CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 71

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

1. 9.8CVE-2017-9199EPSS 2.2%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19.

2. 9.8CVE-2017-9198EPSS 2.2%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.

3. 9.8CVE-2017-9197EPSS 1.9%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.

4. 9.8CVE-2017-9196EPSS 2.1%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7.

5. 9.8CVE-2017-9187EPSS 1.9%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:486:7.

6. 9.8CVE-2017-9186EPSS 2.2%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:326:17.

7. 9.8CVE-2017-9185EPSS 1.9%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:319:7.

8. 9.8CVE-2017-9184EPSS 1.9%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:314:7.

9. 9.8CVE-2017-9162EPSS 2.2%2017-05-23

   libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:191:2.

10. 9.8CVE-2017-9161EPSS 2.2%2017-05-23

    libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:188:23.

11. 7.8CVE-2016-5735EPSS 1.8%2017-05-23

    Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.

12. 7.5CVE-2015-1529EPSS 0.9%2017-05-23

    Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.

13. 7.8CVE-2016-10239EPSS 0.7%2017-05-16

    In TrustZone access control policy may potentially be bypassed in all Android releases from CAF using the Linux kernel due to improper input validation an integer overflow vulnerability leading to a buffer overflow could potentially occur …

14. 7.8CVE-2015-8998EPSS 0.6%2017-05-16

    In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.

15. 7.8CVE-2015-8995EPSS 0.6%2017-05-16

    In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.

16. 7.8CVE-2014-9935EPSS 0.7%2017-05-16

    In TrustZone an integer overflow vulnerability leading to a buffer overflow could potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.

17. 7.8CVE-2014-9932EPSS 0.6%2017-05-16

    In TrustZone, an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel due to an improper address range computation.

18. 9.8CVE-2017-6889EPSS 1.5%2017-05-15

    An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.

19. 7.0CVE-2017-0611EPSS 1.5%2017-05-12

    An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising …

20. 4.7CVE-2017-0603EPSS 0.5%2017-05-12

    A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Moderate because it requires an uncommon device configurat…

21. 7.8CVE-2017-0597EPSS 0.7%2017-05-12

    An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local acce…

22. 8.8CVE-2017-5051EPSS 0.9%2017-04-25

    An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDem…

23. 8.8CVE-2017-5050EPSS 0.9%2017-04-25

    An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDem…

24. 8.8CVE-2017-5049EPSS 0.9%2017-04-25

    An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDem…

25. 8.8CVE-2017-5048EPSS 0.9%2017-04-25

    An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDem…

26. 8.8CVE-2017-5047EPSS 0.9%2017-04-25

    An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDem…

27. 7.8CVE-2017-5037EPSS 1.0%2017-04-24

    An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDem…

28. 7.5CVE-2017-3599ExploitEPSS 90%2017-04-24

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows unauthenticat…

29. 7.8CVE-2016-6916EPSS 0.4%2017-04-24

    Integer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA 1.5 allows local users to cause a denial of service (system crash) via unspecif…

30. 7.8CVE-2016-2347EPSS 3.2%2017-04-21

    Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.

31. 9.8CVE-2016-5762EPSS 5.7%2017-04-20

    Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long (1) username or (2) password, which triggers a heap-based buffer over…

32. 5.5CVE-2017-7982EPSS 1.5%2017-04-20

    Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.

33. 7.1CVE-2017-7976EPSS 1.1%2017-04-19

    Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file, leading to a denial of service (application crash) or…

34. 7.8CVE-2017-7975EPSS 1.7%2017-04-19

    Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file, leading to a denial of servic…

35. 7.8CVE-2017-7948EPSS 1.6%2017-04-19

    Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript doc…

36. 7.1CVE-2017-7885EPSS 1.2%2017-04-17

    Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2_decode_symbol_dict function in…

37. 7.8CVE-2017-3011EPSS 7.6%2017-04-12

    Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable integer overflow vulnerability in the CCITT fax PDF filter. Successful exploitation could lead to arbitrary code exec…

38. 7.8CVE-2017-7603EPSS 1.5%2017-04-09

    au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.

39. 7.8CVE-2017-7602EPSS 2.7%2017-04-09

    LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

40. 7.0CVE-2017-0576EPSS 1.5%2017-04-07

    An elevation of privilege vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compr…

41. 7.0CVE-2017-0553EPSS 2.3%2017-04-07

    An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privile…

42. 5.9CVE-2016-10319EPSS 1.6%2017-04-06

    In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory because of integer overflows. This affects certain cases involving execution of both AArch64 Generic Trus…

43. 5.9CVE-2016-8795EPSS 1.2%2017-04-02

    Huawei CloudEngine 12800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 5800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 6…

44. 6.5CVE-2016-6177EPSS 0.6%2017-04-02

    The Huawei OceanStor 5800 V300R003C00 has an integer overflow vulnerability. An authenticated attacker may send massive abnormal Network File System (NFS) packets, causing an anomaly in specific disk arrays.

45. 7.8CVE-2017-2440EPSS 1.5%2017-04-02

    An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. It allows attackers …

46. 6.5CVE-2017-7395EPSS 1.4%2017-04-01

    In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server.

47. 7.8CVE-2017-7294EPSS 0.4%2017-03-29

    The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bound…

48. 7.5CVE-2016-9123EPSS 2.1%2017-03-28

    go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.

49. 8.8CVE-2017-5931EPSS 0.5%2017-03-27

    Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto …

50. 5.5CVE-2016-9557EPSS 1.9%2017-03-23

    Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.