Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

153 results · page 3 of 4

Aug 31, 2022FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files.CVE-2022-2866 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files. If a valid user is tricked into using maliciously crafted project files, an attacker could achieve arbitrary code execution.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 14, 2022MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.CVE-2022-27456 · Other software · Mariadb · reported by MITREHigh 7.5
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.
Product
Mariadb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mariadb.org lists.debian.org
Feb 25, 2022The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary codeCVE-2022-25170 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Feb 25, 2022The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow aCVE-2022-23985 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov zerodayinitiative.com
Feb 25, 2022The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow arCVE-2022-21209 · Other software · FATEK Automation · reported by ics-cert@hq.dhs.govHigh 7.8
The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov zerodayinitiative.com
Jan 19, 2022There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC Android Q SDK V1.0, which could cause a media crash (denial of service).CVE-2021-38786 · Other software · Allwinnertech · reported by MITREHigh 7.5
There is a NULL pointer dereference in media/libcedarc/vdecoder of Allwinner R818 SoC Android Q SDK V1.0, which could cause a media crash (denial of service).
Product
Android Q SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vul.wangan.com
Jan 18, 2022NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location CVE-2021-34402 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.7
NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service, Information disclosure, loss of Integrity, or possible escalation of privileges.
Product
SHIELD TV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Aug 11, 2021FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.CVE-2021-32947 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov zerodayinitiative.com
Aug 11, 2021FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a pCVE-2021-32939 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a project file that may permit arbitrary code execution.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov zerodayinitiative.com
Aug 11, 2021An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing project files, allowing CVE-2021-32931 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov zerodayinitiative.com
Jul 22, 2021An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB deCVE-2021-34268 · Other software · ST · reported by MITREMedium 4.6
An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB device packet.
Product
Stm32cube Middleware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2021A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c.CVE-2020-22049 · Other software · Ffmpeg · reported by MITREMedium 6.5
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c.
Product
Ffmpeg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.videolan.org lists.debian.org
Mar 3, 2021Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a special projecCVE-2021-22683 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Mar 3, 2021An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, allowing an attacker tCVE-2021-22670 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Mar 3, 2021Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing an attacker to craft CVE-2021-22666 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Mar 3, 2021A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, allowing an attackerCVE-2021-22662 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Mar 3, 2021Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to craft a special projectCVE-2021-22638 · Other software · Fatek · reported by ics-cert@hq.dhs.govHigh 7.8
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Product
Fvdesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jan 21, 2021Out of bound issue in WLAN driver while processing vdev responses from firmware due to lack of validation of data received from firmware in Snapdragon Auto, SnaCVE-2020-11185 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Out of bound issue in WLAN driver while processing vdev responses from firmware due to lack of validation of data received from firmware in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Product
Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jan 20, 2021NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker can read from or write to a memory locationCVE-2021-1068 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker can read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service or escalation of privileges.
Product
SHIELD TV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Jul 28, 2019In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.CVE-2019-14372 · Other software · Libav · reported by MITREMedium 6.5
In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.
Product
Libav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.libav.org lists.debian.org
Jun 14, 2019Out of bounds read occurs due to improper validation of array while processing VDEV stop response from WLAN firmware in Snapdragon Auto, Snapdragon Consumer IOTCVE-2018-5903 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Out of bounds read occurs due to improper validation of array while processing VDEV stop response from WLAN firmware in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS405, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
Product
Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codeaurora.org codeaurora.org
Jun 3, 2019An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6.CVE-2019-12615 · Computers, phones & browsers · Linux · reported by MITREHigh 7.5
An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com git.kernel.org
Sep 18, 2018In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly inCVE-2018-11299 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly in stats events then WLAN host driver tries to access interface array without proper bound check which can lead to invalid memory access and as a side effect kernel panic or page fault.
Product
Android for MSM, Firefox OS for MSM, QRD Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.codeaurora.org
Sep 13, 2018On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an acceCVE-2018-5548 · Network & remote access · F5 Networks, Inc. · reported by f5sirt@f5.comMedium 6.1
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.
Product
BIG-IP APM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sbudella.altervista.org securityfocus.com
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in wCVE-2017-18065 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in wma_action_frame_filter_mac_event_handler(), which is received from firmware, leads to arbitrary code execution.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_iCVE-2017-18060 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.5
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_id in wma_unified_bcntx_status_event_handler(), which is received from firmware, leads to potential out of bounds memory read.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_scaCVE-2017-18059 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.5
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_scan_event_callback(), which is received from firmware, leads to potential out of bounds memory read.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_nloCVE-2017-18057 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.5
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_nlo_scan_cmp_evt_handler(), which is received from firmware, leads to potential out of bounds memory read.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmi_event->num_vdeCVE-2017-18055 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmi_event->num_vdev_mac_entries in wma_pdev_set_hw_mode_resp_evt_handler(), which is received from firmware, leads to potential buffer overflow.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for num_vdev_mac_entriCVE-2017-18054 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for num_vdev_mac_entries in wma_pdev_hw_mode_transition_evt_handler(), which is received from firmware, leads to potential buffer overflow.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fix_param->vdev_idCVE-2017-18053 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.5
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fix_param->vdev_id in wma_p2p_lo_event_handler(), which is received from firmware, leads to potential out of bounds memory read.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event->vdev_id in CVE-2017-18051 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.5
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event->vdev_id in wma_rcpi_event_handler(), which is received from firmware, leads to potential out of bounds memory read.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_map in wma_tbCVE-2017-18050 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_map in wma_tbttoffset_update_event_handler(), which is received from firmware, leads to potential buffer overwrite and out of bounds memory read.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.codeaurora.org
Mar 15, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_id in wma_uniCVE-2017-18056 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_id in wma_unified_bcntx_status_event_handler() which is received from firmware leads to potential out of bounds memory read.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Feb 23, 2018In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wma_roam_synch_event_handler, vdev_id is received from firmware CVE-2017-15861 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wma_roam_synch_event_handler, vdev_id is received from firmware and used to access an array without validation.
Product
Android for MSM, Firefox OS for MSM, QRD Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jan 12, 2018In libMtkOmxVdec.so there is a possible heap buffer overflow.CVE-2017-13225 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
In libMtkOmxVdec.so there is a possible heap buffer overflow. This could lead to a remote elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38308024. References: M-ALPS03495789.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 6, 2017The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on CVE-2017-16638 · Other software · VDE Project · reported by MITRECritical 9.8
The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on which "chown" is called recursively by the OpenRC service script.
Product
VDE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.gentoo.org security.gentoo.org
Sep 8, 2017A elevation of privilege vulnerability in the MediaTek libmtkomxvdec.CVE-2017-0801 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
A elevation of privilege vulnerability in the MediaTek libmtkomxvdec. Product: Android. Versions: Android kernel. Android ID: A-38447970. References: M-ALPS03337980.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Sep 7, 2017In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption.CVE-2017-14171 · Other software · Ffmpeg · reported by MITREMedium 6.5
In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.
Product
Ffmpeg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record debian.org securityfocus.com
Aug 31, 2017In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption.CVE-2017-14055 · Other software · Ffmpeg · reported by MITREMedium 6.5
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Product
Ffmpeg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record debian.org securityfocus.com
May 18, 2017libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.CVE-2017-9051 · Other software · Libav · reported by MITRECritical 9.8
libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.
Product
Libav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.libav.org
Jul 10, 2016Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x befCVE-2016-3746 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27890802.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com android.googlesource.com
Jul 10, 2016The vid_dec_set_h264_mv_buffers function in drivers/video/msm/vidc/common/dec/vdec.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2CVE-2014-9778 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
The vid_dec_set_h264_mv_buffers function in drivers/video/msm/vidc/common/dec/vdec.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate the number of buffers, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28598515 and Qualcomm internal bug CR563694.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com securityfocus.com
Jul 10, 2016The vid_dec_set_meta_buffers function in drivers/video/msm/vidc/common/dec/vdec.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013CVE-2014-9777 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
The vid_dec_set_meta_buffers function in drivers/video/msm/vidc/common/dec/vdec.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate the number of buffers, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28598501 and Qualcomm internal bug CR563654.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com securityfocus.com
Jun 12, 2016The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffCVE-2016-2482 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27661749.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com android.googlesource.com
Jun 12, 2016The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffCVE-2016-2479 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27532282.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com android.googlesource.com
Jun 12, 2016mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mCVE-2016-2478 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles pointers, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27475409.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com android.googlesource.com
Jun 12, 2016mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mCVE-2016-2477 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles pointers, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27251096.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com android.googlesource.com
Nov 23, 2013libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds writeCVE-2013-0868 · Other software · Ffmpeg · reported by chrome-cve-admin@google.comHigh 9.3
libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."
Product
Ffmpeg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.videolan.org git.videolan.org
Jul 9, 2013The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Format Runtime 11 and WinCVE-2013-3127 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3
The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Format Runtime 11 and Windows Media Player 11 and 12 allows remote attackers to execute arbitrary code via a crafted media file, aka "WMV Video Decoder Remote Code Execution Vulnerability."
Product
Windows Media Format Runtime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov docs.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.