CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-416

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1010177 416 DoS Exec Code 2019-07-24 2019-08-01
7.5
 None Remote Low Not required Partial Partial Partial
Jsish 2.4.70 2.047 is affected by: Use After Free. The impact is: denial of service and possibly arbitrary code execution. The component is: function Jsi_RegExpNew (jsi/jsiRegexp.c:39). The attack vector is: executing crafted javascript code. The fixed version is: after commit 48a66c798d.
2 CVE-2019-1010170 416 DoS 2019-07-23 2019-07-23
5.0
 None Remote Low Not required None None Partial
Jsish 2.4.77 2.0477 is affected by: Use After Free. The impact is: denial of service. The component is: function Jsi_ObjFree (jsiObj.c:230). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.
3 CVE-2019-1010129 416 DoS Exec Code 2019-07-23 2019-07-25
6.8
 None Remote Medium Not required Partial Partial Partial
VCFTools vcfools prior to version 0.1.15 is affected by: Heap Use-After-Free. The impact is: Denial of Service or possibly unspecified impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The victim must open a specially crafted VCF file.
4 CVE-2019-1010127 416 DoS Exec Code 2019-07-25 2019-07-30
6.8
 None Remote Medium Not required Partial Partial Partial
VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The victim must open a specially crafted VCF file.
5 CVE-2019-16882 416 2019-09-25 2019-09-26
5.0
 None Remote Low Not required Partial None None
An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw.
6 CVE-2019-16881 416 Exec Code 2019-09-25 2019-09-25
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.
7 CVE-2019-16510 416 2019-09-19 2019-09-19
5.0
 None Remote Low Not required None None Partial
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.
8 CVE-2019-16396 416 2019-09-17 2019-09-18
6.8
 None Remote Medium Not required Partial Partial Partial
GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.
9 CVE-2019-16165 416 2019-09-09 2019-09-10
4.3
 None Remote Medium Not required None None Partial
GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.
10 CVE-2019-16140 416 2019-09-09 2019-09-09
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.
11 CVE-2019-16138 416 Exec Code 2019-09-09 2019-09-10
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
12 CVE-2019-15920 416 2019-09-04 2019-09-24
7.2
 None Local Low Not required Complete Complete Complete
An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.
13 CVE-2019-15919 416 2019-09-04 2019-09-24
7.2
 None Local Low Not required Complete Complete Complete
An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
14 CVE-2019-15917 416 2019-09-04 2019-09-24
7.2
 None Local Low Not required Complete Complete Complete
An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.
15 CVE-2019-15890 416 2019-09-06 2019-09-20
5.0
 None Remote Low Not required None None Partial
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
16 CVE-2019-15717 416 2019-08-29 2019-09-14
7.5
 None Remote Low Not required Partial Partial Partial
Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.
17 CVE-2019-15552 416 Exec Code 2019-08-26 2019-09-05
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
18 CVE-2019-15292 416 2019-08-21 2019-09-02
10.0
 None Remote Low Not required Complete Complete Complete
An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.
19 CVE-2019-15239 416 2019-08-20 2019-09-24
7.2
 None Local Low Not required Complete Complete Complete
In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139.
20 CVE-2019-15232 416 2019-08-19 2019-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
21 CVE-2019-15220 416 2019-08-19 2019-09-02
4.9
 None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.
22 CVE-2019-15215 416 2019-08-19 2019-09-02
4.9
 None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.
23 CVE-2019-15214 416 2019-08-19 2019-09-02
4.7
 None Local Medium Not required None None Complete
An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.
24 CVE-2019-15213 416 2019-08-19 2019-09-05
4.9
 None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver.
25 CVE-2019-15211 416 2019-08-19 2019-09-02
4.9
 None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.
26 CVE-2019-15140 416 DoS 2019-08-18 2019-08-28
6.8
 None Remote Medium Not required Partial Partial Partial
coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.
27 CVE-2019-14980 416 DoS 2019-08-12 2019-08-16
4.3
 None Remote Medium Not required None None Partial
In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
28 CVE-2019-14778 416 2019-08-29 2019-09-06
6.8
 None Remote Medium Not required Partial Partial Partial
The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
29 CVE-2019-14777 416 2019-08-29 2019-09-06
6.8
 None Remote Medium Not required Partial Partial Partial
The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
30 CVE-2019-14694 416 DoS 2019-08-28 2019-09-03
4.7
 None Local Medium Not required None None Complete
A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications. This allows an attacker to cause a denial of service (BSOD) when an executable is run inside the container.
31 CVE-2019-14533 416 2019-08-29 2019-09-06
6.8
 None Remote Medium Not required Partial Partial Partial
The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
32 CVE-2019-14437 416 2019-08-29 2019-09-06
6.8
 None Remote Medium Not required Partial Partial Partial
The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.
33 CVE-2019-14294 416 2019-07-27 2019-07-29
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in Xpdf 4.01.01. There is a use-after-free in the function JPXStream::fillReadBuf at JPXStream.cc, due to an out of bounds read.
34 CVE-2019-13514 416 Exec Code 2019-08-15 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger a use-after-free vulnerability, which may allow information disclosure, remote code execution, or crash of the application.
35 CVE-2019-13510 416 Exec Code 2019-08-15 2019-09-09
6.8
 None Remote Medium Not required Partial Partial Partial
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code.
36 CVE-2019-13332 416 Exec Code 2019-10-03 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of templates in XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9149.
37 CVE-2019-13328 416 Exec Code 2019-10-03 2019-10-09
6.8
 User Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8913.
38 CVE-2019-13327 416 Exec Code 2019-10-03 2019-10-09
6.8
 User Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8888.
39 CVE-2019-13320 416 Exec Code 2019-10-04 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8814.
40 CVE-2019-13319 416 Exec Code 2019-10-04 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8669.
41 CVE-2019-13317 416 Exec Code 2019-10-04 2019-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8759.
42 CVE-2019-13316 416 Exec Code 2019-10-04 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8757.
43 CVE-2019-13315 416 Exec Code 2019-10-04 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8656.
44 CVE-2019-13289 416 2019-07-04 2019-07-09
6.8
 None Remote Medium Not required Partial Partial Partial
In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool.
45 CVE-2019-13224 416 DoS Exec Code 2019-07-10 2019-07-17
7.5
 None Remote Low Not required Partial Partial Partial
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
46 CVE-2019-13045 416 2019-06-29 2019-07-03
6.8
 None Remote Medium Not required Partial Partial Partial
Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.
47 CVE-2019-12871 416 Exec Code 2019-06-24 2019-06-27
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to a Use-After-Free and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation, the attacker needs to exchange the original file with the manipulated one on the application programming workstation.
48 CVE-2019-12819 416 DoS 2019-06-13 2019-06-18
2.1
 None Local Low Not required None None Partial
An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service.
49 CVE-2019-12160 416 2019-05-17 2019-05-20
7.5
 None Remote Low Not required Partial Partial Partial
GoHTTP through 2017-07-25 has a sendHeader use-after-free.
50 CVE-2019-12106 416 2019-05-15 2019-05-26
5.0
 None Remote Low Not required None None Partial
The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.
Total number of vulnerabilities : 1256   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.