expat: Integer overflow in copyString()

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

Tomcat/JBossWeb: Request smuggling via malicious content length header

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

expat: integer overflow in the doProlog function

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

expat: Integer overflow in function XML_GetBuffer

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

expat: Integer overflow in storeAtts in xmlparse.c

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in nextScaffoldPart in xmlparse.c

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in lookup in xmlparse.c

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in defineAttribute in xmlparse.c

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in build_model in xmlparse.c

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in addBinding in xmlparse.c

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in doProlog in xmlparse.c

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

gmp: Integer overflow and resultant buffer overflow via crafted input

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

util-linux: integer overflow can lead to buffer overflow in get_sem_elements() in sys-utils/ipcutils.c

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

glibc: Arbitrary read in wordexp()

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to 32 bits

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a 64-bit platform

An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

lz4: memory corruption due to an integer overflow bug caused by memmove argument

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

openldap: Integer underflow in serialNumberAndIssuerCheck in schema_init.c

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).

p11-kit: integer overflow when allocating memory for arrays or attributes and object identifiers

An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.

Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error.