Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.

Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

HPE NonStop Posix User Threads - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.

Heap Use-After-Free in GPAC MP4Box Leading to Denial of Service

A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.

Windows Spaceport.sys Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.

Windows NTFS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Kernel Streaming Service Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

Windows libarchive Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.

libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow

A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

dm-integrity: fix buffer overflow in inline mode with large tag size

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read. Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata. Note that this is not a security bug because the buffer overflow can only be triggered by root.

Windows Update Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.

Windows iSCSI Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack.

Windows libarchive Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Credential Providers Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.