| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof visible ICMP replies could influence mirror latency selection, while a malformed packet carrying IP options could shift the ICMP header and trigger an out-of-bounds read. This issue is fixed in version 2.7.8. |
| Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. |
| Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker to disclose information over a network. |
| Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows VOLSNAP.SYS allows an authorized attacker to elevate privileges over a network. |
| Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally. |
| A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. |
| Use After Free in GitHub repository vim/vim prior to 9.0.0530. |
| Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. |
| Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. |
| Use After Free in GitHub repository vim/vim prior to 9.0.0579. |
| Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. |
| FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0. |
| Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. |
| Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| BusyBox dpkg write_status_file() does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages. |
