CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-119

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1010305 119 Overflow 2019-07-15 2019-08-23
4.3
None Remote Medium Not required Partial None None
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
2 CVE-2019-1010301 119 DoS Overflow 2019-07-15 2019-08-12
4.3
None Remote Medium Not required None None Partial
jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file.
3 CVE-2019-1010300 119 Overflow 2019-07-15 2019-07-22
5.0
None Remote Low Not required None None Partial
mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The attack vector is: Send a specific MMS protocol packet.
4 CVE-2019-1010298 119 Exec Code Overflow 2019-07-15 2019-07-16
10.0
None Remote Low Not required Complete Complete Complete
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
5 CVE-2019-1010297 119 Exec Code Overflow 2019-07-15 2019-07-16
10.0
None Remote Low Not required Complete Complete Complete
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component is: optee_os. The fixed version is: 3.4.0 and later.
6 CVE-2019-1010296 119 Exec Code Overflow 2019-07-15 2019-07-16
10.0
None Remote Low Not required Complete Complete Complete
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
7 CVE-2019-1010295 119 Overflow Mem. Corr. 2019-07-15 2019-07-16
7.5
None Remote Low Not required Partial Partial Partial
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: optee_os. The fixed version is: 3.4.0 and later.
8 CVE-2019-1010292 119 Overflow Mem. Corr. 2019-07-16 2019-07-22
7.5
None Remote Low Not required Partial Partial Partial
Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can access. The component is: optee_os. The fixed version is: v3.4.0.
9 CVE-2019-1010258 119 Overflow Mem. Corr. 2019-05-15 2019-05-16
4.3
None Remote Medium Not required None None Partial
nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file.
10 CVE-2019-1010238 119 Exec Code Overflow 2019-07-19 2019-07-31
7.5
None Remote Low Not required Partial Partial Partial
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
11 CVE-2019-1010232 119 Overflow 2019-07-22 2019-08-01
4.3
None Remote Medium Not required None None Partial
Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by: Buffer Overflow. The impact is: remote dos. The component is: slaxlexer.c:601(funtion:slaxGetInput). The attack vector is: ./slaxproc --slax-to-xslt POC0.
12 CVE-2019-1010228 119 DoS Exec Code Overflow 2019-07-22 2019-09-26
7.5
None Remote Low Not required Partial Partial Partial
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
13 CVE-2019-1010223 119 Overflow 2019-07-22 2019-07-23
7.5
None Remote Low Not required Partial Partial Partial
aubio 0.4.8 and earlier is affected by: Buffer Overflow. The impact is: buffer overflow in strcpy. The component is: tempo. The fixed version is: after commit b1559f4c9ce2b304d8d27ffdc7128b6795ca82e5.
14 CVE-2019-1010218 119 Overflow 2019-07-22 2019-10-09
5.0
None Remote Low Not required None None Partial
Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv[0] to an insane length with execl. The fixed version is: There's no fix yet.
15 CVE-2019-1010208 119 Exec Code Overflow 2019-07-23 2019-08-05
2.1
None Local Low Not required Partial None None
IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffer Overflow. The impact is: Minor information disclosure of kernel stack. The component is: Veracrypt NT Driver (veracrypt.sys). The attack vector is: Locally executed code, IOCTL request to driver. The fixed version is: 1.23-Hotfix-1.
16 CVE-2019-1010180 119 Exec Code Overflow 2019-07-24 2019-08-01
6.8
None Remote Medium Not required Partial Partial Partial
GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.
17 CVE-2019-1010176 119 DoS Exec Code Overflow 2019-07-25 2019-08-05
7.5
None Remote Low Not required Partial Partial Partial
JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function lit_char_to_utf8_bytes (jerry-core/lit/lit-char-helpers.c:377). The attack vector is: executing crafted javascript code. The fixed version is: after commit 505dace719aebb3308a3af223cfaa985159efae0.
18 CVE-2019-1010163 119 DoS Exec Code Overflow 2019-07-24 2019-08-01
7.2
None Local Low Not required Complete Complete Complete
Socusoft Co Photo 2 Video Converter 8.0.0 is affected by: Buffer Overflow - Local shell-code execution and Denial of Service. The impact is: Local privilege escalation (dependant upon conditions), shell code execution and denial-of-service. The component is: pdmlog.dll library. The attack vector is: The attacker must have access to local system (either directly, or remotley).
19 CVE-2019-1010073 119 Overflow 2019-07-18 2019-07-25
6.8
None Remote Medium Not required Partial Partial Partial
BACnet Stack bacserv 0.9.1 and 0.8.5 is affected by: Buffer Overflow. The impact is: exploit was not explored. The component is: bacserv BVLC forwarded NPDU. bvlc_bdt_forward_npdu() calls bvlc_encode_forwarded_npdu() which copies the content from the request into a local in the bvlc_bdt_forward_npdu() stack frame and clobbers the canary. The attack vector is: A BACnet/IP device with BBMD enabled based on this library connected to IP network. The fixed version is: 0.8.6.
20 CVE-2019-1010060 119 Exec Code Overflow 2019-07-16 2019-07-22
7.5
None Remote Low Not required Partial Partial Partial
NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.
21 CVE-2019-1010057 119 DoS Exec Code Overflow 2019-07-16 2019-08-23
6.8
None Remote Medium Not required Partial Partial Partial
nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The component is: nfx.c:546, nffile_inline.c:83, minilzo.c (redistributed). The attack vector is: nfdump must read and process a specially crafted file. The fixed version is: after commit 9f0fe9563366f62a71d34c92229da3432ec5cf0e.
22 CVE-2019-1010044 119 DoS Exec Code Overflow 2019-07-15 2019-07-17
7.5
None Remote Low Not required Partial Partial Partial
borg-reducer c6d5240 is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Output parameter within the executable.
23 CVE-2019-1010043 119 DoS Exec Code Overflow 2019-07-16 2019-07-29
7.5
None Remote Low Not required Partial Partial Partial
Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation.
24 CVE-2019-1010039 119 DoS Exec Code Overflow 2019-07-15 2019-07-16
7.5
None Remote Low Not required Partial Partial Partial
uLaunchELF < commit 170827a is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Loader program (loader.c) overly trusts the arguments provided via command line.
25 CVE-2019-1010038 119 DoS Exec Code Overflow 2019-07-15 2019-07-30
7.5
None Remote Low Not required Partial Partial Partial
OpenModelica OMCompiler is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: OPENMODELICAHOME parameter changeable via environment variable. The attack vector is: Changing an environment variable.
26 CVE-2019-1010022 119 Overflow Bypass 2019-07-15 2019-07-18
7.5
None Remote Low Not required Partial Partial Partial
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.
27 CVE-2019-1010006 119 Exec Code Overflow 2019-07-14 2019-07-16
6.8
None Remote Medium Not required Partial Partial Partial
Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.
28 CVE-2019-17260 119 Overflow 2019-10-08 2019-10-10
4.6
None Local Low Not required Partial Partial Partial
MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc_hc!memcpy+0x000000000000004e.
29 CVE-2019-17075 119 DoS Overflow 2019-10-01 2019-10-08
7.1
None Remote Medium Not required None None Complete
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
30 CVE-2019-16900 119 Overflow 2019-09-25 2019-09-26
5.0
None Remote Low Not required None None Partial
Advantech WebAccess/HMI Designer 2.1.9.31 has a User Mode Write AV starting at MSVCR90!memcpy+0x000000000000015c.
31 CVE-2019-16899 119 Overflow 2019-09-25 2019-09-26
5.0
None Remote Low Not required None None Partial
In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PM_V3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918.
32 CVE-2019-16866 119 Overflow 2019-10-03 2019-10-08
5.0
None Remote Low Not required None None Partial
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
33 CVE-2019-16707 119 Overflow 2019-09-23 2019-09-23
4.3
None Remote Medium Not required None None Partial
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
34 CVE-2019-16352 119 Overflow 2019-09-16 2019-09-16
4.3
None Remote Medium Not required None None Partial
ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.
35 CVE-2019-16347 119 Overflow 2019-09-16 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
ngiflib 0.4 has a heap-based buffer overflow in WritePixels() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
36 CVE-2019-16346 119 Overflow 2019-09-16 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
37 CVE-2019-16277 119 Overflow 2019-09-13 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c.
38 CVE-2019-16247 119 Overflow 2019-09-11 2019-09-13
4.6
None Local Low Not required Partial Partial Partial
Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x000000000000001b.
39 CVE-2019-16227 119 Overflow 2019-09-11 2019-10-12
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
40 CVE-2019-16226 119 Overflow 2019-09-11 2019-10-12
5.0
None Remote Low Not required None None Partial
An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
41 CVE-2019-16225 119 Overflow 2019-09-11 2019-10-12
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_pg[mc->top], leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
42 CVE-2019-16224 119 Overflow 2019-09-11 2019-10-12
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
43 CVE-2019-16137 119 Overflow 2019-09-09 2019-09-10
7.8
None Remote Low Not required None None Complete
An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.
44 CVE-2019-16115 119 DoS Overflow 2019-09-08 2019-09-09
6.8
None Remote Medium Not required Partial Partial Partial
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
45 CVE-2019-16058 119 Overflow 2019-09-06 2019-09-12
5.0
None Remote Low Not required None None Partial
An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature scheme.
46 CVE-2019-15946 119 Overflow 2019-09-05 2019-09-11
7.5
None Remote Low Not required Partial Partial Partial
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
47 CVE-2019-15945 119 Overflow 2019-09-05 2019-09-11
7.5
None Remote Low Not required Partial Partial Partial
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
48 CVE-2019-15942 119 Overflow 2019-09-05 2019-09-06
6.8
None Remote Medium Not required Partial Partial Partial
FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer.
49 CVE-2019-15938 119 Overflow 2019-09-05 2019-09-05
7.5
None Remote Low Not required Partial Partial Partial
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy.
50 CVE-2019-15937 119 Overflow 2019-09-05 2019-09-05
7.5
None Remote Low Not required Partial Partial Partial
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.