CVE Vulnerability Catalog

A vulnerability in ISC BIND 9.x before version 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service via a DNAME record in the answer section of a response to a recursive query.

A memory corruption in the IPsec code path of Brocade NetIron OS could lead to denial of service via line card reset. Attackers can exploit specially crafted IPsec control packets to trigger this issue.

An out-of-bounds read vulnerability in Foxit Reader and PhantomPDF before version 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document.

CVE-2016-8877 is a heap buffer overflow (Out-of-Bounds write) vulnerability in Foxit Reader and PhantomPDF before version 8.1 on Windows. It allows remote attackers to execute arbitrary code via a crafted JPEG2000 image embedded in a PDF document.

Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before version 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted TIFF image embedded in the XFA stream in a PDF document.

Foxit Reader for Mac version 2.1.0.0804 and earlier and Foxit Reader for Linux version 2.1.0.0805 and earlier had a vulnerability where weak file permissions could be exploited by attackers to execute arbitrary code.

On Samsung Galaxy S4 through S7 devices, the 'omacp' app ignores security information embedded in the OMACP messages, leading to the acceptance, parsing, and handling of unsolicited WAP Push SMS messages by the device.

On Samsung Galaxy S4 through S7 devices, an integer overflow condition exists within libomacp.so when parsing OMACP messages, leading to heap corruption. This can result in Denial of Service and potentially remote code execution.

On Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message triggers an unhandled ArrayIndexOutOfBoundsException in Samsung's implementation of the WifiServiceImpl class. This causes the Android runtime to continually crash, rendering the device unusable until a factory reset is performed.

On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework.

The sendRequest method in the HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF.

There is a NULL Pointer Access in function imagetopnm of convert.c in OpenJPEG 2.1.2. The value of image->comps[compno].data is not assigned after initialization, leading to a program crash.

There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. The image->comps[0].data is not assigned a value after initialization (NULL), leading to Denial of Service.

A floating point exception (FPE) occurs in the opj_pi_next_cprl function in OpenJPEG 2.1.2, which may lead to calculation errors, including division by zero.

An out-of-bounds read vulnerability was observed in the Sp_replace_regexp function of Artifex Software, Inc. MuJS before version 5000749f5afe3b956fc916e407309de840997f4a. Successful exploitation of this issue can lead to code execution or denial of service condition.

A buffer overflow vulnerability was observed in the divby function of MuJS before version 8c805b4eb19cf2af689c860b77e6111d2ee439d5. Successful exploitation of this issue can lead to code execution or denial of service condition.

A use-after-free vulnerability was observed in the Rp_toString function of MuJS before version 5c337af4b3df80cf967e4f9f6a21522de84b392a. Successful exploitation can lead to code execution or denial of service condition.

HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a 'Buffer Overflow' issue.

HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a 'Buffer Overflow' issue.