Weaknesses of type CWE-190

1,657 results

Estouro ou envolvimento de inteiro

Ocorre quando uma operação aritmética produz um resultado maior (ou menor, em caso de sinal) do que o tipo de dado consegue representar, causando truncamento ou envolvimento para valores inesperados. Um atacante explora isso para contornar validações, causar alocações de memória inválidas ou alterar lógica de negócio.

Example

Um servidor calcula tamanho de buffer como `size = quantidade * 100`. Se quantidade for próxima ao máximo de um inteiro de 32 bits, a multiplicação estoura e retorna um valor pequeno, levando a alocação insuficiente e buffer overflow posterior.

How to mitigate

Valide limites antes de operações aritméticas (verifique se o resultado cabe no tipo), use tipos de dado maiores quando possível, ou aplique bibliotecas de aritmética segura que detectam estouro em tempo de execução.

CVE-2013-2596HIGHInteger overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of AEPSS 3.2%KEVCVE-2021-3520—There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, EPSS 3.2%CVE-2023-45853HIGHMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,EPSS 3.2%CVE-2020-11904—The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.EPSS 3.2%CVE-2018-1084HIGHcorosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.EPSS 3.1%CVE-2018-10911MEDIUMA flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaEPSS 3.1%CVE-2023-35383HIGHMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 3.0%CVE-2014-9192—Trihedral Engineering Limited VTScada Integer OverflowEPSS 2.9%CVE-2023-0754CRITICAL The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely EPSS 2.9%CVE-2020-10070CRITICALMQTT buffer overflow on receive bufferEPSS 2.9%CVE-2022-41318HIGHA buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB auEPSS 2.8%CVE-2022-22826HIGHnextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.8%CVE-2022-22827HIGHstoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.8%CVE-2021-21036HIGHAcrobat Reader DC Integer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 2.8%CVE-2017-5130HIGHAn integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remEPSS 2.7%CVE-2021-32762HIGHInteger overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platformsEPSS 2.7%CVE-2022-22825HIGHlookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.6%CVE-2023-41056HIGHRedis vulnerable to integer overflow in certain payloadsEPSS 2.6%CVE-2019-5093HIGHAn exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.EPSS 2.5%CVE-2023-36910CRITICALMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 2.5%