Memory safety CVEs.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Drop everything exploited Memory safety Library PHP

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Drop everything exploited Memory safety Library PHP

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Drop everything exploited Memory safety Library Google Brotli

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

Memory safety

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety Microsoft 365 Apps

Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

Memory safety Server

Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Integer underflow (wrap or wraparound) in Microsoft QUIC allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Memory safety Server GitLab

A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Memory safety Network gear

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1809

Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1809

Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety Microsoft 365 Apps

Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows Server 2022

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

Memory safety Server

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.

Memory safety

Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 21h2

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact:  This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Memory safety Server

Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety Browser & mail Microsoft 365 Apps

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.

Memory safety Server Mariadb

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Memory safety Server

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety Browser & mail Microsoft 365 Apps

Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety Browser & mail Microsoft 365 Apps

Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls  strlen()  on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.

Memory safety Network gear