CVE-2015-5156

kernel: buffer overflow with fraglist larger than MAX_SKB_FRAGS + 2 in virtio-net

The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.

CVSS 2.0 · 6.1 Medium EPSS 1.0% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Extras Rt

CVE-2014-3635

dbus: heap-based buffer overflow flaw in file descriptor passing

Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

D-bus Project Freedesktop Opensuse

Products

D-bus Dbus Opensuse

CVE-2014-0226

httpd: mod_status heap-based buffer overflow

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

CVSS 2.0 · 6.8 Medium EPSS 85.8% KEV · Not listed

Vendors

Apache Debian Oracle and 1 more

Products

Http Server Debian Linux Enterprise Manager Ops Center and 6 more

CVE-2014-0172

elfutils: integer overflow, leading to a heap-based buffer overflow in libdw

Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 4.0% KEV · Not listed

Vendors

Elfutils Project Redhat

Products

Elfutils Enterprise Linux

CVE-2015-5259

subversion: integer overflow in the svn:// protocol parser

Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.

CVSS 3.0 · 8.6 High EPSS 57.0% KEV · Not listed

Vendors

Apache

Products

Subversion

CVE-2015-5279

qemu: Heap overflow vulnerability in ne2000_receive() function

Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.

CVSS 2.0 · 7.2 High EPSS 1.0% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Openstack and 1 more

CVE-2015-5343

subversion: (mod_dav_svn) integer overflow when parsing skel-encoded request bodies

Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.

CVSS 3.0 · 7.6 High EPSS 30.2% KEV · Not listed

Vendors

Apache Debian

Products

Subversion Debian Linux

CVE-2015-6525

libevent: multiple integer overflows in the evbuffer APIs

Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.

CVSS 2.0 · 7.5 High EPSS 4.8% KEV · Not listed

Vendors

Debian Libevent Project

Products

Debian Linux Libevent

CVE-2010-5325

foomatic: potential remote arbitrary code execution

Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a long job title.

CVSS 3.0 · 9.8 Critical EPSS 5.5% KEV · Not listed

Vendors

Linuxfoundation Oracle Redhat

Products

Foomatic-filters Linux Enterprise Linux and 5 more

CVE-2010-5110

poppler: heap based buffer overflow in DCTStream.cc

DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

CVSS 2.0 · 4.3 Medium EPSS 3.0% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2015-7497

libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey

Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed

Vendors

Canonical Debian Hp and 2 more

Products

Ubuntu Linux Debian Linux Icewall Federation Agent and 8 more

CVE-2015-7498

libxml2: Heap-based buffer overflow in xmlParseXmlDecl

Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed

Vendors

Canonical Debian Hp and 2 more

Products

Ubuntu Linux Debian Linux Icewall Federation Agent and 8 more

CVE-2015-7499

libxml2: Heap-based buffer overflow in xmlGROW

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed

Vendors

Apple Canonical Debian and 4 more

Products

Iphone Os Mac Os X Tvos and 14 more

CVE-2016-4738

libxslt: Heap overread due to an empty decimal-separator

libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

CVSS 3.0 · 8.8 High EPSS 4.1% KEV · Not listed

Vendors

Apple Debian

Products

Iphone Os Mac Os X Tvos and 2 more

CVE-2014-1303

webkitgtk: heap-based buffer overflow (WSA-2015-0001)

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.

CVSS 2.0 · 10.0 Critical EPSS 34.8% KEV · Not listed

Vendors

Apple

Products

Safari

CVE-2015-5225

Qemu: ui: vnc: heap memory corruption in vnc_refresh_server_surface

Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu Redhat

Products

Fedora Qemu Enterprise Linux and 1 more

CVE-2014-8502

binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485)

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

CVSS 2.0 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 1 more

Products

Ubuntu Linux Fedora Binutils and 1 more

CVE-2014-3676

shim: heap-based buffer overflow flaw in IPv6 address parsing

Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVSS 2.0 · 7.5 High EPSS 5.2% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Shim

CVE-2025-1176

GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec heap-based overflow

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Binutils

CVE-2025-2849

UPX p_lx_elf.cpp un_DT_INIT heap-based overflow

A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_elf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Upx

Products

Upx