← Back
CWE-119

14,685 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

JSON object

Loading...

CVEs (14,685)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-6618
1Ffmpeg
1Ffmpeg
Apr 29, 2026
Dec 24, 2013
N/A· v4
N/A· v3
2.6 LOW· v2
The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service (crash) via a crafted MP3 file, possibly...Show more
The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service (crash) via a crafted MP3 file, possibly related to frame size or lack of sufficient "frames to estimate rate."Show less
CVE-2012-6616
1Ffmpeg
1Ffmpeg
Apr 29, 2026
Dec 24, 2013
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The mov_text_decode_frame function in libavcodec/movtextdec.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via crafted 3GPP TS 26.245 data.
CVE-2013-4553
1Xen
1Xen
Apr 29, 2026
Dec 24, 2013
N/A· v4
N/A· v3
5.2 MEDIUM· v2
The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of ser...Show more
The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).Show less
CVE-2013-7049
1Znc
1Znc Msvc
Apr 29, 2026
Dec 23, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote attackers to cause a denial of service (crash) via a long string in a DH1080_INIT...Show more
Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.206 and earlier, allows remote attackers to cause a denial of service (crash) via a long string in a DH1080_INIT message.Show less
CVE-2013-7186
1Steinberg
1Mymp3pro
Apr 29, 2026
Dec 20, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long string in a .m3u file.
CVE-2013-6767
1Quickheal
1Antivirus Pro
Apr 29, 2026
Dec 20, 2013
N/A· v4
N/A· v3
7.2 HIGH· v2
Stack-based buffer overflow in pepoly.dll in Quick Heal AntiVirus Pro 7.0.0.1 allows local users to execute arbitrary code or cause a denial of service (process crash) via a long *.text value in a PE file.
CVE-2013-7114
1Wireshark
1Wireshark
Apr 29, 2026
Dec 19, 2013
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Multiple buffer overflows in the create_ntlmssp_v2_key function in epan/dissectors/packet-ntlmssp.c in the NTLMSSP v2 dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 allow remote attackers to cause a...Show more
Multiple buffer overflows in the create_ntlmssp_v2_key function in epan/dissectors/packet-ntlmssp.c in the NTLMSSP v2 dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 allow remote attackers to cause a denial of service (application crash) via a long domain name in a packet.Show less
CVE-2013-7100
1Digium
3Asterisk
Asterisk DigiumphonesCertified Asterisk
Apr 29, 2026
Dec 19, 2013
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digium...Show more
Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.Show less
CVE-2013-6877
1Realnetworks
1Realplayer
Apr 29, 2026
Dec 19, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allows remote attackers to execute arbitrary code via a long string in the TRACKID element of an R...Show more
Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allows remote attackers to execute arbitrary code via a long string in the TRACKID element of an RMP file, a different vulnerability than CVE-2013-7260.Show less
CVE-2013-6836
1Gnome
1Gnumeric
Apr 29, 2026
Dec 19, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a...Show more
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.Show less
CVE-2013-5415
1Ibm
1Rational Clearcase
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
7.2 HIGH· v2
Buffer overflow in IBM Rational ClearCase through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2 allows local users to gain privileges via unspecified vectors.
CVE-2013-5228
1Apple
5Iphone Os
ItunesSafari+2 more
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a differ...Show more
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.Show less
CVE-2013-5225
1Apple
5Iphone Os
ItunesSafari+2 more
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a differ...Show more
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.Show less
CVE-2013-5199
1Apple
5Iphone Os
ItunesSafari+2 more
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a differ...Show more
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.Show less
CVE-2013-5198
1Apple
5Iphone Os
ItunesSafari+2 more
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a differ...Show more
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.Show less
CVE-2013-5197
1Apple
5Iphone Os
ItunesSafari+2 more
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a differ...Show more
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.Show less
CVE-2013-5196
1Apple
5Iphone Os
ItunesSafari+2 more
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a differ...Show more
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.Show less
CVE-2013-5195
1Apple
3Itunes
SafariWebkit
Apr 29, 2026
Dec 18, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a differ...Show more
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.Show less
CVE-2013-6038
1Trimble
1Sketchup Viewer
Apr 29, 2026
Dec 17, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Stack-based buffer overflow in Trimble SketchUp Viewer 13.0.4124 allows remote attackers to execute arbitrary code via a crafted .SKP file.
CVE-2013-6420
3Apple
OpensusePhp
3Mac Os X
OpensusePhp
Apr 29, 2026
Dec 17, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which a...Show more
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.Show less