CWE-125
Out-of-bounds Read
Description
The product reads data past the end, or before the beginning, of the intended buffer.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-540
CVEs mapped to this weakness (9,337)
page 42 of 467| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-6806 | Hig | 0.57 | 8.8 | 0.03 | Mar 25, 2020 | By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox… | ||
| CVE-2020-6628 | Hig | 0.57 | 8.8 | 0.02 | Jan 9, 2020 | Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c. | ||
| CVE-2020-6622 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8. | ||
| CVE-2020-6621 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT. | ||
| CVE-2020-6620 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8. | ||
| CVE-2020-6618 | Hig | 0.57 | 8.8 | 0.01 | Jan 8, 2020 | stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table. | ||
| CVE-2020-6609 | Hig | 0.57 | 8.8 | 0.02 | Jan 8, 2020 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c. | ||
| CVE-2019-20219 | Hig | 0.57 | 8.8 | 0.01 | Jan 2, 2020 | ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c. | ||
| CVE-2019-20087 | Hig | 0.57 | 8.8 | 0.01 | Dec 30, 2019 | GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the "matching tags" feature. | ||
| CVE-2019-20086 | Hig | 0.57 | 8.8 | 0.01 | Dec 30, 2019 | GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c. | ||
| CVE-2019-20011 | Hig | 0.57 | 8.8 | 0.01 | Dec 27, 2019 | An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decode_R13_R2000 in decode.c. | ||
| CVE-2019-8657 | Hig | 0.57 | 8.8 | 0.02 | Dec 18, 2019 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution. | ||
| CVE-2019-8603 | Hig | 0.57 | 8.8 | 0.01 | Dec 18, 2019 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Mojave 10.14.5. An application may be able to read restricted memory. | ||
| CVE-2019-8585 | Hig | 0.57 | 8.8 | 0.02 | Dec 18, 2019 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. Processing a maliciously crafted movie file may lead to arbitrary code execution. | ||
| CVE-2019-19778 | Hig | 0.57 | 8.8 | 0.01 | Dec 13, 2019 | An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c. | ||
| CVE-2019-19777 | Hig | 0.57 | 8.8 | 0.01 | Dec 13, 2019 | stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main. | ||
| CVE-2019-8204 | Hig | 0.57 | 8.8 | 0.03 | Oct 17, 2019 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information… | ||
| CVE-2019-17266 | Cri | 0.57 | 9.8 | 0.03 | Oct 6, 2019 | libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy. | ||
| CVE-2019-17040 | Cri | 0.57 | 9.8 | 0.02 | Sep 30, 2019 | contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. | ||
| CVE-2015-9381 | Hig | 0.57 | 8.8 | 0.02 | Sep 3, 2019 | FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. |
- risk 0.57cvss 8.8epss 0.03
By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox…
- risk 0.57cvss 8.8epss 0.02
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
- risk 0.57cvss 8.8epss 0.01
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
- risk 0.57cvss 8.8epss 0.02
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c.
- risk 0.57cvss 8.8epss 0.01
ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c.
- risk 0.57cvss 8.8epss 0.01
GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the "matching tags" feature.
- risk 0.57cvss 8.8epss 0.01
GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decode_R13_R2000 in decode.c.
- risk 0.57cvss 8.8epss 0.02
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution.
- risk 0.57cvss 8.8epss 0.01
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Mojave 10.14.5. An application may be able to read restricted memory.
- risk 0.57cvss 8.8epss 0.02
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. Processing a maliciously crafted movie file may lead to arbitrary code execution.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c.
- risk 0.57cvss 8.8epss 0.01
stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.
- risk 0.57cvss 8.8epss 0.03
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information…
- risk 0.57cvss 9.8epss 0.03
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
- risk 0.57cvss 9.8epss 0.02
contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.
- risk 0.57cvss 8.8epss 0.02
FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.