Vulnerabilities > Use of Uninitialized Resource

DATE CVE VULNERABILITY TITLE RISK
2017-05-19 CVE-2017-9098 Use of Uninitialized Resource vulnerability in multiple products
ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users.
network
low complexity
imagemagick graphicsmagick debian CWE-908
5.0
2016-09-02 CVE-2016-5105 Use of Uninitialized Resource vulnerability in multiple products
The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.
1.9
2016-03-12 CVE-2016-0821 Use of Uninitialized Resource vulnerability in multiple products
The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.
local
low complexity
linux google CWE-908
2.1
2015-12-02 CVE-2015-8390 Use of Uninitialized Resource vulnerability in multiple products
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
pcre fedoraproject php CWE-908
critical
9.8
2015-04-24 CVE-2015-3414 Use of Uninitialized Resource vulnerability in multiple products
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
network
low complexity
sqlite apple debian canonical php CWE-908
7.5
2011-10-12 CVE-2011-1998 Use of Uninitialized Resource vulnerability in Microsoft Internet Explorer 9
Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized, aka "Jscript9.dll Remote Code Execution Vulnerability."
network
microsoft CWE-908
critical
9.3
2011-10-12 CVE-2011-1995 Use of Uninitialized Resource vulnerability in Microsoft Internet Explorer
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized, aka "OLEAuto32.dll Remote Code Execution Vulnerability."
network
microsoft CWE-908
critical
9.3
2011-08-10 CVE-2011-1964 Use of Uninitialized Resource vulnerability in Microsoft Internet Explorer
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Style Object Memory Corruption Vulnerability."
network
microsoft CWE-908
critical
9.3
2011-08-10 CVE-2011-1963 Use of Uninitialized Resource vulnerability in Microsoft Internet Explorer 7/8/9
Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "XSLT Memory Corruption Vulnerability."
network
microsoft CWE-908
critical
9.3
2011-06-16 CVE-2011-1266 Use of Uninitialized Resource vulnerability in Microsoft Internet Explorer 6/7/8
The Vector Markup Language (VML) implementation in vgx.dll in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "VML Memory Corruption Vulnerability."
network
microsoft CWE-908
critical
9.3