CVE-2015-1858

qt: segmentation fault in qbmphandler.cpp

Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image.

CVSS 2.0 · 6.8 Medium EPSS 7.1% KEV · Not listed

Vendors

Digia Fedoraproject Qt

Products

Qt Fedora Qt

CVE-2015-1859

qt: segmentation fault in qicohandler.cpp

Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.

CVSS 2.0 · 6.8 Medium EPSS 6.5% KEV · Not listed

Vendors

Digia Fedoraproject Qt

Products

Qt Fedora Qt

CVE-2015-1860

qt: segmentation fault in qgifhandler.cpp

Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image.

CVSS 2.0 · 6.8 Medium EPSS 8.6% KEV · Not listed

Vendors

Digia Fedoraproject Qt

Products

Qt Fedora Qt

CVE-2015-1863

wpa_supplicant: P2P SSID processing vulnerability

Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVSS 2.0 · 5.8 Medium EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Opensuse and 8 more

CVE-2015-2785

byzanz: Out-of heap-based buffer write in GIF encoder

The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.

CVSS 2.0 · 7.5 High EPSS 2.8% KEV · Not listed

Vendors

Gnome

Products

Byzanz

CVE-2015-3622

libtasn1: heap overflow flaw in _asn1_extract_der_octet()

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.

CVSS 3.0 · 5.9 Medium EPSS 32.9% KEV · Not listed

Vendors

Fedoraproject Gnu Opensuse and 1 more

Products

Fedora Libtasn1 Opensuse and 1 more

CVE-2015-4491

Mozilla: Heap overflow in gdk-pixbuf when scaling bitmap images (MFSA 2015-88)

Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.

CVSS 2.0 · 6.8 Medium EPSS 8.4% KEV · Not listed

Vendors

Canonical Fedoraproject Gnome and 6 more

Products

Ubuntu Linux Fedora Gdk-pixbuf and 6 more

CVE-2015-4588

libwmf: heap overflow within the RLE decoding of embedded BMP images

Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.

CVSS 2.0 · 6.8 Medium EPSS 9.2% KEV · Not listed

Vendors

Fedoraproject Opensuse Redhat and 1 more

Products

Fedora Opensuse Enterprise Linux and 1 more

CVE-2015-5522

tidy: heap buffer overflow in ParseValue()

Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.

CVSS 2.0 · 6.8 Medium EPSS 4.6% KEV · Not listed

Vendors

Apple Canonical Debian and 1 more

Products

Iphone Os Mac Os X Watchos and 3 more

CVE-2015-5523

tidy: heap buffer overflow in ParseValue()

The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed

Vendors

Apple Canonical Debian and 1 more

Products

Iphone Os Mac Os X Watchos and 3 more

CVE-2015-7182

nss: ASN.1 decoder heap overflow when decoding constructed OCTET STRING that mixes indefinite and definite length encodings (MFSA 2015-133)

Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.

CVSS 3.0 · 9.8 Critical EPSS 10.2% KEV · Not listed

Vendors

Mozilla Oracle Redhat

Products

Firefox Network Security Services Glassfish Server and 8 more

CVE-2015-7183

nspr: heap-buffer overflow in PL_ARENA_ALLOCATE (MFSA 2015-133)

Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

CVSS 2.0 · 7.5 High EPSS 6.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Network Security Services Enterprise Linux and 3 more

CVE-2015-7805

libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header

Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.

CVSS 2.0 · 9.3 Critical EPSS 14.3% KEV · Not listed

Vendors

Mega-nerd Opensuse

Products

Libsndfile Opensuse

CVE-2015-7942

libxml2: heap-based buffer overflow in xmlParseConditionalSections()

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

CVSS 2.0 · 6.8 Medium EPSS 4.5% KEV · Not listed

Vendors

Apple Canonical Debian and 3 more

Products

Iphone Os Mac Os X Tvos and 8 more

CVE-2015-8668

libtiff: OOB read in bmp2tiff

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

CVSS 3.1 · 9.8 Critical EPSS 13.7% KEV · Not listed

Vendors

Libtiff Oracle Redhat

Products

Libtiff Linux Vm Server and 3 more

CVE-2015-8723

wireshark: 802.11 decryption crash (wnpa-sec-2015-42)

The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship between the total length and the capture length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.

CVSS 3.0 · 5.5 Medium EPSS 4.7% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2015-8724

wireshark: 802.11 decryption crash (wnpa-sec-2015-42)

The AirPDcapDecryptWPABroadcastKey function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not verify the WPA broadcast key length, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.

CVSS 3.0 · 5.5 Medium EPSS 4.3% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2015-8733

wireshark: Sniffer file parser crash (wnpa-sec-2015-51)

The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationships between record lengths and record header lengths, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 4.1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2015-8806

libxml2: heap-buffer overread in dict.c

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed

Vendors

Canonical Debian Xmlsoft

Products

Ubuntu Linux Debian Linux Libxml2

CVE-2016-1523

graphite2: Heap-based buffer overflow in context item handling functionality

The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Debian Fedoraproject Mozilla and 2 more

Products

Debian Linux Fedora Firefox and 3 more