CWE-369

{
  "affected": [],
  "aliases": [
    "CVE-2021-27847"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-15T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85.",
  "id": "GHSA-78wm-7588-c232",
  "modified": "2023-09-29T12:30:16Z",
  "published": "2022-05-24T19:08:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27847"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libvips/libvips/issues/1236"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-36911"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-01T22:16:48Z",
    "severity": "MODERATE"
  },
  "details": "A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.",
  "id": "GHSA-78wm-m59p-255g",
  "modified": "2026-07-02T15:32:03Z",
  "published": "2026-07-02T00:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-36911"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Aleksoid1978/MPC-BE/issues/1062"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-55642"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-15T20:16:23Z",
    "severity": "MODERATE"
  },
  "details": "GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).",
  "id": "GHSA-79v6-5w6w-c48m",
  "modified": "2026-06-15T21:30:37Z",
  "published": "2026-06-15T21:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55642"
    },
    {
      "type": "WEB",
      "url": "https://infosec.exchange/@sigdevel/116736787186993437"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/06/13/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-9302"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-29T19:29:00Z",
    "severity": "MODERATE"
  },
  "details": "RealPlayer 16.0.2.32 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp4 file.",
  "id": "GHSA-7cvf-36vw-9mfv",
  "modified": "2022-05-17T02:42:22Z",
  "published": "2022-05-17T02:42:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9302"
    },
    {
      "type": "WEB",
      "url": "http://code610.blogspot.com/2017/05/divided-realplayer-160232.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/98754"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-0857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-16T23:29:00Z",
    "severity": "HIGH"
  },
  "details": "Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65122447.",
  "id": "GHSA-7ggj-c3f3-cjqm",
  "modified": "2022-05-13T01:40:51Z",
  "published": "2022-05-13T01:40:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0857"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2017-11-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.3.3"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "vproxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-30T16:33:41Z",
    "nvd_published_at": "2025-07-30T20:15:37Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state.\n\n### Details\nUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as \u0027configuredUser-ttl-0\u0027), the modulo operation \u0027timestamp % ttl\u0027 will cause a division by zero panic, causing the server to crash causing a denial-of-service.\n\nThe code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183\n\n### PoC\n1. Download and run the latest version of vproxy\n2. Send a cUrl request like the following, adjusting address and port as necessary: ```curl -x \"http://test-ttl-0:test@127.0.0.1:8101\" https://google.com```\n3. Wait for a cUrl error indicating \"Proxy CONNECT aborted\"\n4. View logs from the vproxy server\n5. Observe that the vproxy server crashed due to a divide-by-zero panic\n\n### Impact\nThe resulting crash renders the proxy server unusable until it is reset.\n\nFinally, one last note: I\u0027m reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon ([dbohannon](https://github.com/dbohannon))",
  "id": "GHSA-7h24-c332-p48c",
  "modified": "2025-07-31T11:18:29Z",
  "published": "2025-07-30T16:33:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0x676e67/vproxy/security/advisories/GHSA-7h24-c332-p48c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54581"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0x676e67/vproxy/commit/aa1bf64c5e7f1c471395f9f29175ffc1b16a1079"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0x676e67/vproxy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0x676e67/vproxy/releases/tag/v2.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vproxy Divide by Zero DoS Vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-18360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-31T09:29:00Z",
    "severity": "MODERATE"
  },
  "details": "In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.",
  "id": "GHSA-7hhv-rch7-rfmj",
  "modified": "2022-05-14T01:09:46Z",
  "published": "2022-05-14T01:09:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18360"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torvalds/linux/commit/6aeb75e6adfaed16e58780309613a578fe1ee90b"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1123706"
    },
    {
      "type": "WEB",
      "url": "https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.3"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3933-1"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3933-2"
    },
    {
      "type": "WEB",
      "url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6aeb75e6adfaed16e58780309613a578fe1ee90b"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106802"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-46772"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T08:15:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check denominator crb_pipes before used\n\n[WHAT \u0026 HOW]\nA denominator cannot be 0, and is checked before used.\n\nThis fixes 2 DIVIDE_BY_ZERO issues reported by Coverity.",
  "id": "GHSA-7hr2-9rf8-gx6q",
  "modified": "2025-11-03T21:31:13Z",
  "published": "2024-09-18T09:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46772"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/04805efe8623f8721f3c01182ea73d68e88c62d8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9264aa24f628eba5779d1c916441e0cedde9b3d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ea79068d4073bf303f8203f2625af7d9185a1bc6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ede06d23392529b039cf7ac11b5875b047900f1c"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-46470"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-14T18:16:50Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin\u0027s qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.",
  "id": "GHSA-7jcp-9qq9-8rjq",
  "modified": "2026-05-14T18:32:57Z",
  "published": "2026-05-14T18:32:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46470"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11243.patch"
    },
    {
      "type": "WEB",
      "url": "https://gstreamer.freedesktop.org/security/sa-2026-0018.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-38126"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-369"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-03T09:15:26Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: make sure that ptp_rate is not 0 before configuring timestamping\n\nThe stmmac platform drivers that do not open-code the clk_ptp_rate value\nafter having retrieved the default one from the device-tree can end up\nwith 0 in clk_ptp_rate (as clk_get_rate can return 0). It will\neventually propagate up to PTP initialization when bringing up the\ninterface, leading to a divide by 0:\n\n Division by zero in kernel.\n CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22\n Hardware name: STM32 (Device Tree Support)\n Call trace:\n  unwind_backtrace from show_stack+0x18/0x1c\n  show_stack from dump_stack_lvl+0x6c/0x8c\n  dump_stack_lvl from Ldiv0_64+0x8/0x18\n  Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4\n  stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c\n  stmmac_hw_setup from __stmmac_open+0x18c/0x434\n  __stmmac_open from stmmac_open+0x3c/0xbc\n  stmmac_open from __dev_open+0xf4/0x1ac\n  __dev_open from __dev_change_flags+0x1cc/0x224\n  __dev_change_flags from dev_change_flags+0x24/0x60\n  dev_change_flags from ip_auto_config+0x2e8/0x11a0\n  ip_auto_config from do_one_initcall+0x84/0x33c\n  do_one_initcall from kernel_init_freeable+0x1b8/0x214\n  kernel_init_freeable from kernel_init+0x24/0x140\n  kernel_init from ret_from_fork+0x14/0x28\n Exception stack(0xe0815fb0 to 0xe0815ff8)\n\nPrevent this division by 0 by adding an explicit check and error log\nabout the actual issue. While at it, remove the same check from\nstmmac_ptp_register, which then becomes duplicate",
  "id": "GHSA-7jmr-6pr9-g7cc",
  "modified": "2025-12-17T18:31:32Z",
  "published": "2025-07-03T09:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38126"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/030ce919e114a111e83b7976ecb3597cefd33f26"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32af9c289234990752281c805500dfe03c5b2b8f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/379cd990dfe752b38fcf46034698a9a150626c7a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b263088ee8ab14563817a8be3519af8e25225793"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bb033c6781ce1b0264c3993b767b4aa9021959c2"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}