CVSS: 9.8EPSS: 3%CPEs: 30EXPL: 1CVE-2016-4538 – php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition
https://notcve.org/view.php?id=CVE-2016-4538
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call. La función bcpowmod en ext/bcmath/bcmath.c en PHP en versiones anteriores a 5.5.35, 5.6.x en versiones anteriores a 5.6.21 y 7.x en versiones anteriores a 7.0.6 modifica ciertas estructuras de datos sin considerar si son copias de la variable global _zero_, _one_, o _two_, lo que permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto no especificado a través de una llamada manipulada. • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183736.html http://lists.opensuse.org/opensuse-updates/2016-05/msg00086.html http://lists.opensuse.org/opensuse-updates/2016-06/msg00027.html http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://rhn.redhat.com/errata/RHSA-2016-2750.html http://www.debian.org/security/2016/dsa-3602 http://www.openwall.com/lists/oss-security/2016/05/05/21 http://www.securityfocus.com/bid/90173 https:/ • CWE-20: Improper Input Validation CWE-122: Heap-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-4348
https://notcve.org/view.php?id=CVE-2016-4348
The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document. La función _rsvg_css_normalize_font_size en librsvg 2.40.2 permite a atacantes dependientes del contexto provocar una denegación del servicio (consumo de pila y caída de aplicación) a través de definiciones circulares en un documento SVG. • http://lists.opensuse.org/opensuse-updates/2016-05/msg00079.html http://www.debian.org/security/2016/dsa-3584 http://www.openwall.com/lists/oss-security/2016/04/28/4 http://www.openwall.com/lists/oss-security/2016/04/28/7 http://www.openwall.com/lists/oss-security/2016/04/30/3 http://www.openwall.com/lists/oss-security/2016/05/10/15 https://git.gnome.org/browse/librsvg/commit/?id=d1c9191949747f6dcfd207831d15dd4ba00e31f2 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 26EXPL: 0CVE-2016-0718 – expat: Out-of-bounds heap read on crafted input causing crash
https://notcve.org/view.php?id=CVE-2016-0718
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Expat permite a atacantes dependientes del contexto provocar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de un documento de entrada mal formado, lo que desencadena un desbordamiento de buffer. An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application. • http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2016-08 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2016-4574
https://notcve.org/view.php?id=CVE-2016-4574
Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356. El error off-by-one en la función append_utf8_value en el decodificador DN (dn.c) en Libksba en versiones anteriores a 1.3.4 permite a atacantes remotos provocar una caída de servicio (lectura fuera de rango) a través de una codificación de la información utf-8. NOTA: esta vulnerabilidad existe debido a una reparación incompleta de CVE-2016-4356. • http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=6be61daac047d8e6aa941eb103f8e71a1d4e3c75 http://lists.opensuse.org/opensuse-updates/2016-05/msg00087.html http://lists.opensuse.org/opensuse-updates/2016-06/msg00028.html http://www.openwall.com/lists/oss-security/2016/05/10/3 http://www.openwall.com/lists/oss-security/2016/05/10/4 http://www.ubuntu.com/usn/USN-2982-1 • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2016-4579
https://notcve.org/view.php?id=CVE-2016-4579
Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl." Libksba en versiones anteriores a 1.3.4 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de rango y caída) a través de vectores no especificados, relacionado "longitud devuelta del objeto de _ksba_ber_parse_tl". • http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=a7eed17a0b2a1c09ef986f3b4b323cd31cea2b64 http://lists.opensuse.org/opensuse-updates/2016-06/msg00028.html http://www.openwall.com/lists/oss-security/2016/05/10/8 http://www.openwall.com/lists/oss-security/2016/05/11/10 http://www.ubuntu.com/usn/USN-2982-1 https://security.gentoo.org/glsa/201706-22 • CWE-20: Improper Input Validation •