CWE-125
Out-of-bounds Read
Description
The product reads data past the end, or before the beginning, of the intended buffer.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-540
CVEs mapped to this weakness (9,337)
page 445 of 467| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-45897 | Med | 0.00 | 5.5 | 0.00 | Oct 28, 2023 | exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set. | ||
| CVE-2023-46407 | Med | 0.00 | 5.5 | 0.00 | Oct 27, 2023 | FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function. | ||
| CVE-2023-46603 | Hig | 0.00 | 8.8 | 0.01 | Oct 23, 2023 | In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICC.a. | ||
| CVE-2023-5520 | Hig | 0.00 | 7.7 | 0.00 | Oct 11, 2023 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. | ||
| CVE-2023-5377 | Hig | 0.00 | 7.1 | 0.00 | Oct 4, 2023 | Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV. | ||
| CVE-2023-42822 | Med | 0.00 | 4.6 | 0.01 | Sep 27, 2023 | xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an… | ||
| CVE-2023-37459 | Med | 0.00 | 5.3 | 0.00 | Sep 15, 2023 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify… | ||
| CVE-2023-37281 | Med | 0.00 | 5.3 | 0.00 | Sep 15, 2023 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header decompression, Contiki-NG confirms the received packet buffer contains enough data as needed for that field. But no… | ||
| CVE-2023-4778 | Med | 0.00 | 5.5 | 0.00 | Sep 5, 2023 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. | ||
| CVE-2023-41910 | Cri | 0.00 | 9.8 | 0.01 | Sep 5, 2023 | An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c. | ||
| CVE-2023-4758 | Med | 0.00 | 5.5 | 0.00 | Sep 4, 2023 | Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV. | ||
| CVE-2023-4721 | Med | 0.00 | 5.5 | 0.00 | Sep 1, 2023 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. | ||
| CVE-2023-39354 | Med | 0.00 | 5.9 | 0.01 | Aug 31, 2023 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes`… | ||
| CVE-2023-41360 | Cri | 0.00 | 9.1 | 0.01 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation. | ||
| CVE-2023-41359 | Cri | 0.00 | 9.1 | 0.01 | Aug 29, 2023 | An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation. | ||
| CVE-2023-3745 | Med | 0.00 | 5.5 | 0.00 | Jul 24, 2023 | A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to… | ||
| CVE-2021-34121 | Hig | 0.00 | 7.8 | 0.00 | Jul 18, 2023 | An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution. | ||
| CVE-2023-38432 | Cri | 0.00 | 9.1 | 0.03 | Jul 18, 2023 | An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read. | ||
| CVE-2023-38431 | Cri | 0.00 | 9.1 | 0.01 | Jul 18, 2023 | An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read. | ||
| CVE-2023-38430 | Cri | 0.00 | 9.1 | 0.01 | Jul 18, 2023 | An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read. |
- risk 0.00cvss 5.5epss 0.00
exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
- risk 0.00cvss 5.5epss 0.00
FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.
- risk 0.00cvss 8.8epss 0.01
In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICC.a.
- risk 0.00cvss 7.7epss 0.00
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
- risk 0.00cvss 7.1epss 0.00
Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV.
- risk 0.00cvss 4.6epss 0.01
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an…
- risk 0.00cvss 5.3epss 0.00
Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify…
- risk 0.00cvss 5.3epss 0.00
Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header decompression, Contiki-NG confirms the received packet buffer contains enough data as needed for that field. But no…
- risk 0.00cvss 5.5epss 0.00
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
- risk 0.00cvss 9.8epss 0.01
An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.
- risk 0.00cvss 5.5epss 0.00
Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV.
- risk 0.00cvss 5.5epss 0.00
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
- risk 0.00cvss 5.9epss 0.01
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes`…
- risk 0.00cvss 9.1epss 0.01
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.
- risk 0.00cvss 9.1epss 0.01
An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation.
- risk 0.00cvss 5.5epss 0.00
A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to…
- risk 0.00cvss 7.8epss 0.00
An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.
- risk 0.00cvss 9.1epss 0.03
An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.
- risk 0.00cvss 9.1epss 0.01
An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.
- risk 0.00cvss 9.1epss 0.01
An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.