CVE-2014-7187

bash: off-by-one error in deeply nested flow control constructs

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

CVSS 2.0 · 10.0 Critical EPSS 58.5% KEV · Not listed

Vendors

Gnu Redhat

Products

Bash Enterprise Linux Rhel Els and 4 more

CVE-2016-5180

c-ares: Single byte out of buffer write

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

CVSS 3.1 · 9.8 Critical EPSS 8.7% KEV · Not listed

Vendors

C-ares C-ares Project Canonical and 3 more

Products

C-ares C-ares Ubuntu Linux and 3 more

CVE-2015-2189

wireshark: The pcapng file parser could crash (wnpa-sec-2015-08)

Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed

Vendors

Debian Mageia Opensuse and 3 more

Products

Debian Linux Mageia Opensuse and 4 more

CVE-2015-8701

Qemu: net: rocker: stack buffer overflow(off-by-one) in tx_consume routine

QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2014-5388

Qemu: out of bounds memory access

Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Qemu

Products

Ubuntu Linux Qemu

CVE-2014-5119

glibc: off-by-one error leading to a heap-based buffer overflow flaw in __gconv_translit_find()

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

CVSS 2.0 · 7.5 High EPSS 17.0% KEV · Not listed

Vendors

Debian Gnu Redhat

Products

Debian Linux Glibc Enterprise Linux and 2 more

CVE-2014-9664

freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.

CVSS 2.0 · 6.8 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 10 more

CVE-2015-3144

curl: host name out of boundary memory access

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

CVSS 2.0 · 9.0 Critical EPSS 10.5% KEV · Not listed

Vendors

Canonical Debian Haxx and 1 more

Products

Ubuntu Linux Debian Linux Curl and 2 more

CVE-2015-3145

curl: cookie parser out of boundary memory access

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

CVSS 2.0 · 7.5 High EPSS 30.5% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Mac Os X Ubuntu Linux Debian Linux and 6 more

CVE-2015-3239

libunwind: off-by-one in dwarf_to_unw_regnum()

Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Libunwind Project Redhat

Products

Libunwind Openstack

CVE-2014-8157

jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)

Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 16.9% KEV · Not listed

Vendors

Debian Jasper Project Opensuse and 1 more

Products

Debian Linux Jasper Opensuse and 2 more

CVE-2014-9657

freetype: off-by-one buffer over-read in tt_face_load_hdmx()

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 10 more

CVE-2014-1895

xen: Off-by-one error in FLASK_AVC_CACHESTAT hypercall (xsa-85)

Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.

CVSS 2.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-9029

jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009)

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 18.2% KEV · Not listed

Vendors

Jasper Project Redhat

Products

Jasper Enterprise Linux Rhev Manager

CVE-2012-0501

OpenJDK: off-by-one bug in ZIP reading code (JRE, 7118283)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect availability via unknown vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed

Vendors

Oracle Redhat Sun

Products

Jre Enterprise Linux Network Satellite and 2 more

CVE-2012-2840

libexif: "exif_convert_utf16_to_utf8()" off-by-one

Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Libexif Project Redhat

Products

Libexif Enterprise Linux

CVE-2012-1129

freetype: heap off-by-one buffer underflow in Type42 parser t42_parse_sfnts() (#35602)

FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted SFNT string in a Type 42 font.

CVSS 2.0 · 9.3 Critical EPSS 3.8% KEV · Not listed

Vendors

Freetype Mozilla

Products

Freetype Firefox Mobile

CVE-2011-5244

t1lib: off-by-one errors in token and linetoken

Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.

CVSS 2.0 · 6.8 Medium EPSS 3.4% KEV · Not listed

Vendors

Gnome T1lib Tetex

Products

Evince T1lib Tetex

CVE-2011-3062

Mozilla: Off-by-one error in OpenType Sanitizer (MFSA 2012-31)

Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.

CVSS 2.0 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Google Mozilla Redhat

Products

Chrome Firefox Seamonkey and 3 more

CVE-2013-7205

nagios: denial of service due to off-by-one flaw in process_cgivars()

Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.

CVSS 2.0 · 6.4 Medium EPSS 4.6% KEV · Not listed

Vendors

Nagios

Products

Nagios