CVE-2008-0668

gnumeric: integer overflow and signedness errors in XLS processing

The excel_read_HLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing XLS HLINK opcodes, possibly because of an integer signedness error that leads to an integer overflow. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 9.3 Critical EPSS 5.0% KEV · Not listed

Vendors

Gnome Redhat

Products

Gnumeric Fedora

CVE-2009-0200

OpenOffice.org Word document Integer Underflow

Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 6.7% KEV · Not listed

Vendors

Openoffice Redhat

Products

Openoffice.org Enterprise Linux

CVE-2007-6429

xfree86: integer overflow in EVI extension

Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.

CVSS 2.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Evi Mit-shm and 1 more

CVE-2007-5747

openoffice.org: Quattro Pro files parsing integer underflow

Integer underflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted values that trigger an excessive loop and a stack-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 4.1% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Openoffice.org

CVE-2007-4997

kernel ieee80211 off-by-two integer underflow

Integer underflow in the ieee80211_rx function in net/ieee80211/ieee80211_rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service (crash) via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211_STYPE_QOS_DATA flag is set, aka an "off-by-two error."

CVSS 2.0 · 7.1 High EPSS 3.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2007-4988

Integer overflow in ImageMagick's DIB coder

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS 3.1% KEV · Not listed

Vendors

Canonical Imagemagick Redhat

Products

Ubuntu Linux Imagemagick Enterprise Linux

CVE-2009-1179

PDF JBIG2 integer overflow

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0 · 6.8 Medium EPSS 5.5% KEV · Not listed

Vendors

Apple Foolabs Glyphandcog and 2 more

Products

Cups Xpdf Xpdfreader and 2 more

CVE-2009-1187

poppler CairoOutputDev integer overflow

Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc).

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed

Vendors

Poppler Redhat

Products

Poppler Enterprise Linux

CVE-2009-1188

xpdf/poppler: SplashBitmap integer overflow

Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed

Vendors

Poppler Redhat

Products

Poppler Enterprise Linux

CVE-2007-4986

Multiple integer overflows in ImageMagick

Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 3.3% KEV · Not listed

Vendors

Imagemagick Redhat

Products

Imagemagick Enterprise Linux

CVE-2009-1194

pango: pango_glyph_string_set_size integer overflow

Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.

CVSS 2.0 · 6.8 Medium EPSS 4.1% KEV · Not listed

Vendors

Pango Redhat

Products

Pango Enterprise Linux

CVE-2008-3144

python: Potential integer underflow and overflow in the PyOS_vsnprintf C API function

Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations. NOTE: the handling of certain integer values is also affected by related integer underflows and an off-by-one error.

CVSS 2.0 · 5.0 Medium EPSS 4.2% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux

CVE-2008-4225

libxml2: integer overflow leading to infinite loop in xmlBufferResize

Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

CVSS 2.0 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Enterprise Linux Libxml

CVE-2008-4226

libxml2: integer overflow leading to memory corruption in xmlSAX2Characters

Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.

CVSS 2.0 · 10.0 Critical EPSS 4.1% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Enterprise Linux Libxml

CVE-2008-4316

glib2: integer overflows in the base64 handling functions (oCERT-2008-015)

Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Enterprise Linux

CVE-2008-3143

python: Multiple integer overflows discovered by Google

Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _struct.c, (4) arraymodule.c, (5) audioop.c, (6) binascii.c, (7) cPickle.c, (8) cStringIO.c, (9) cjkcodecs/multibytecodec.c, (10) datetimemodule.c, (11) md5.c, (12) rgbimgmodule.c, and (13) stropmodule.c in Modules/; (14) bufferobject.c, (15) listobject.c, and (16) obmalloc.c in Objects/; (17) Parser/node.c; and (18) asdl.c, (19) ast.c, (20) bltinmodule.c, and (21) compile.c in Python/, as addressed by "checks for integer overflows, contributed by Google."

CVSS 2.0 · 7.5 High EPSS 3.1% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux

CVE-2008-2927

pidgin MSN integer overflow

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.

CVSS 2.0 · 6.8 Medium EPSS 4.3% KEV · Not listed

Vendors

Adium Pidgin Redhat

Products

Adium Pidgin Enterprise Linux

CVE-2008-2316

python: integer overflow in hashlib module

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Python

Products

Python

CVE-2008-2315

python: Multiple integer overflows in python core

Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux

CVE-2007-4965

python imageop module heap corruption

Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain sensitive information (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.

CVSS 2.0 · 5.8 Medium EPSS 14.0% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux Network Satellite