| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.
When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.
This issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4. |
| Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network. |
| Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. |
| Integer underflow (wrap or wraparound) in Microsoft QUIC allows an unauthorized attacker to deny service over a network. |
| Integer overflow or wraparound in Windows Overlay Filter allows an unauthorized attacker to elevate privileges locally. |
| Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally. |
| Numeric truncation error in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
| Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally. |
| Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally. |
| Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. |
| NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution. |
| A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. |
| An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB.
This would easily trash the allocated block's allocator metadata footer, and the next block, if any, and most likely cause the BEAM VM to crash. Utilizing this with precision enough to achieve Remote Code Execution would be extremely unfeasible.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to erts from 6.0 before 15.2.7.13, 16.4.0.6, and 17.0.6. Whether OTP before OTP 17.0, corresponding to erts before 6.0, is affected is unknown. |
