Threats Tagged 'cwe-124'

Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-109448 is an integer overflow vulnerability in the PostgreSQL psqlODBC driver affecting versions from 08.01.0102 up to but not including 18.00.0005. The flaw arises from a signed 16-bit field used to store the binding count in SQLBindParameter, which can wrap around when binding parameter number 32768 or higher. This causes heap memory corruption, potentially crashing the application or leaving it in a corrupted state. Applications that construct parameter lists from untrusted input are particularly at risk.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.

CVE-2026-16439 is a medium severity buffer underwrite (buffer underflow) vulnerability in Eclipse Foundation's OpenJ9. It affects versions up to 0.60 and occurs when using the -Xtrace option to trace method arguments. This flaw can cause memory corruption due to accessing memory before the allocated buffer.

CVE-2026-26199 is a medium severity buffer underwrite (buffer underflow) vulnerability in the HDFGroup's hdf5 library. It occurs when the function H5Iget_name is called with a size parameter of zero, causing an underflow while attempting to place a null terminator in the buffer. This can lead to memory corruption if important data exists before the name buffer. No affected versions or patches are explicitly stated.

A critical buffer underwrite vulnerability (CWE-124) exists in Apache HTTP Server versions from 2.4.0 through 2.4.67. The flaw is triggered by crafted regular expressions in the server configuration. This vulnerability allows an attacker to potentially execute arbitrary code or cause denial of service. The issue is fixed in Apache HTTP Server version 2.4.68.

Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of Memory Segment (TSEG) memory region, potentially resulting in loss of confidentiality or integrity.

YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer: while ( colon >= ptr && *colon != ':' ) { colon--; } if ( *colon == ':' ) *colon = '\0'; // colon may be ptr-1 here When no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.

A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMRAM potentially resulting in loss of confidentiality or integrity.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2024-36310#cwe-124