tcpdump: multiple overflow issues in protocol decoding

The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:udp_print().

tcpdump: multiple overflow issues in protocol decoding

The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:vat_print().

tcpdump: multiple overflow issues in protocol decoding

The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame().

tcpdump: multiple overflow issues in protocol decoding

The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions.

tcpdump: multiple overflow issues in protocol decoding

The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions.

tcpdump: multiple overflow issues in protocol decoding

The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.

tcpdump: multiple overflow issues in protocol decoding

The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.

tcpdump: multiple overflow issues in protocol decoding

The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().

tcpdump: multiple overflow issues in protocol decoding

The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().

tcpdump: multiple overflow issues in protocol decoding

The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print().

tcpdump: multiple overflow issues in protocol decoding

The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().

tcpdump: multiple overflow issues in protocol decoding

The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions.

tcpdump: multiple overflow issues in protocol decoding

A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).

tcpdump: multiple overflow issues in protocol decoding

The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print().

Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass (Peripheral Image Loader) PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR#1023638.

tcpdump: multiple overflow issues in protocol decoding

The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print().

tcpdump: multiple overflow issues in protocol decoding

The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482.

kernel: Integer overflow in the RDMA over infiniband software implementation

Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology.

cairo: Out of bounds read in read_png/write_png in cairo-png.c

Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference) via a large svg file.

libwebp: Several integer overflows

Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.