Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

CVEs (781)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-6619 1Nothings 1Stb Truetype.h Jun 17, 2026 Jan 8, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
CVE-2020-6617 1Nothings 1Stb Truetype.h Jun 17, 2026 Jan 8, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
CVE-2019-20056 1Nothings 1Stb Image.h Jun 17, 2026 Dec 29, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
CVE-2011-3596 2Debian Polipo Project 2Debian Linux Polipo Nov 21, 2024 Nov 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.
CVE-2012-5521 3Debian QuaggaRedhat 3Debian Linux Enterprise LinuxQuagga Nov 21, 2024 Nov 25, 2019 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal
CVE-2019-18844 1Linux 1Acrn Jun 17, 2026 Nov 13, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Device Model in ACRN before 2019w25.5-140000p relies on assert calls in devicemodel/hw/pci/core.c and devicemodel/include/pci_core.h (instead of other mechanisms for propagating error information or diagnostic inform...Show more The Device Model in ACRN before 2019w25.5-140000p relies on assert calls in devicemodel/hw/pci/core.c and devicemodel/include/pci_core.h (instead of other mechanisms for propagating error information or diagnostic information), which might allow attackers to cause a denial of service (assertion failure) within pci core. This is fixed in 1.2. 6199e653418e is a mitigation for pre-1.1 versions, whereas 2b3dedfb9ba1 is a mitigation for 1.1.Show less
CVE-2018-5742 1Isc 1Bind Jun 17, 2026 Oct 30, 2019 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affec...Show more While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also be affected.Show less
CVE-2018-5735 1Debian 1Debian Linux Jun 17, 2026 Oct 30, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC r...Show more The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar backports for the fix for 2017-3137 may also be affected.Show less
CVE-2019-6476 1Isc 1Bind Jun 17, 2026 Oct 17, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, an...Show more A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.Show less
CVE-2019-6473 1Ics 1Kea Jun 17, 2026 Oct 16, 2019 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
CVE-2019-6472 1Isc 1Kea Jun 17, 2026 Oct 16, 2019 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
CVE-2019-6471 2F5 Isc 17Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+14 more Jun 17, 2026 Oct 9, 2019 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.1...Show more A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.Show less
CVE-2019-6469 1Isc 1Bind Jun 17, 2026 Oct 9, 2019 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has malformed RRSIGs. Versions affected: BIND 9.10.5-S1 -> 9.11.6-...Show more An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has malformed RRSIGs. Versions affected: BIND 9.10.5-S1 -> 9.11.6-S1 of BIND 9 Supported Preview Edition.Show less
CVE-2019-6468 1Isc 1Bind Jun 17, 2026 Oct 9, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In BIND Supported Preview Edition, an error in the nxdomain-redirect feature can occur in versions which support EDNS Client Subnet (ECS) features. In those versions which have ECS support, enabling nxdomain-redirect is...Show more In BIND Supported Preview Edition, an error in the nxdomain-redirect feature can occur in versions which support EDNS Client Subnet (ECS) features. In those versions which have ECS support, enabling nxdomain-redirect is likely to lead to BIND exiting due to assertion failure. Versions affected: BIND Supported Preview Edition version 9.10.5-S1 -> 9.11.5-S5. ONLY BIND Supported Preview Edition releases are affected.Show less
CVE-2019-6467 1Isc 1Bind Jun 17, 2026 Oct 9, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenar...Show more A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.Show less
CVE-2019-9455 2Google Opensuse 2Android Leap Jun 17, 2026 Sep 6, 2019 N/A· v4 2.3 LOW· v3 2.1 LOW· v2 In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed...Show more In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Show less
CVE-2019-15892 3Debian Varnish SoftwareVarnish Cache Project 3Debian Linux Varnish CacheVarnish Cache Jun 17, 2026 Sep 3, 2019 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cau...Show more An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.Show less
CVE-2019-15758 1Webassembly 1Binaryen Jun 17, 2026 Aug 29, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrate...Show more An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.Show less
CVE-2019-10055 1Suricata Ids 1Suricata Jun 17, 2026 Aug 28, 2019 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a crash within the ftp/mod.rs file.
CVE-2019-13223 2Debian Stb Vorbis Project 2Debian Linux Stb Vorbis Jun 17, 2026 Aug 15, 2019 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.

Previous 1...333435...40 Next