Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

CVEs (14,089)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-2490 1Microsoft 1Internet Explorer May 6, 2026 Sep 9, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulne...Show more Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.Show less
CVE-2015-2487 1Microsoft 1Internet Explorer May 6, 2026 Sep 9, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulne...Show more Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.Show less
CVE-2015-2486 1Microsoft 2Edge Internet Explorer May 6, 2026 Sep 9, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability,"...Show more Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.Show less
CVE-2015-2485 1Microsoft 2Edge Internet Explorer May 6, 2026 Sep 9, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability,"...Show more Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2491 and CVE-2015-2541.Show less
CVE-2015-3247 2Redhat Spice Project 6Enterprise Linux Enterprise Linux DesktopEnterprise Linux Hpc Node+3 more May 6, 2026 Sep 8, 2015 N/A· v4 N/A· v3 6.9 MEDIUM· v2 Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arb...Show more Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.Show less
CVE-2015-5624 1Freebit 1Elphonebtnv6 Activex Control May 6, 2026 Sep 7, 2015 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Buffer overflow in the ExecCall method in c2lv6.ocx in the FreeBit ELPhoneBtnV6 ActiveX control allows remote attackers to execute arbitrary code via a crafted HTML document, related to the discontinued "Click to Live" s...Show more Buffer overflow in the ExecCall method in c2lv6.ocx in the FreeBit ELPhoneBtnV6 ActiveX control allows remote attackers to execute arbitrary code via a crafted HTML document, related to the discontinued "Click to Live" service.Show less
CVE-2015-6820 2Canonical Ffmpeg 2Ffmpeg Ubuntu Linux May 6, 2026 Sep 6, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers...Show more The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.Show less
CVE-2015-2991 1Nscripter Project 1Nscripter May 6, 2026 Sep 5, 2015 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.
CVE-2015-6274 1Cisco 1Asr 1000 Series Software May 6, 2026 Sep 2, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of service (ESP QFP CPU consumption) by triggering packet fragmentation and reassembly, aka Bug ID CSCuv7...Show more The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of service (ESP QFP CPU consumption) by triggering packet fragmentation and reassembly, aka Bug ID CSCuv71273.Show less
CVE-2015-6587 2Debian Openafs 2Debian Linux Openafs May 6, 2026 Sep 2, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.
CVE-2015-4036 1Linux 1Linux Kernel May 6, 2026 Aug 31, 2015 N/A· v4 N/A· v3 7.2 HIGH· v2 Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other i...Show more Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.Show less
CVE-2015-6750 1Ricoh 1Dl 1 Sr10 May 6, 2026 Aug 31, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
CVE-2015-3214 6Arista DebianLenovo+3 more 19Debian Linux Emc Px12 400r IvxEmc Px12 450r Ivx+16 more May 6, 2026 Aug 31, 2015 N/A· v4 N/A· v3 6.9 MEDIUM· v2 The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host O...Show more The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.Show less
CVE-2015-1333 1Linux 1Linux Kernel May 6, 2026 Aug 31, 2015 N/A· v4 N/A· v3 4.9 MEDIUM· v2 Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to exis...Show more Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.Show less
CVE-2014-9728 1Linux 1Linux Kernel May 6, 2026 Aug 31, 2015 N/A· v4 N/A· v3 4.9 MEDIUM· v2 The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem im...Show more The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.Show less
CVE-2015-1171 1Gsm 1Sim Card Editor May 6, 2026 Aug 28, 2015 N/A· v4 N/A· v3 10.0 HIGH· v2 Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
CVE-2014-9651 1Call Cc 1Chicken May 6, 2026 Aug 28, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index[-ci] procedures."
CVE-2015-5368 1Hp 39Elite X2 1010 G2 Elitebook 1040 G1Elitebook 1040 G2+36 more May 6, 2026 Aug 27, 2015 N/A· v4 N/A· v3 7.8 HIGH· v2 The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows remote attackers to modify data or cause a denial...Show more The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows remote attackers to modify data or cause a denial of service, or execute arbitrary code, via unspecified vectors.Show less
CVE-2015-5409 1Hp 1Version Control Repository Manager May 6, 2026 Aug 26, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
CVE-2015-5949 1Videolan 1Vlc Media Player May 6, 2026 Aug 25, 2015 N/A· v4 N/A· v3 6.8 MEDIUM· v2 VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.

Previous 1...423424425...705 Next