CVE Vulnerability Catalog

The Microsoft Malware Protection Engine on various Windows versions improperly scans a specially crafted file, leading to memory corruption. This may allow for remote code execution.

A heap-based buffer overflow in the de_dotdot function in libhttpd.c in sthttpd before version 2.27.1 can be exploited by remote attackers. This may lead to a denial of service (daemon crash) or possibly other unspecified impacts via a crafted filename.

An authorization bypass in the web interface of Arcadyan SLT-00 Star* (also known as Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the static routing table via an unauthenticated HTTP request.

Apache Ignite versions from 1.0.0-RC3 to 2.0 uses an update notifier component that sends data to an external PHP server. During this communication, sensitive user information such as Apache Ignite or Java version may be transmitted.

The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg before versions 2.8.12, 3.0.8, 3.1.8, 3.2.5, and 3.3.1 does not exclude the CHUNKY format, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

In libavcodec/scpr.c in FFmpeg version 3.3 and earlier, before version 3.3.1, height and width data is not properly validated, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

In the libavcodec library in FFmpeg before version 2.8.12 and 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1, the pix_fmt is not ensured to be set, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

FFmpeg versions before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 do not properly restrict HTTP Live Streaming filename extensions and demuxer names, allowing attackers to read arbitrary files via crafted playlist data.

A heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

A heap-based buffer overflow in the xwd_decode_frame function in FFmpeg before 2.8.12 and 3.0.x before 3.0.8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

A stack-based buffer overflow in the color_string_to_rgba function in libavcodec/xpmdec.c in FFmpeg 3.3 before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input can lead to a remote denial of service attack.

The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a 'double fetch' vulnerability.

The snd_msndmidi_input_read function in the Linux kernel through version 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, known as a 'double fetch' vulnerability.

The snd_msnd_interrupt function in the Linux kernel up to version 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, known as a 'double fetch' vulnerability.

In systemd versions up to 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, leading to arbitrary data being written beyond its end.

ViMbAdmin 3.0.15 has multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions that allow remote attackers to hijack the authentication of logged administrators.

CVE-2017-2491 is a 'use after free' vulnerability in the String.replace method in JavaScriptCore in Apple Safari on iOS before version 10.3. It allows remote attackers to execute arbitrary code via a crafted web page or file.

The vulnerability in rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password in cleartext.

Version 3.1.1 of elog allows remote attackers to post data as any username in the logbook.