CVE Vulnerability Catalog

Possible buffer overflow in storage subsystem. Bad parameters as part of listener responses to RPMB commands could lead to buffer overflow.

Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call may result in hypervisor memory overwrite.

Possible buffer overflow in trust zone access control API. Buffer overflow may occur due to lack of buffer size checking.

Integer overflow leads to a TOCTOU condition in hypervisor PIL. This overflow can be exploited to bypass (Peripheral Image Loader) PIL authentication.

Improper input validation in Access Control APIs may lead to incorrect memory range checking. The issue affects the kernel version 3.18.

Unauthenticated messages are processed by the User Equipment (UE). Certain NAS messages are processed when no EPS security context exists in the UE.

In CodeIgniter before version 3.1.3, a vulnerability exists in Email.php that allows remote attackers to execute arbitrary code. Attackers can leverage control over the email->from field to inject sendmail command-line arguments.

All versions of PHP 7 have a vulnerability that during the unserialization process may lead to use-after-free when resizing the 'properties' hash table of a serialized object. A remote attacker may exploit this bug to gain arbitrary code execution.

The base64decode function in base64.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.

The SplObjectStorage unserialize implementation in PHP before 7.0.12 does not verify that a key is an object, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.

In PHP before 7.0.15 and 7.1.x before 7.1.1, there is an issue in zend_hash.c that mishandles cases requiring large array allocations. This can allow remote attackers to execute arbitrary code or cause a denial of service.

The 'process-execute' and 'process-spawn' procedures in CHICKEN Scheme use fixed-size buffers for holding arguments and environment variables for the execve() call. This can lead to buffer overrun when user-supplied argument/environment variable lists are provided.

eClinicalWorks Population Health (CCMR) has a session fixation vulnerability. The application does not assign a new session ID during user authentication, allowing the use of an existing session ID.

Splunk Web in Splunk Enterprise before version 5.0.17, 6.0.13, 6.1.12, 6.2.12, 6.3.8, and 6.4.4 is vulnerable to HTTP request injection attacks, allowing remote attackers to obtain sensitive REST API authentication-token information.

An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1 regarding unauthenticated access to the gfsh (Geode Shell) endpoint. This endpoint is publicly accessible, allowing attackers to execute any commands.

Multiple integer overflows in the process_bin_update function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An integer overflow in the process_bin_append_prepend function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An exploitable out-of-bounds write exists in the Bzip2 parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted Bzip2 document can lead to a stack-based buffer overflow causing an out-of-bounds write which under the right circumstance could potentially be leveraged by an attacker to gain arbitrary code execution.

CVE-2016-2339 describes a heap overflow vulnerability in the 'initialize' function of Fiddle::Function.new in Ruby. A specially crafted object passed as an element of the args array can increase the size of this array after allocation, leading to a heap overflow.

Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.