 7.8 | 2024-05-03 | GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa… |
CVE-2024-26995 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_… |
CVE-2024-31585 | Medium | 5.3 | 2024-04-17 | FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers… |
CVE-2024-26766 | High | 7.8 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877… |
CVE-2024-1441 | Medium | 5.5 | 2024-03-11 | An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array… |
CVE-2021-47046 | High | 7.8 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offsets[] a… |
CVE-2024-23849 | Medium | 5.5 | 2024-01-23 | In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, res… |
CVE-2023-46247 | High | 7.5 | 2023-12-13 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots t… |
CVE-2023-46853 | Critical | 9.8 | 2023-10-27 | In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n. |
CVE-2023-4260 | Medium | 6.3 | 2023-09-27 | Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. |
CVE-2023-4259 | High | 7.1 | 2023-09-26 | Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. |
CVE-2023-41880 | Low | 2.2 | 2023-09-15 | Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssemb… |
CVE-2022-33064 | High | 7.8 | 2023-07-18 | An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrar… |
CVE-2023-38429 | Critical | 9.8 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_ch… |
CVE-2023-28709 | High | 7.5 | 2023-05-22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTT… |
CVE-2023-30546 | Critical | 9.8 | 2023-04-26 | Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contik… |
CVE-2023-28858 | Low | 3.7 | 2023-03-26 | redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an un… |
CVE-2023-27477 | Low | 3.1 | 2023-03-08 | wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16… |
CVE-2023-0818 | Medium | 5.5 | 2023-02-13 | Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2022-34684 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or info… |
CVE-2022-36354 | Medium | 5.3 | 2022-12-22 | A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-… |
CVE-2022-47517 | High | 7.5 | 2022-12-18 | An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a… |
CVE-2022-41916 | Medium | 5.9 | 2022-11-15 | Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI cer… |
CVE-2022-3821 | Medium | 5.5 | 2022-11-08 | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accurac… |
CVE-2022-3872 | High | 8.6 | 2022-11-07 | An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and s… |
CVE-2021-46848 | Critical | 9.1 | 2022-10-24 | GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. |
CVE-2022-39274 | High | 7.5 | 2022-10-06 | LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflo… |
CVE-2022-3103 | High | 7.8 | 2022-09-26 | off-by-one in io_uring module. |
CVE-2021-3999 | High | 7.8 | 2022-08-24 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A lo… |
CVE-2020-27793 | High | 7.5 | 2022-08-19 | An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crash, and perform a de… |
CVE-2022-34970 | Critical | 9.8 | 2022-08-04 | Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers… |
CVE-2022-30155 | Medium | 5.5 | 2022-06-15 | Windows Kernel Denial of Service Vulnerability |
CVE-2022-23400 | High | 7.1 | 2022-05-03 | A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10. A specially-crafted PSD fil… |
CVE-2021-21938 | Critical | 9.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to cod… |
CVE-2022-25051 | Medium | 5.5 | 2022-03-02 | An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file. |
CVE-2021-4070 | Critical | 9.1 | 2022-02-23 | Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0. |
CVE-2021-3930 | Medium | 6.5 | 2022-02-18 | An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' arg… |
CVE-2022-24988 | Critical | 9.8 | 2022-02-14 | In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector. |
CVE-2021-44007 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an o… |
CVE-2021-23017 | High | 7.7 | 2021-06-01 | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory ov… |
CVE-2021-29529 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` b… |
CVE-2021-31875 | Critical | 9.8 | 2021-04-29 | In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which ca… |
CVE-2020-27171 | Medium | 6.0 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-… |
CVE-2021-3156 | High | 7.8 | 2021-01-26 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" a… |
CVE-2020-35893 | High | 7.5 | 2020-12-31 | An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized me… |
CVE-2020-29040 | High | 8.8 | 2020-11-24 | An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly g… |
CVE-2020-14510 | Critical | 9.8 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as… |
CVE-2020-14508 | High | 8.1 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code o… |
CVE-2020-3969 | High | 7.8 | 2020-06-24 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-10062 | Critical | 9.0 | 2020-06-05 | An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue… |
CVE-2019-19721 | High | 7.8 | 2020-05-15 | An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of ser… |
CVE-2019-12521 | Medium | 5.9 | 2020-04-15 | An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a st… |
CVE-2020-11765 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, le… |
CVE-2020-3840 | High | 7.8 | 2020-02-27 | An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iO… |
CVE-2020-8443 | Critical | 9.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow… |
CVE-2020-7044 | High | 7.5 | 2020-01-16 | In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one… |
CVE-2020-6835 | Critical | 9.8 | 2020-01-10 | An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking. |
CVE-2014-8182 | High | 7.5 | 2020-01-02 | An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an a… |
CVE-2019-19906 | High | 7.5 | 2019-12-19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The… |
CVE-2015-0841 | High | 7.5 | 2019-12-09 | Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denial of service (cras… |
CVE-2019-18423 | High | 8.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_g… |
CVE-2019-14532 | Critical | 9.8 | 2019-08-02 | An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus ha… |
CVE-2019-14323 | High | 7.5 | 2019-07-28 | SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server… |
CVE-2010-5331 | High | 7.8 | 2019-07-27 | In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least… |
CVE-2019-13306 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors. |
CVE-2019-13305 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. |
CVE-2019-10131 | High | 7.1 | 2019-04-30 | An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker… |
CVE-2019-8272 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be ex… |
CVE-2019-8268 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which… |
CVE-2019-9209 | Medium | 5.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preven… |
CVE-2019-3813 | High | 7.5 | 2019-02-04 | Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of serv… |
CVE-2018-5800 | Medium | 6.5 | 2018-12-07 | An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cau… |
CVE-2018-14599 | Critical | 9.8 | 2018-08-24 | An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server resp… |
CVE-2018-14682 | High | 8.8 | 2018-07-28 | An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. |
CVE-2018-14679 | Medium | 6.5 | 2018-07-28 | An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which co… |
CVE-2017-2618 | Medium | 5.5 | 2018-07-27 | A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can cr… |
CVE-2018-9860 | High | 7.5 | 2018-04-12 | An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving s… |
CVE-2018-8828 | Critical | 9.8 | 2018-03-20 | A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malfor… |
CVE-2018-7329 | High | 7.5 | 2018-02-23 | In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by correcting off-by-one errors. |
CVE-2017-1000416 | Medium | 5.3 | 2018-01-22 | axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050. |
CVE-2017-9720 | High | 7.8 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, due to an off-by-one error in a camera driver, an out-of-bounds read/write can… |
CVE-2017-14502 | High | 7.5 | 2017-09-17 | read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bo… |
CVE-2016-10160 | Critical | 9.8 | 2017-01-24 | Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial… |
CVE-2015-8701 | Medium | 6.5 | 2016-12-29 | QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descri… |
CVE-2014-5388 | | 2014-11-15 | Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information… | |
CVE-2013-0897 | | 2013-02-23 | Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attacke… | |
CVE-2011-2852 | | 2011-09-19 | Off-by-one error in Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified… | |
CVE-2011-2695 | | 2011-07-28 | Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by… | |
CVE-2011-1027 | | 2011-03-20 | Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infin… | |
CVE-2010-3454 | | 2011-01-28 | Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to c… | |
CVE-2010-1773 | High | 8.8 | 2010-09-24 | Off-by-one error in the toAlphabetic function in rendering/RenderListMarker.cpp in WebCore in WebKit before r59950, as used in Google Chrome before 5.0.375.70… |
CVE-2010-2955 | | 2010-09-08 | The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain stru… | |
CVE-2009-1217 | | 2009-04-01 | Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack cor… | |
CVE-2008-3964 | | 2008-09-11 | Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or… | |
CVE-2008-3535 | | 2008-08-08 | Off-by-one error in the iov_iter_advance function in mm/filemap.c in the Linux kernel before 2.6.27-rc2 allows local users to cause a denial of service (system… |