The internet is broken right now.

Double free in Windows Error Reporting allows an authorized attacker to execute code locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 23h2

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 23h2

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 23h2

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 23h2

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 23h2

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.

Memory safety Network gear

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

Memory safety

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

Memory safety

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

Memory safety Web app

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.

Memory safety Network gear

A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device.

Memory safety Network gear

NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.

Memory safety Network gear

Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto connection handler. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29016.

Memory safety Device

Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth OBEX packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29012.

Memory safety Device

Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29007.

Memory safety Device

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

Memory safety Library

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

Memory safety Library

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607