Weaknesses of type CWE-190

1,956 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2019-5085CRITICALAn exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.1EPSS 3.4%CVE-2017-20005CRITICALNGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 thatEPSS 3.3%CVE-2023-24871HIGHWindows Bluetooth Service Remote Code Execution VulnerabilityEPSS 3.2%CVE-2013-2596HIGHInteger overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of AEPSS 3.2%KEVCVE-2022-22827HIGHstoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 3.2%CVE-2022-22826HIGHnextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 3.2%CVE-2020-11904—The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.EPSS 3.2%CVE-2018-1084HIGHcorosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.EPSS 3.1%CVE-2022-41318HIGHA buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB auEPSS 3.1%CVE-2023-35383HIGHMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 3.0%CVE-2022-22825HIGHlookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 3.0%CVE-2023-0754CRITICAL The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely EPSS 2.9%CVE-2014-9192—Trihedral Engineering Limited VTScada Integer OverflowEPSS 2.9%CVE-2021-21036HIGHAcrobat Reader DC Integer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 2.9%CVE-2020-10070CRITICALMQTT buffer overflow on receive bufferEPSS 2.9%CVE-2018-10911MEDIUMA flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaEPSS 2.9%CVE-2017-5130HIGHAn integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remEPSS 2.7%CVE-2021-32762HIGHInteger overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platformsEPSS 2.6%CVE-2023-41056HIGHRedis vulnerable to integer overflow in certain payloadsEPSS 2.6%CVE-2019-5093HIGHAn exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.EPSS 2.5%