Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

CVEs (14,557)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2013-4312 2Linux Oracle 2Linux Linux Kernel May 6, 2026 Feb 8, 2016 N/A· v4 6.2 MEDIUM· v3 4.9 MEDIUM· v2 The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af...Show more The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.Show less
CVE-2016-0804 1Google 1Android May 6, 2026 Feb 7, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrm...Show more The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434.Show less
CVE-2016-0803 1Google 1Android May 6, 2026 Feb 7, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft...Show more libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.Show less
CVE-2016-2213 1Ffmpeg 1Ffmpeg May 6, 2026 Feb 3, 2016 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.
CVE-2016-1727 2Apple Webkitgtk 5Iphone Os SafariTvos+2 more May 6, 2026 Feb 1, 2016 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a differen...Show more WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1724.Show less
CVE-2016-1726 1Apple 3Iphone Os SafariWatchos May 6, 2026 Feb 1, 2016 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than...Show more WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1723 and CVE-2016-1725.Show less
CVE-2016-1725 1Apple 3Iphone Os SafariWatchos May 6, 2026 Feb 1, 2016 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than...Show more WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1723 and CVE-2016-1726.Show less
CVE-2016-1724 2Apple Webkitgtk 5Iphone Os SafariTvos+2 more May 6, 2026 Feb 1, 2016 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a differen...Show more WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1727.Show less
CVE-2016-1723 1Apple 3Iphone Os SafariWatchos May 6, 2026 Feb 1, 2016 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than...Show more WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1725 and CVE-2016-1726.Show less
CVE-2016-1722 1Apple 4Iphone Os Mac Os XTvos+1 more May 6, 2026 Feb 1, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 syslog in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-1721 1Apple 4Iphone Os Mac Os XTvos+1 more May 6, 2026 Feb 1, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The kernel in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-1720 1Apple 4Iphone Os Mac Os XTvos+1 more May 6, 2026 Feb 1, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 IOKit in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-1719 1Apple 4Iphone Os Mac Os XTvos+1 more May 6, 2026 Feb 1, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-1718 1Apple 1Mac Os X May 6, 2026 Feb 1, 2016 N/A· v4 7.3 HIGH· v3 6.9 MEDIUM· v2 The IOAcceleratorFamily2 interface in IOAcceleratorFamily in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-1717 1Apple 4Iphone Os Mac Os XTvos+1 more May 6, 2026 Feb 1, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The Disk Images component in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-1716 1Apple 1Mac Os X May 6, 2026 Feb 1, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 AppleGraphicsPowerManagement in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-1946 2Mozilla Opensuse 3Firefox LeapOpensuse May 6, 2026 Jan 31, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which might allow remote attackers to cause a denial of service (in...Show more The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which might allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.Show less
CVE-2016-1944 2Mozilla Opensuse 3Firefox LeapOpensuse May 6, 2026 Jan 31, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before 44.0, might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unk...Show more The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before 44.0, might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.Show less
CVE-2016-1935 3Mozilla OpensuseOracle 4Firefox LeapLinux+1 more May 6, 2026 Jan 31, 2016 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content.
CVE-2016-1931 2Mozilla Opensuse 3Firefox LeapOpensuse May 6, 2026 Jan 31, 2016 N/A· v4 10.0 CRITICAL· v3 10.0 HIGH· v2 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code v...Show more Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered during brotli data compression, and other vectors.Show less

Previous 1...419420421...728 Next