CWE-617
Reachable Assertion
Description
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (859)
page 43 of 43| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-31620 | Med | 0.00 | 6.5 | 0.01 | May 25, 2022 | In libjpeg before 1.64, BitStream::Get in bitstream.hpp has an assertion failure that may cause denial of service. This is related to out-of-bounds array access during arithmetically coded lossless scan or arithmetically coded sequential scan. | ||
| CVE-2022-29339 | Hig | 0.00 | 7.5 | 0.01 | May 5, 2022 | In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2. | ||
| CVE-2021-45861 | Med | 0.00 | 5.5 | 0.01 | Mar 2, 2022 | There is an Assertion `num <= INT_BIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277. | ||
| CVE-2021-32815 | Med | 0.00 | 5.5 | 0.01 | Aug 9, 2021 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the… | ||
| CVE-2021-30501 | Med | 0.00 | 5.5 | 0.01 | May 27, 2021 | An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file. | ||
| CVE-2021-24029 | Hig | 0.00 | 7.5 | 0.01 | Mar 15, 2021 | A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to… | ||
| CVE-2019-25007 | Hig | 0.00 | 7.5 | 0.01 | Dec 31, 2020 | An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic. | ||
| CVE-2020-27638 | Hig | 0.00 | 7.5 | 0.02 | Oct 22, 2020 | receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code. | ||
| CVE-2020-13649 | Hig | 0.00 | 7.5 | 0.02 | May 28, 2020 | parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure. | ||
| CVE-2020-13622 | Hig | 0.00 | 7.5 | 0.01 | May 27, 2020 | JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data. | ||
| CVE-2019-15758 | Med | 0.00 | 6.5 | 0.01 | Aug 29, 2019 | An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js. | ||
| CVE-2019-13223 | Med | 0.00 | 5.5 | 0.01 | Aug 15, 2019 | A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file. | ||
| CVE-2019-13113 | Med | 0.00 | 6.5 | 0.02 | Jun 30, 2019 | Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file. | ||
| CVE-2018-20217 | Med | 0.00 | 5.3 | 0.01 | Dec 26, 2018 | A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request. | ||
| CVE-2018-17205 | Hig | 0.00 | 7.5 | 0.03 | Sep 19, 2018 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a… | ||
| CVE-2018-17204 | Med | 0.00 | 4.3 | 0.02 | Sep 19, 2018 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries… | ||
| CVE-2018-13304 | Med | 0.00 | 6.5 | 0.01 | Jul 5, 2018 | In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c,… | ||
| CVE-2018-5269 | Med | 0.00 | 5.5 | 0.01 | Jan 8, 2018 | In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast. | ||
| CVE-2010-3411 | 0.00 | — | 0.01 | Sep 16, 2010 | Google Chrome before 6.0.472.59 on Linux does not properly handle cursors, which might allow attackers to cause a denial of service (assertion failure) via unspecified vectors. |
- risk 0.00cvss 6.5epss 0.01
In libjpeg before 1.64, BitStream::Get in bitstream.hpp has an assertion failure that may cause denial of service. This is related to out-of-bounds array access during arithmetically coded lossless scan or arithmetically coded sequential scan.
- risk 0.00cvss 7.5epss 0.01
In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2.
- risk 0.00cvss 5.5epss 0.01
There is an Assertion `num <= INT_BIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277.
- risk 0.00cvss 5.5epss 0.01
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the…
- risk 0.00cvss 5.5epss 0.01
An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.
- risk 0.00cvss 7.5epss 0.01
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to…
- risk 0.00cvss 7.5epss 0.01
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.
- risk 0.00cvss 7.5epss 0.02
receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.
- risk 0.00cvss 7.5epss 0.02
parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure.
- risk 0.00cvss 7.5epss 0.01
JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
- risk 0.00cvss 6.5epss 0.01
An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.
- risk 0.00cvss 5.5epss 0.01
A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.
- risk 0.00cvss 6.5epss 0.02
Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.
- risk 0.00cvss 5.3epss 0.01
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
- risk 0.00cvss 7.5epss 0.03
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a…
- risk 0.00cvss 4.3epss 0.02
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries…
- risk 0.00cvss 6.5epss 0.01
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c,…
- risk 0.00cvss 5.5epss 0.01
In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
- CVE-2010-3411Sep 16, 2010risk 0.00cvss —epss 0.01
Google Chrome before 6.0.472.59 on Linux does not properly handle cursors, which might allow attackers to cause a denial of service (assertion failure) via unspecified vectors.