CWE-908 · Use of Uninitialized Resource (page 8)
Page 8 of 9 — CVEs classified under CWE-908, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10541 | Critical | 9.8 | 2019-11-06 | Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons… |
CVE-2019-18786 | Medium | 5.5 | 2019-11-06 | In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a m… |
CVE-2019-18603 | Medium | 5.9 | 2019-10-29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output variables are sent… |
CVE-2019-18602 | High | 7.5 | 2019-10-29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a p… |
CVE-2019-18197 | High | 7.5 | 2019-10-18 | In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed… |
CVE-2019-15900 | Critical | 9.8 | 2019-10-18 | An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking… |
CVE-2019-17533 | High | 8.2 | 2019-10-13 | Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized me… |
CVE-2019-16866 | High | 7.5 | 2019-10-03 | Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the q… |
CVE-2019-9416 | Medium | 6.5 | 2019-09-27 | In libstagefright there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional exe… |
CVE-2019-9415 | Medium | 6.5 | 2019-09-27 | In libstagefright there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional exe… |
CVE-2019-9411 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9410 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9409 | Medium | 6.5 | 2019-09-27 | In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution… |
CVE-2019-9408 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9406 | Medium | 6.5 | 2019-09-27 | In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution… |
CVE-2019-9391 | Medium | 6.5 | 2019-09-27 | In libxaac, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure with no additional execution privileges… |
CVE-2019-9369 | Medium | 5.5 | 2019-09-27 | In Bluetooth, there is a use of uninitialized variable. This could lead to local information disclosure with no additional execution privileges needed. User in… |
CVE-2019-9361 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9359 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9338 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9337 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9336 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9335 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-9334 | Medium | 6.5 | 2019-09-27 | In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution… |
CVE-2019-9329 | High | 7.5 | 2019-09-27 | In Bluetooth, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure, with no additional privileges… |
CVE-2019-9322 | Medium | 6.5 | 2019-09-27 | In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution p… |
CVE-2019-2172 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2171 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2170 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2169 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2168 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2167 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2166 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2140 | Medium | 6.5 | 2019-09-27 | In libxaac, there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privil… |
CVE-2019-11750 | Medium | 6.5 | 2019-09-27 | A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1. |
CVE-2019-5067 | Critical | 9.8 | 2019-09-18 | An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can caus… |
CVE-2019-1254 | Medium | 5.5 | 2019-09-11 | An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerabil… |
CVE-2019-16144 | High | 7.5 | 2019-09-09 | An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls. |
CVE-2019-15553 | High | 7.5 | 2019-08-26 | An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory. |
CVE-2018-20992 | Medium | 6.5 | 2019-08-26 | An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled. |
CVE-2019-13220 | High | 7.1 | 2019-08-15 | Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose… |
CVE-2019-11694 | High | 7.5 | 2019-07-23 | A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an… |
CVE-2019-1010299 | Medium | 5.3 | 2019-07-15 | The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory… |
CVE-2019-1010319 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-1010317 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-2118 | Medium | 5.5 | 2019-07-08 | In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no… |
CVE-2019-2105 | High | 8.8 | 2019-07-08 | In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data. This could lead to remote code execution in… |
CVE-2019-2104 | Medium | 5.5 | 2019-07-08 | In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. This could lead to local information dis… |
CVE-2019-13135 | High | 8.8 | 2019-07-01 | ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c. |
CVE-2019-13117 | Medium | 5.3 | 2019-07-01 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow… |
CVE-2019-5818 | Medium | 6.5 | 2019-06-27 | Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2018-6132 | Medium | 4.3 | 2019-06-27 | Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-2004 | Medium | 5.5 | 2019-06-19 | In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local information disclos… |
CVE-2019-11038 | Medium | 5.3 | 2019-06-19 | When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30… |
CVE-2019-7321 | Critical | 9.8 | 2019-06-13 | Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to ex… |
CVE-2019-12730 | Critical | 9.8 | 2019-06-04 | aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitializ… |
CVE-2019-9824 | Medium | 5.5 | 2019-06-03 | tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. |
CVE-2019-11833 | Medium | 5.5 | 2019-05-15 | fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtai… |
CVE-2019-11323 | Medium | 5.9 | 2019-05-09 | HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include… |
CVE-2019-9805 | Critical | 9.8 | 2019-04-26 | A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption… |
CVE-2018-18366 | Medium | 6.5 | 2019-04-25 | Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.3… |
CVE-2019-11459 | Medium | 5.5 | 2019-04-22 | The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from T… |
CVE-2019-9641 | Critical | 9.8 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2019-9639 | High | 7.5 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2019-9578 | High | 7.5 | 2019-03-05 | In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. |
CVE-2018-12011 | Medium | 5.5 | 2019-02-11 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Uninitialized data for socket address leads to infor… |
CVE-2018-3989 | Medium | 4.3 | 2019-02-05 | An exploitable kernel memory disclosure vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys Version 6.40 (Build 2400… |
CVE-2019-6976 | Medium | 5.3 | 2019-01-26 | libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not z… |
CVE-2019-0006 | Critical | 9.8 | 2019-01-15 | A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, Q… |
CVE-2018-19974 | Medium | 5.5 | 2018-12-17 | In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to… |
CVE-2018-8627 | Medium | 5.5 | 2018-12-12 | An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose t… |
CVE-2018-20029 | Medium | 5.5 | 2018-12-10 | The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uniniti… |
CVE-2018-9557 | High | 7.8 | 2018-12-06 | In really_install_package of install.cpp, there is a possible free of arbitrary memory due to uninitialized data. This could lead to local escalation of privil… |
CVE-2018-6982 | Medium | 6.5 | 2018-12-04 | VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual n… |
CVE-2018-6981 | High | 8.8 | 2018-12-04 | VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG, VMware Workstation… |
CVE-2018-19626 | Medium | 5.5 | 2018-11-29 | In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination. |
CVE-2018-3970 | Medium | 5.5 | 2018-10-25 | An exploitable memory disclosure vulnerability exists in the 0x222000 IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP… |
CVE-2018-9499 | Medium | 5.5 | 2018-10-02 | In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server w… |
CVE-2018-3975 | High | 7.5 | 2018-10-01 | An exploitable uninitialized variable vulnerability exists in the RTF-parsing functionality of Atlantis Word Processor 3.2.6 version. A specially crafted RTF f… |
CVE-2018-15911 | High | 7.8 | 2018-08-28 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to c… |
CVE-2018-7166 | High | 7.5 | 2018-08-21 | In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended t… |
CVE-2018-1000224 | High | 7.5 | 2018-08-20 | Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer ov… |
CVE-2018-8378 | Medium | 5.5 | 2018-08-15 | An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose… |
CVE-2018-14551 | Critical | 9.8 | 2018-07-23 | The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption. |
CVE-2018-5160 | High | 7.5 | 2018-06-11 | WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder usin… |
CVE-2018-5095 | Critical | 9.8 | 2018-06-11 | An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the u… |
CVE-2018-11383 | Medium | 5.5 | 2018-05-22 | The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file… |
CVE-2018-10115 | High | 7.8 | 2018-05-02 | Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a… |
CVE-2018-1037 | Medium | 4.3 | 2018-04-12 | An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program databas… |
CVE-2018-0919 | Low | 3.3 | 2018-03-14 | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft… |
CVE-2017-5103 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensit… |
CVE-2017-5102 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potential… |
CVE-2017-4905 | Medium | 5.5 | 2017-06-07 | VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch… |
CVE-2017-9098 | High | 7.5 | 2017-05-19 | ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information fro… |
CVE-2016-5105 | Medium | 4.4 | 2016-09-02 | The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized… |
CVE-2016-0821 | Medium | 5.5 | 2016-03-12 | The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the re… |
CVE-2015-8390 | Critical | 9.8 | 2015-12-02 | PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory rea… |
CVE-2015-5165 | | 2015-08-12 | The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap… | |
CVE-2015-3414 | | 2015-04-24 | SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of servic… | |
CVE-2012-1891 | Critical | 9.8 | 2012-07-10 | Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to… |