Weaknesses of type CWE-190

1,956 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2017-17408—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. UserEPSS 6.5%CVE-2022-28615CRITICALRead beyond bounds in ap_strcmp_match()EPSS 6.5%CVE-2018-17958HIGHQemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.EPSS 6.3%CVE-2019-11048MEDIUMTemporary files are not cleaned after OOM when parsing HTTP request dataEPSS 6.3%CVE-2023-35644HIGHWindows Sysmain Service Elevation of Privilege VulnerabilityEPSS 6.3%CVE-2019-3857HIGHAn integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUESEPSS 6.1%CVE-2019-3856HIGHAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requEPSS 6.1%CVE-2023-2136CRITICALInteger overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to poteEPSS 5.8%KEVCVE-2018-16839MEDIUMCurl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.EPSS 5.8%CVE-2023-21823HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 5.6%KEVCVE-2023-38142HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 5.6%CVE-2022-22822CRITICALaddBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 5.5%CVE-2014-4608HIGHMultiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kerEPSS 5.4%CVE-2022-28614—read beyond bounds via ap_rwrite()EPSS 5.1%CVE-2022-23852CRITICALExpat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.EPSS 5.1%CVE-2008-4309HIGHInteger overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and EPSS 5.1%CVE-2021-26461—malloc, realloc and memalign implementations are vulnerable to integer wrap-aroundsEPSS 5.0%CVE-2023-21579HIGHAdobe Acrobat Reader DC Font Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 4.9%CVE-2023-36478HIGHHTTP/2 HPACK integer overflow and buffer allocationEPSS 4.8%CVE-2022-25315CRITICALIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.EPSS 4.8%