Vulnerabilities (CVE)

Transient DOS while parse fils IE with length equal to 1.

Memory corruption during the image encoding process.

Information disclosure in IOE Firmware while handling WMI command.

Information disclosure while handling T2LM Action Frame in WLAN Host.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.

Memory corruption during management frame processing due to mismatch in T2LM info element.

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Memory corruption when the captureRead QDCM command is invoked from user-space.

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.

Transient DOS in WLAN Firmware while parsing rsn ies.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Transient DOS while parsing probe response and assoc response frame.

Transient DOS while processing received beacon frame.

Transient DOS in WLAN Firmware while parsing a NAN management frame.

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

Transient DOS in WLAN Firmware while parsing no-inherit IES.

Transient DOS while parsing per STA profile in ML IE.

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the read_iptc_profile function in the Source/Metadata/IPTC.cpp file because the size of the profile is not being sanitized, causing a crash in the application linked to the library, resulting in a denial of service.

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resu ... A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

Show More

A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resu ... A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

Show More

Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2.

Buffer over-read in Storage Port Driver allows an authorized attacker to disclose information locally.

Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.

Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally.

Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally.

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.