Incorrect Calculation

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

CVEs (139)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-5462 2Debian Mozilla 4Debian Linux FirefoxNetwork Security Services+1 more Nov 25, 2025 Jun 11, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue...Show more A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.Show less
CVE-2017-13288 1Google 1Android Nov 21, 2024 Apr 4, 2018 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 In writeToParcel and readFromParcel of PeriodicAdvertisingReport.java, there is a permission bypass due to a 64/32bit int mismatch. This could lead to a local escalation of privilege where the user can start an activity...Show more In writeToParcel and readFromParcel of PeriodicAdvertisingReport.java, there is a permission bypass due to a 64/32bit int mismatch. This could lead to a local escalation of privilege where the user can start an activity with system privileges, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-69634768.Show less
CVE-2017-13151 1Google 1Android May 13, 2026 Dec 6, 2017 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456.
CVE-2017-0819 1Google 1Android May 13, 2026 Oct 4, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63045918.
CVE-2017-9725 1Google 1Android May 13, 2026 Sep 21, 2017 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail.
CVE-2017-12135 3Citrix DebianXen 3Debian Linux XenXenserver May 13, 2026 Aug 24, 2017 N/A· v4 8.8 HIGH· v3 4.6 MEDIUM· v2 Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transitive grants.
CVE-2017-12134 2Citrix Xen 2Xen Xenserver May 13, 2026 Aug 24, 2017 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of servic...Show more The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation.Show less
CVE-2017-11537 1Imagemagick 1Imagemagick May 13, 2026 Jul 23, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an incorrect bits-per-pixel calculation.
CVE-2017-0679 1Google 1Android May 13, 2026 Jul 6, 2017 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36996978.
CVE-2017-0666 1Google 1Android May 13, 2026 Jul 6, 2017 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 A elevation of privilege vulnerability in the Android framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37285689.
CVE-2017-8932 4Fedoraproject GolangNovell+1 more 4Fedora GoLeap+1 more May 13, 2026 Jul 6, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive att...Show more A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.Show less
CVE-2017-8905 1Xen 1Xen May 13, 2026 May 11, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
CVE-2017-0342 1Nvidia 1Gpu Driver May 13, 2026 May 9, 2017 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where incorrect calculation may cause an invalid address access leading to denial of service o...Show more All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where incorrect calculation may cause an invalid address access leading to denial of service or potential escalation of privileges.Show less
CVE-2017-8326 1Entropymine 1Imageworsener May 13, 2026 Apr 29, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial of service (application crash) or possib...Show more libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image, related to imagew-bmp.c and imagew-util.c.Show less
CVE-2017-0545 1Google 1Android May 13, 2026 Apr 7, 2017 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used...Show more An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32591350.Show less
CVE-2016-9377 1Xen 1Xen May 13, 2026 Feb 22, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT...Show more Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.Show less
CVE-2016-7433 1Ntp 1Ntp May 13, 2026 Jan 13, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion."
CVE-2011-3062 2Google Mozilla 5Chrome FirefoxSeamonkey+2 more Apr 29, 2026 Mar 30, 2012 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.
CVE-2011-1573 1Linux 1Linux Kernel Apr 29, 2026 Feb 2, 2012 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunk...Show more net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunks, which allows remote attackers to cause a denial of service (OOPS) via crafted packet data.Show less

Previous 1 2 3 4 5 67