CVE-2016-9840 | ByteOS Network

Vulnerability Details :

CVE-2016-9840

Assigner-microfocus

Assigner Org ID-f81092c5-7f14-476d-80dc-24857f90be84

Published At-23 May, 2017 | 03:56

Updated At-06 Aug, 2024 | 02:59

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:microfocus

Assigner Org ID:f81092c5-7f14-476d-80dc-24857f90be84

Published At:23 May, 2017 | 03:56

Updated At:06 Aug, 2024 | 02:59

▼CVE Numbering Authority (CNA)

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2017:1221	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1220	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:3047	vendor-advisory x_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2016/12/05/21	mailing-list x_refsource_MLIST
http://www.securityfocus.com/bid/95131	vdb-entry x_refsource_BID
https://access.redhat.com/errata/RHSA-2017:3046	vendor-advisory x_refsource_REDHAT
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html	vendor-advisory x_refsource_SUSE
https://security.gentoo.org/glsa/201701-56	vendor-advisory x_refsource_GENTOO
http://www.securitytracker.com/id/1039427	vdb-entry x_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1222	vendor-advisory x_refsource_REDHAT
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html	vendor-advisory x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2017:3453	vendor-advisory x_refsource_REDHAT
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html	vendor-advisory x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2017:2999	vendor-advisory x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html	mailing-list x_refsource_MLIST
https://usn.ubuntu.com/4246-1/	vendor-advisory x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html	mailing-list x_refsource_MLIST
https://usn.ubuntu.com/4292-1/	vendor-advisory x_refsource_UBUNTU
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	x_refsource_CONFIRM
https://support.apple.com/HT208144	x_refsource_CONFIRM
https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0	x_refsource_CONFIRM
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib	x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1402345	x_refsource_CONFIRM
https://support.apple.com/HT208113	x_refsource_CONFIRM
https://support.apple.com/HT208112	x_refsource_CONFIRM
https://support.apple.com/HT208115	x_refsource_CONFIRM
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf	x_refsource_MISC
https://security.gentoo.org/glsa/202007-54	vendor-advisory x_refsource_GENTOO

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1221

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1220

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3047

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://www.openwall.com/lists/oss-security/2016/12/05/21

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://www.securityfocus.com/bid/95131

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3046

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: https://security.gentoo.org/glsa/201701-56

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: http://www.securitytracker.com/id/1039427

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1222

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3453

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: https://access.redhat.com/errata/RHSA-2017:2999

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://usn.ubuntu.com/4246-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

Hyperlink: https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://usn.ubuntu.com/4292-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Resource:

x_refsource_MISC

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Resource:

x_refsource_CONFIRM

Hyperlink: https://support.apple.com/HT208144

Resource:

x_refsource_CONFIRM

Hyperlink: https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0

Resource:

x_refsource_CONFIRM

Hyperlink: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib

Resource:

x_refsource_MISC

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1402345

Resource:

x_refsource_CONFIRM

Hyperlink: https://support.apple.com/HT208113

Resource:

x_refsource_CONFIRM

Hyperlink: https://support.apple.com/HT208112

Resource:

x_refsource_CONFIRM

Hyperlink: https://support.apple.com/HT208115

Resource:

x_refsource_CONFIRM

Hyperlink: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf

Resource:

x_refsource_MISC

Hyperlink: https://security.gentoo.org/glsa/202007-54

Resource:

vendor-advisory

x_refsource_GENTOO

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2017:1221	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2017:1220	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2017:3047	vendor-advisory x_refsource_REDHAT x_transferred
http://www.openwall.com/lists/oss-security/2016/12/05/21	mailing-list x_refsource_MLIST x_transferred
http://www.securityfocus.com/bid/95131	vdb-entry x_refsource_BID x_transferred
https://access.redhat.com/errata/RHSA-2017:3046	vendor-advisory x_refsource_REDHAT x_transferred
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html	vendor-advisory x_refsource_SUSE x_transferred
https://security.gentoo.org/glsa/201701-56	vendor-advisory x_refsource_GENTOO x_transferred
http://www.securitytracker.com/id/1039427	vdb-entry x_refsource_SECTRACK x_transferred
https://access.redhat.com/errata/RHSA-2017:1222	vendor-advisory x_refsource_REDHAT x_transferred
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html	vendor-advisory x_refsource_SUSE x_transferred
https://access.redhat.com/errata/RHSA-2017:3453	vendor-advisory x_refsource_REDHAT x_transferred
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html	vendor-advisory x_refsource_SUSE x_transferred
https://access.redhat.com/errata/RHSA-2017:2999	vendor-advisory x_refsource_REDHAT x_transferred
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html	mailing-list x_refsource_MLIST x_transferred
https://usn.ubuntu.com/4246-1/	vendor-advisory x_refsource_UBUNTU x_transferred
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html	mailing-list x_refsource_MLIST x_transferred
https://usn.ubuntu.com/4292-1/	vendor-advisory x_refsource_UBUNTU x_transferred
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	x_refsource_CONFIRM x_transferred
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC x_transferred
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	x_refsource_CONFIRM x_transferred
https://support.apple.com/HT208144	x_refsource_CONFIRM x_transferred
https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0	x_refsource_CONFIRM x_transferred
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib	x_refsource_MISC x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1402345	x_refsource_CONFIRM x_transferred
https://support.apple.com/HT208113	x_refsource_CONFIRM x_transferred
https://support.apple.com/HT208112	x_refsource_CONFIRM x_transferred
https://support.apple.com/HT208115	x_refsource_CONFIRM x_transferred
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf	x_refsource_MISC x_transferred
https://security.gentoo.org/glsa/202007-54	vendor-advisory x_refsource_GENTOO x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1221

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1220

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3047

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2016/12/05/21

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: http://www.securityfocus.com/bid/95131

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3046

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: https://security.gentoo.org/glsa/201701-56

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: http://www.securitytracker.com/id/1039427

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1222

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3453

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:2999

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://usn.ubuntu.com/4246-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://usn.ubuntu.com/4292-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

x_transferred

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://support.apple.com/HT208144

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1402345

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://support.apple.com/HT208113

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://support.apple.com/HT208112

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://support.apple.com/HT208115

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202007-54

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

▼National Vulnerability Database (NVD)

Source:security@opentext.com

Published At:23 May, 2017 | 04:29

Updated At:20 Apr, 2025 | 01:37

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

boost>>boost>>Versions before 1.78.0(exclusive)

cpe:2.3:a:boost:boost:*:*:*:*:*:*:*:*

zlib>>zlib>>Versions from 1.2.0.6(inclusive) to 1.2.9(exclusive)

cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*

>>leap>>42.1

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

>>leap>>42.2

cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*

>>opensuse>>13.2

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>8.0

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

>>ubuntu_linux>>16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

>>ubuntu_linux>>18.04

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*

Oracle Corporation

>>database_server>>18c

cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*

Oracle Corporation

>>jdk>>1.6.0

cpe:2.3:a:oracle:jdk:1.6.0:update161:*:*:*:*:*:*

Oracle Corporation

>>jdk>>1.7.0

cpe:2.3:a:oracle:jdk:1.7.0:update151:*:*:*:*:*:*

Oracle Corporation

>>jdk>>1.8.0

cpe:2.3:a:oracle:jdk:1.8.0:update144:*:*:*:*:*:*

Oracle Corporation

>>jre>>1.6.0

cpe:2.3:a:oracle:jre:1.6.0:update161:*:*:*:*:*:*

Oracle Corporation

>>jre>>1.7.0

cpe:2.3:a:oracle:jre:1.7.0:update151:*:*:*:*:*:*

Oracle Corporation

>>jre>>1.8.0

cpe:2.3:a:oracle:jre:1.8.0:update144:*:*:*:*:*:*

Oracle Corporation

>>mysql>>Versions from 5.5.0(inclusive) to 5.5.61(inclusive)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql>>Versions from 5.6.0(inclusive) to 5.6.41(inclusive)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql>>Versions from 5.7.0(inclusive) to 5.7.23(inclusive)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql>>Versions from 8.0.0(inclusive) to 8.0.12(inclusive)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

>>satellite>>5.8

cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*

>>enterprise_linux_desktop>>6.0

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

>>enterprise_linux_desktop>>7.0

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

>>enterprise_linux_eus>>7.4

cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*

>>enterprise_linux_eus>>7.5

cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

>>enterprise_linux_server>>6.0

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

>>enterprise_linux_server>>7.0

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

>>enterprise_linux_workstation>>6.0

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

>>enterprise_linux_workstation>>7.0

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

>>iphone_os>>Versions before 11(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>mac_os_x>>Versions from 10.0.0(inclusive) to 10.13.0(exclusive)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

>>tvos>>Versions before 11.0(exclusive)

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

>>watchos>>Versions before 4(exclusive)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 4.0.0(inclusive) to 4.1.2(inclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 4.2.0(inclusive) to 4.8.2(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 6.0.0(inclusive) to 6.8.1(inclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 6.9.0(inclusive) to 6.10.2(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 7.0.0(inclusive) to 7.6.0(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html	security@opentext.com	Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html	security@opentext.com	Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html	security@opentext.com	Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/21	security@opentext.com	Mailing List Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	security@opentext.com	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	security@opentext.com	Third Party Advisory
http://www.securityfocus.com/bid/95131	security@opentext.com	Broken Link
http://www.securitytracker.com/id/1039427	security@opentext.com	Broken Link
https://access.redhat.com/errata/RHSA-2017:1220	security@opentext.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1221	security@opentext.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1222	security@opentext.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2999	security@opentext.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3046	security@opentext.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3047	security@opentext.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3453	security@opentext.com	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1402345	security@opentext.com	Issue Tracking Third Party Advisory
https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0	security@opentext.com	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html	security@opentext.com	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html	security@opentext.com	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201701-56	security@opentext.com	Third Party Advisory
https://security.gentoo.org/glsa/202007-54	security@opentext.com	Third Party Advisory
https://support.apple.com/HT208112	security@opentext.com	Third Party Advisory
https://support.apple.com/HT208113	security@opentext.com	Third Party Advisory
https://support.apple.com/HT208115	security@opentext.com	Third Party Advisory
https://support.apple.com/HT208144	security@opentext.com	Third Party Advisory
https://usn.ubuntu.com/4246-1/	security@opentext.com	Third Party Advisory
https://usn.ubuntu.com/4292-1/	security@opentext.com	Third Party Advisory
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib	security@opentext.com	Third Party Advisory
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf	security@opentext.com	Broken Link
https://www.oracle.com/security-alerts/cpujul2020.html	security@opentext.com	Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/21	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.securityfocus.com/bid/95131	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.securitytracker.com/id/1039427	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://access.redhat.com/errata/RHSA-2017:1220	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1221	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1222	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2999	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3046	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3047	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3453	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1402345	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Third Party Advisory
https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0	af854a3a-2127-422b-91ae-364da2661108	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201701-56	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://security.gentoo.org/glsa/202007-54	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.apple.com/HT208112	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.apple.com/HT208113	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.apple.com/HT208115	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.apple.com/HT208144	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://usn.ubuntu.com/4246-1/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://usn.ubuntu.com/4292-1/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://www.oracle.com/security-alerts/cpujul2020.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2016/12/05/21

Source: security@opentext.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/95131

Source: security@opentext.com

Resource:

Broken Link

Hyperlink: http://www.securitytracker.com/id/1039427

Source: security@opentext.com

Resource:

Broken Link

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1220

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1221

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1222

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:2999

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3046

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3047

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3453

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1402345

Source: security@opentext.com

Resource:

Issue Tracking

Third Party Advisory

Hyperlink: https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0

Source: security@opentext.com

Resource:

Patch

Third Party Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

Source: security@opentext.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html

Source: security@opentext.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/201701-56

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/202007-54

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208112

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208113

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208115

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208144

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://usn.ubuntu.com/4246-1/

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://usn.ubuntu.com/4292-1/

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf

Source: security@opentext.com

Resource:

Broken Link

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Source: security@opentext.com

Resource:

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2016/12/05/21

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/95131

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://www.securitytracker.com/id/1039427

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1220

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1221

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:1222

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:2999

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3046

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3047

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3453

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1402345

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Issue Tracking

Third Party Advisory

Hyperlink: https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Third Party Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/201701-56

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://security.gentoo.org/glsa/202007-54

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208112

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208113

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208115

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/HT208144

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://usn.ubuntu.com/4246-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://usn.ubuntu.com/4292-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Similar CVEs

4224Records found

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.77% / 81.88%

||

7 Day CHG~0.00%

Published-15 Nov, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

Stack-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code via a crafted embedded font in a document.

Vendor-n/a Apple Inc.

Product-mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-1.28% / 78.74%

||

7 Day CHG+0.12%

Published-18 Nov, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

Vendor-n/a Apple Inc.Canonical Ltd.HP Inc.libxml2 (XMLSoft)Debian GNU/Linux

Product-icewall_file_manager libxml2 icewall_federation_agent watchos ubuntu_linux debian_linux iphone_os mac_os_x tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.01% / 76.18%

||

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7102.

Vendor-n/a Apple Inc.

Product-safari iphone_os tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.37% / 79.46%

||

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.

Vendor-n/a Apple Inc.

Product-mac_os_x watchos tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.65% / 81.29%

||

7 Day CHG~0.00%

Published-11 Dec, 2018 | 15:00

Updated-05 Aug, 2024 | 11:08

Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Red Hat, Inc.Google LLC Debian GNU/Linux

Product-debian_linux chrome linux_workstation linux_server linux_desktop Chrome

CWE ID-CWE-416

Use After Free

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-6.8||MEDIUM

EPSS-1.91% / 82.54%

||

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

The ANAuthenticateResource method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7620.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.65% / 81.29%

||

7 Day CHG~0.00%

Published-11 Dec, 2018 | 15:00

Updated-05 Aug, 2024 | 11:08

Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page.

Vendor-Red Hat, Inc.Google LLC Debian GNU/Linux

Product-debian_linux chrome linux_workstation linux_server linux_desktop Chrome

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.50% / 80.42%

||

7 Day CHG~0.00%

Published-26 Apr, 2021 | 16:26

Updated-03 Aug, 2024 | 18:01

Use after free in WebMIDI in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Fedora Project Google LLC Debian GNU/Linux

Product-chrome debian_linux fedora Chrome

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.97% / 82.80%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, and CVE-2016-4254.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.09% / 77.08%

||

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.

Vendor-n/a Apple Inc.

Product-safari iphone_os tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.28% / 78.78%

||

7 Day CHG~0.00%

Published-09 Mar, 2021 | 17:46

Updated-03 Aug, 2024 | 18:01

Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Linux Kernel Organization, Inc Google LLC Fedora Project Debian GNU/Linux

Product-chrome debian_linux linux_kernel fedora Chrome

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.87% / 82.33%

||

7 Day CHG~0.00%

Published-23 Oct, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.03% / 76.44%

||

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.

Vendor-n/a Apple Inc.

Product-safari iphone_os tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.28% / 78.78%

||

7 Day CHG~0.00%

Published-09 Mar, 2021 | 17:46

Updated-03 Aug, 2024 | 18:01

Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Fedora Project Google LLC Debian GNU/Linux

Product-chrome debian_linux fedora Chrome

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-7.3||HIGH

EPSS-0.27% / 50.17%

||

7 Day CHG~0.00%

Published-15 Nov, 2019 | 11:55

Updated-05 Aug, 2024 | 00:26

A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.

Vendor-openSUSE Ghostscript (Artifex Software, Inc.)Fedora Project Artifex Software Inc.

Product-ghostscript fedora leap ghostscript

CWE ID-CWE-648

Incorrect Use of Privileged APIs

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.17% / 77.81%

||

7 Day CHG~0.00%

Published-23 Oct, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.

Vendor-n/a Apple Inc.

Product-safari iphone_os itunes n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-13.44% / 93.94%

||

7 Day CHG~0.00%

Published-11 Feb, 2021 | 19:42

Updated-16 Sep, 2024 | 20:21

Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-4.37% / 88.52%

||

7 Day CHG~0.00%

Published-09 Sep, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF file.

Vendor-n/a Apple Inc.

Product-iphone_os ipod_touch n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-71.61% / 98.67%

||

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-40.01% / 97.23%

||

7 Day CHG~0.00%

Published-19 Feb, 2020 | 20:27

Updated-13 Aug, 2025 | 20:48

Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c.

Vendor-audiofile n/a Canonical Ltd.Fedora Project

Product-audiofile ubuntu_linux fedora n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-17.39% / 94.80%

||

7 Day CHG~0.00%

Published-09 Sep, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines.

Vendor-n/a Apple Inc.

Product-iphone_os ipod_touch n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.87% / 82.33%

||

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-6.12% / 90.42%

||

7 Day CHG~0.00%

Published-23 Oct, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x iphone_os watchos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-3.70% / 87.48%

||

7 Day CHG~0.00%

Published-17 Jun, 2010 | 16:00

Updated-11 Apr, 2025 | 00:51

Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) afp, (2) cifs, or (3) smb URL.

Vendor-n/a Apple Inc.

Product-mac_os_x mac_os_x_server n/a

CWE ID-CWE-134

Use of Externally-Controlled Format String

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.92% / 74.98%

||

7 Day CHG~0.00%

Published-02 Nov, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.

Vendor-polarssl n/a Arm Limited openSUSE Fedora Project Debian GNU/Linux

Product-fedora opensuse polarssl mbed_tls debian_linux n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.35% / 79.31%

||

7 Day CHG~0.00%

Published-09 Mar, 2021 | 17:46

Updated-03 Aug, 2024 | 18:01

Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Fedora Project Google LLC Debian GNU/Linux

Product-chrome debian_linux fedora Chrome

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.01% / 76.18%

||

7 Day CHG~0.00%

Published-23 Oct, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.

Vendor-n/a Apple Inc.

Product-safari iphone_os itunes n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Talos

Matching Score-8

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-0.31% / 53.75%

||

7 Day CHG~0.00%

Published-18 Aug, 2021 | 12:50

Updated-03 Aug, 2024 | 18:23

Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.

Vendor-n/a Debian GNU/Linux GPAC

Product-gpac debian_linux GPAC

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.95% / 82.72%

||

7 Day CHG~0.00%

Published-30 Apr, 2021 | 20:15

Updated-03 Aug, 2024 | 18:09

Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Fedora Project Google LLC Debian GNU/Linux

Product-chrome debian_linux fedora Chrome

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.52% / 80.54%

||

7 Day CHG~0.00%

Published-08 Jan, 2021 | 17:56

Updated-03 Aug, 2024 | 18:01

Heap buffer overflow in Skia in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Fedora Project Google LLC Debian GNU/Linux

Product-chrome debian_linux fedora Chrome

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-8.61% / 92.07%

||

7 Day CHG~0.00%

Published-30 Jan, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Integer overflow in CoreGraphics in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x tvos n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.80% / 82.01%

||

7 Day CHG~0.00%

Published-16 Nov, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

ImageIO in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted PSD image.

Vendor-n/a Apple Inc.

Product-mac_os_x mac_os_x_server n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-5.51% / 89.86%

||

7 Day CHG~0.00%

Published-09 Sep, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving selections.

Vendor-webkitgtk n/a Canonical Ltd.Apple Inc.

Product-ubuntu_linux iphone_os ipod_touch webkitgtk n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.51% / 80.47%

||

7 Day CHG~0.00%

Published-22 Jun, 2010 | 20:24

Updated-11 Apr, 2025 | 00:51

ImageIO in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG image.

Vendor-n/a Apple Inc.

Product-iphone_os ipod_touch n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.6||MEDIUM

EPSS-0.57% / 67.67%

||

7 Day CHG~0.00%

Published-09 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.

Vendor-n/a Apple Inc.

Product-quicktime n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-7.08% / 91.15%

||

7 Day CHG~0.00%

Published-11 Feb, 2021 | 19:42

Updated-17 Sep, 2024 | 04:20

Acrobat Reader DC Integer Overflow Vulnerability Could Lead To Arbitrary Code Execution

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Integer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader

CWE ID-CWE-190

Integer Overflow or Wraparound

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.52% / 80.54%

||

7 Day CHG~0.00%

Published-08 Jan, 2021 | 17:57

Updated-03 Aug, 2024 | 18:01

Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Fedora Project Google LLC Debian GNU/Linux

Product-chrome debian_linux fedora Chrome

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.21% / 43.86%

||

7 Day CHG~0.00%

Published-30 Jan, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from the user, which allows attackers to bypass intended first-launch restrictions by leveraging access to an enterprise distribution certificate for signing a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Flexera Software LLC

Matching Score-8

Assigner-Flexera Software LLC

CVSS Score-8.8||HIGH

EPSS-9.79% / 92.66%

||

7 Day CHG~0.00%

Published-13 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 11.5.7.609 does not properly process asset entries, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted Shockwave file.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows shockwave_player macos n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.28% / 78.78%

||

7 Day CHG~0.00%

Published-09 Mar, 2021 | 17:46

Updated-03 Aug, 2024 | 18:01

Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Vendor-Fedora Project Google LLC Debian GNU/Linux

Product-chrome debian_linux fedora Chrome

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Talos

Matching Score-8

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-0.21% / 43.47%

||

7 Day CHG~0.00%

Published-19 Nov, 2021 | 00:00

Updated-03 Aug, 2024 | 18:30

A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

Vendor-librecad n/a Debian GNU/Linux Fedora Project

Product-libdxfrw debian_linux fedora LibreCAD

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-1.48% / 80.21%

||

7 Day CHG~0.00%

Published-25 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5786.

Vendor-n/a Apple Inc.

Product-quicktime n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.8||MEDIUM

EPSS-11.34% / 93.28%

||

7 Day CHG~0.00%

Published-18 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Integer overflow in CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x tvos n/a

Matching Score-8

Assigner-Talos

Matching Score-8

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-0.30% / 53.10%

||

7 Day CHG~0.00%

Published-18 Aug, 2021 | 12:43

Updated-03 Aug, 2024 | 18:23

Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.

Vendor-n/a Debian GNU/Linux GPAC

Product-gpac debian_linux GPAC

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Talos

Matching Score-8

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-0.25% / 48.28%

||

7 Day CHG~0.00%

Published-25 Aug, 2021 | 18:21

Updated-03 Aug, 2024 | 18:23

An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input used to process an atom using the “saio” FOURCC code cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.

Vendor-n/a Debian GNU/Linux GPAC

Product-gpac debian_linux GPAC Project

CWE ID-CWE-680

Integer Overflow to Buffer Overflow

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Talos

Matching Score-8

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-0.34% / 56.07%

||

7 Day CHG~0.00%

Published-19 Nov, 2021 | 00:00

Updated-03 Aug, 2024 | 18:30

A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Vendor-librecad n/a Debian GNU/Linux Fedora Project

Product-libdxfrw debian_linux fedora LibreCAD

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Talos

Matching Score-8

Assigner-Talos

CVSS Score-8.8||HIGH

EPSS-0.92% / 75.04%

||

7 Day CHG~0.00%

Published-08 Sep, 2021 | 15:11

Updated-03 Aug, 2024 | 18:30

A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Vendor-ribbonsoft n/a Debian GNU/Linux Fedora Project

Product-extra_packages_for_enterprise_linux dxflib debian_linux fedora Ribbonsoft

CWE ID-CWE-191

Integer Underflow (Wrap or Wraparound)

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Flexera Software LLC

Matching Score-8

Assigner-Flexera Software LLC

CVSS Score-8.8||HIGH

EPSS-11.73% / 93.44%

||

7 Day CHG~0.00%

Published-13 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via crafted embedded fonts in a Shockwave file.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows shockwave_player macos n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-6.8||MEDIUM

EPSS-2.15% / 83.55%

||

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

The CBBBRInvite method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_reader macos acrobat_dc windows acrobat n/a

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-47.74% / 97.63%

||

7 Day CHG-2.55%

Published-09 Feb, 2021 | 15:30

Updated-30 Jul, 2025 | 01:38

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendor-Fedora Project Debian GNU/Linux Google LLC

Product-fedora debian_linux chrome Chrome Chromium V8

CWE ID-CWE-787

Out-of-bounds Write