CVE Vulnerability Database

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or …

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads …

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

Out-of-bounds Read from Unvalidated MSRP Attribute List Length

NULL Pointer Dereference When Evicting the Sole MSRP Attribute

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious …

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram …

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option …