CWE-126— Buffer Over-read

Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both…

The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates suppl…

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Ear…

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in s…

Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.

Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array th…

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

Transient DOS when processing target power rate tables during channel configuration.

Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) via a crafted input.

A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives…

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not b…

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) i…

Transient DOS while processing power control requests with invalid antenna or stream values.

Transient DOS while handling command data during power control processing.

Transient DOS while parsing the EPTM test control message to get the test pattern.

Transient DOS while processing a frame with malformed shared-key descriptor.

Transient DOS while handling beacon frames with invalid IE header length.

Transient DOS while processing received beacon frame.

Transient DOS may occur while processing malformed length field in SSID IEs.

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

Transient DOS while processing the EHT operation IE in the received beacon frame.

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 …

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 …

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 …

Transient DOS while parsing per STA profile in ML IE.

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Transient DOS may occur while parsing SSID in action frames.

Transient DOS may occur while parsing extended IE in beacon.

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

Transient DOS while processing the CU information from RNR IE.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while parsing probe response and assoc response frame.

Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0.

Transient DOS while parsing ESP IE from beacon/probe response frame.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.