CWE-908 · Use of Uninitialized Resource (page 9)
Page 9 of 9 — CVEs classified under CWE-908, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-2167 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2166 | Medium | 6.5 | 2019-09-27 | In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privile… |
CVE-2019-2140 | Medium | 6.5 | 2019-09-27 | In libxaac, there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privil… |
CVE-2019-11750 | Medium | 6.5 | 2019-09-27 | A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1. |
CVE-2019-5067 | Critical | 9.8 | 2019-09-18 | An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can caus… |
CVE-2019-1254 | Medium | 5.5 | 2019-09-11 | An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerabil… |
CVE-2019-16144 | High | 7.5 | 2019-09-09 | An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls. |
CVE-2019-15553 | High | 7.5 | 2019-08-26 | An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory. |
CVE-2018-20992 | Medium | 6.5 | 2019-08-26 | An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled. |
CVE-2019-13220 | High | 7.1 | 2019-08-15 | Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose… |
CVE-2019-11694 | High | 7.5 | 2019-07-23 | A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an… |
CVE-2019-1010299 | Medium | 5.3 | 2019-07-15 | The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory… |
CVE-2019-1010319 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-1010317 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-2118 | Medium | 5.5 | 2019-07-08 | In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no… |
CVE-2019-2105 | High | 8.8 | 2019-07-08 | In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data. This could lead to remote code execution in… |
CVE-2019-2104 | Medium | 5.5 | 2019-07-08 | In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. This could lead to local information dis… |
CVE-2019-13135 | High | 8.8 | 2019-07-01 | ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c. |
CVE-2019-13117 | Medium | 5.3 | 2019-07-01 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow… |
CVE-2019-5818 | Medium | 6.5 | 2019-06-27 | Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2018-6132 | Medium | 4.3 | 2019-06-27 | Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-2004 | Medium | 5.5 | 2019-06-19 | In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local information disclos… |
CVE-2019-11038 | Medium | 5.3 | 2019-06-19 | When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30… |
CVE-2019-7321 | Critical | 9.8 | 2019-06-13 | Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to ex… |
CVE-2019-12730 | Critical | 9.8 | 2019-06-04 | aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitializ… |
CVE-2019-9824 | Medium | 5.5 | 2019-06-03 | tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. |
CVE-2019-11833 | Medium | 5.5 | 2019-05-15 | fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtai… |
CVE-2019-11323 | Medium | 5.9 | 2019-05-09 | HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include… |
CVE-2019-9805 | Critical | 9.8 | 2019-04-26 | A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption… |
CVE-2018-18366 | Medium | 6.5 | 2019-04-25 | Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.3… |
CVE-2019-11459 | Medium | 5.5 | 2019-04-22 | The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from T… |
CVE-2019-9641 | Critical | 9.8 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2019-9639 | High | 7.5 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2019-9578 | High | 7.5 | 2019-03-05 | In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. |
CVE-2018-12011 | Medium | 5.5 | 2019-02-11 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Uninitialized data for socket address leads to infor… |
CVE-2018-3989 | Medium | 4.3 | 2019-02-05 | An exploitable kernel memory disclosure vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys Version 6.40 (Build 2400… |
CVE-2019-6976 | Medium | 5.3 | 2019-01-26 | libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not z… |
CVE-2019-0006 | Critical | 9.8 | 2019-01-15 | A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, Q… |
CVE-2018-19974 | Medium | 5.5 | 2018-12-17 | In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to… |
CVE-2018-8627 | Medium | 5.5 | 2018-12-12 | An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose t… |
CVE-2018-20029 | Medium | 5.5 | 2018-12-10 | The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uniniti… |
CVE-2018-9557 | High | 7.8 | 2018-12-06 | In really_install_package of install.cpp, there is a possible free of arbitrary memory due to uninitialized data. This could lead to local escalation of privil… |
CVE-2018-6982 | Medium | 6.5 | 2018-12-04 | VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual n… |
CVE-2018-6981 | High | 8.8 | 2018-12-04 | VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG, VMware Workstation… |
CVE-2018-19626 | Medium | 5.5 | 2018-11-29 | In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination. |
CVE-2018-3970 | Medium | 5.5 | 2018-10-25 | An exploitable memory disclosure vulnerability exists in the 0x222000 IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP… |
CVE-2018-9499 | Medium | 5.5 | 2018-10-02 | In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server w… |
CVE-2018-3975 | High | 7.5 | 2018-10-01 | An exploitable uninitialized variable vulnerability exists in the RTF-parsing functionality of Atlantis Word Processor 3.2.6 version. A specially crafted RTF f… |
CVE-2018-15911 | High | 7.8 | 2018-08-28 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to c… |
CVE-2018-7166 | High | 7.5 | 2018-08-21 | In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended t… |
CVE-2018-1000224 | High | 7.5 | 2018-08-20 | Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer ov… |
CVE-2018-8378 | Medium | 5.5 | 2018-08-15 | An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose… |
CVE-2018-14551 | Critical | 9.8 | 2018-07-23 | The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption. |
CVE-2018-5160 | High | 7.5 | 2018-06-11 | WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder usin… |
CVE-2018-5095 | Critical | 9.8 | 2018-06-11 | An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the u… |
CVE-2018-11383 | Medium | 5.5 | 2018-05-22 | The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file… |
CVE-2018-10115 | High | 7.8 | 2018-05-02 | Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a… |
CVE-2018-1037 | Medium | 4.3 | 2018-04-12 | An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program databas… |
CVE-2018-0919 | Low | 3.3 | 2018-03-14 | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft… |
CVE-2017-5103 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensit… |
CVE-2017-5102 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potential… |
CVE-2017-4905 | Medium | 5.5 | 2017-06-07 | VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch… |
CVE-2017-9098 | High | 7.5 | 2017-05-19 | ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information fro… |
CVE-2016-5105 | Medium | 4.4 | 2016-09-02 | The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized… |
CVE-2016-0821 | Medium | 5.5 | 2016-03-12 | The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the re… |
CVE-2015-8390 | Critical | 9.8 | 2015-12-02 | PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory rea… |
CVE-2015-5165 | | 2015-08-12 | The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap… | |
CVE-2015-3414 | | 2015-04-24 | SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of servic… | |
CVE-2012-1891 | Critical | 9.8 | 2012-07-10 | Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to… |
CVE-2011-1998 | | 2011-10-12 | Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that w… | |
CVE-2011-1995 | | 2011-10-12 | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2011-1964 | | 2011-08-10 | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2011-1963 | | 2011-08-10 | Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2011-1266 | | 2011-06-16 | The Vector Markup Language (VML) implementation in vgx.dll in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows… | |
CVE-2011-1262 | | 2011-06-16 | Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2011-1261 | | 2011-06-16 | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2011-1256 | | 2011-06-16 | Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2011-1255 | | 2011-06-16 | The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memor… | |
CVE-2011-1254 | | 2011-06-16 | Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2011-1251 | | 2011-06-16 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (… | |
CVE-2011-1250 | | 2011-06-16 | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2010-3346 | | 2010-12-16 | Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2010-3345 | | 2010-12-16 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (… | |
CVE-2010-3343 | | 2010-12-16 | Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (… | |
CVE-2010-2559 | | 2010-08-11 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (… | |
CVE-2010-2557 | | 2010-08-11 | Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (… | |
CVE-2010-2556 | | 2010-08-11 | Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an obj… | |
CVE-2009-3620 | High | 7.8 | 2009-10-22 | The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which… |
CVE-2009-2692 | High | 7.8 | 2009-08-14 | The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, w… |
CVE-2009-1529 | High | 8.1 | 2009-06-10 | Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly ha… |
CVE-2009-0949 | High | 7.5 | 2009-06-09 | The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers… |
CVE-2008-3475 | High | 8.8 | 2008-10-15 | Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly init… |
CVE-2008-4197 | High | 8.8 | 2008-09-27 | Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uniniti… |
CVE-2008-3688 | High | 7.5 | 2008-08-14 | sockethandler.cpp in HTTP Antivirus Proxy (HAVP) 0.88 allows remote attackers to cause a denial of service (hang) by connecting to a non-responsive server, whi… |
CVE-2008-2934 | High | 8.8 | 2008-07-18 | Mozilla Firefox 3 before 3.0.1 on Mac OS X allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a cr… |
CVE-2008-0063 | High | 7.5 | 2008-03-19 | The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might… |
CVE-2008-0081 | Critical | 9.8 | 2008-01-16 | Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute a… |
CVE-2007-1751 | | 2007-06-12 | Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to access an uninitialized or deleted… |