CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-415

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-1000072 415 2017-07-17 2017-07-19
7.5
None Remote Low Not required Partial Partial Partial
Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected memory locations
2 CVE-2017-15364 415 DoS 2017-10-15 2017-11-01
4.3
None Remote Medium Not required None None Partial
The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file.
3 CVE-2017-15186 415 DoS 2017-10-24 2017-10-31
4.3
None Remote Medium Not required None None Partial
Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.
4 CVE-2017-14952 415 Exec Code 2017-10-16 2017-11-07
7.5
None Remote Low Not required Partial Partial Partial
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.
5 CVE-2017-12925 415 DoS 2017-08-28 2017-09-01
4.3
None Remote Medium Not required None None Partial
Double free vulnerability in DfFromLB in docfile.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image.
6 CVE-2017-12858 415 2017-08-23 2017-08-26
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.
7 CVE-2017-11462 415 2017-09-13 2017-10-20
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.
8 CVE-2017-11139 415 2017-07-09 2017-07-12
7.5
None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.
9 CVE-2017-10914 415 DoS +Priv +Info 2017-07-04 2017-11-03
6.8
None Remote Medium Not required Partial Partial Partial
The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service (memory consumption), or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2.
10 CVE-2017-9687 415 2017-10-10 2017-10-19
4.6
None Local Low Not required Partial Partial Partial
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, two concurrent threads/processes can write the value of "0" to the debugfs file that controls ipa ipc log which will lead to the double-free in ipc_log_context_destroy(). Another issue is the Use-After-Free which can happen due to the race condition when the ipc log is deallocated via the debugfs call during a log print.
11 CVE-2017-9686 415 2017-10-10 2017-10-19
4.6
None Local Low Not required Partial Partial Partial
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possible double free/use after free in the SPS driver when debugfs logging is used.
12 CVE-2017-9287 415 2017-05-29 2017-11-03
4.0
None Remote Low Single system None None Partial
servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.
13 CVE-2017-9078 415 Exec Code 2017-05-19 2017-11-03
9.3
Admin Remote Medium Not required Complete Complete Complete
The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.
14 CVE-2017-8890 415 DoS 2017-05-10 2017-11-03
10.0
None Remote Low Not required Complete Complete Complete
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
15 CVE-2017-8265 415 2017-08-18 2017-08-22
5.1
None Remote High Not required Partial Partial Partial
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a video driver which can lead to a double free.
16 CVE-2017-7521 415 2017-06-27 2017-11-03
4.3
None Remote Medium Not required None None Partial
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
17 CVE-2017-7393 415 DoS Exec Code 2017-03-31 2017-04-04
6.5
None Remote Low Single system Partial Partial Partial
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.
18 CVE-2017-7373 415 2017-06-13 2017-07-07
9.3
None Remote Medium Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, a double free vulnerability exists in a display driver.
19 CVE-2017-6362 415 DoS 2017-09-07 2017-09-13
5.0
None Remote Low Not required None None Partial
Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
20 CVE-2017-6353 415 DoS 2017-03-01 2017-11-03
4.9
None Local Low Not required None None Complete
net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.
21 CVE-2017-6074 415 DoS 2017-02-18 2017-11-03
7.2
None Local Low Not required Complete Complete Complete
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
22 CVE-2017-5836 415 DoS 2017-03-03 2017-03-06
5.0
None Remote Low Not required None None Partial
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
23 CVE-2017-5506 415 2017-03-24 2017-11-03
6.8
None Remote Medium Not required Partial Partial Partial
Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
24 CVE-2017-5334 415 2017-03-24 2017-03-27
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
25 CVE-2017-2636 415 DoS +Priv 2017-03-07 2017-11-03
7.2
None Local Low Not required Complete Complete Complete
Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.
26 CVE-2017-2425 415 Exec Code 2017-04-01 2017-07-11
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "SecurityFoundation" component. A double free vulnerability allows remote attackers to execute arbitrary code via a crafted certificate.
27 CVE-2016-9806 415 DoS 2016-12-28 2017-07-17
7.2
None Local Low Not required Complete Complete Complete
Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to a free operation associated with a new dump that started earlier than anticipated.
28 CVE-2016-8693 415 DoS Exec Code 2017-02-15 2017-11-03
6.8
None Remote Medium Not required Partial Partial Partial
Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
29 CVE-2016-8360 415 DoS Exec Code 2017-02-13 2017-02-17
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code.
30 CVE-2016-6912 415 2017-01-26 2017-11-03
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
31 CVE-2016-5772 415 DoS Exec Code 2016-08-07 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
32 CVE-2016-5768 415 DoS Exec Code 2016-08-07 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
33 CVE-2016-5384 415 Exec Code 2016-08-12 2017-01-17
4.6
None Local Low Not required Partial Partial Partial
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.
34 CVE-2016-3177 415 2017-01-23 2017-01-24
7.5
None Remote Low Not required Partial Partial Partial
Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.
35 CVE-2016-3132 415 Exec Code 2016-08-07 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
36 CVE-2016-1516 415 Exec Code 2017-04-09 2017-04-14
6.8
None Remote Medium Not required Partial Partial Partial
OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
37 CVE-2016-1515 415 2017-01-06 2017-01-10
5.0
None Remote Low Not required None None Partial
A use-after-free / double-free vulnerability can occur in libebml master branch while parsing Track elements of the MKV container.
38 CVE-2015-9007 415 2017-06-06 2017-06-08
9.3
None Remote Medium Not required Complete Complete Complete
In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist.
39 CVE-2015-8962 415 DoS +Priv Mem. Corr. 2016-11-16 2017-01-17
9.3
None Remote Medium Not required Complete Complete Complete
Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
40 CVE-2015-8894 415 DoS 2017-03-15 2017-03-17
4.3
None Remote Medium Not required None None Partial
Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.
41 CVE-2015-7700 415 2017-08-31 2017-09-05
7.5
None Remote Low Not required Partial Partial Partial
Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via unknown vectors.
42 CVE-2015-5203 415 DoS 2017-08-02 2017-08-08
4.3
None Remote Medium Not required None None Partial
Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
43 CVE-2015-5177 415 DoS 2017-10-22 2017-11-07
5.0
None Remote Low Not required None None Partial
Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.
44 CVE-2015-1239 415 DoS 2017-10-18 2017-11-08
4.3
None Remote Medium Not required None None Partial
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
45 CVE-2015-1207 415 DoS Mem. Corr. 2017-06-06 2017-06-12
4.3
None Remote Medium Not required None None Partial
Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
46 CVE-2014-9807 415 DoS 2017-03-30 2017-04-04
4.3
None Remote Medium Not required None None Partial
The pdb coder in ImageMagick allows remote attackers to cause a denial of service (double free) via unspecified vectors.
47 CVE-2014-4343 415 DoS Exec Code Mem. Corr. 2014-08-14 2017-08-28
7.6
None Remote High Not required Complete Complete Complete
Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.
48 CVE-2014-1767 415 +Priv 2014-07-08 2017-09-09
7.2
None Local Low Not required Complete Complete Complete
Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
49 CVE-2014-1252 415 DoS Exec Code 2014-01-24 2017-08-28
7.5
None Remote Low Not required Partial Partial Partial
Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.
50 CVE-2003-0015 415 DoS Exec Code Bypass 2003-02-07 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands.
Total number of vulnerabilities : 50   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.