Weaknesses of type CWE-680

112 results

Overflow de inteiro levando a estouro de buffer

Ocorre quando um cálculo de inteiro ultrapassa o limite máximo do tipo (overflow), resultando num valor menor do que o esperado. Esse valor comprometido é então usado para alocar ou indexar um buffer, permitindo escrita ou leitura além dos limites e causando corrupção de memória ou execução de código arbitrário.

Example

Um código calcula o tamanho de um buffer como 'tamanho_usuario + 100'. Se tamanho_usuario for INT_MAX, a soma sofre overflow e vira um número negativo ou muito pequeno; o buffer é alocado com apenas alguns bytes, mas o programa escreve dados como se tivesse centenas, sobrescrevendo memória adjacente.

How to mitigate

Valide limites de entrada antes de operações aritméticas (verifique se a soma ultrapassaria o máximo permitido), use tipos inteiros sem sinal quando apropriado, e prefira bibliotecas de alocação dinâmica que verificam transbordos. Em linguagens de alto nível, o risco é menor, mas em C/C++ é crítico usar funções como safe_add ou checagens explícitas.

CVE-2021-32762HIGHInteger overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platformsEPSS 2.7%CVE-2021-32765HIGHInteger Overflow to Buffer Overflow in HiredisEPSS 2.1%CVE-2021-21843HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21838HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21837HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21846HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21839HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21845HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21852HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21847HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2021-21844HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 2.0%CVE-2020-10929HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 EPSS 1.9%CVE-2021-21841HIGHAn exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarEPSS 1.7%CVE-2021-21851HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 1.7%CVE-2021-21849HIGHAn exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarEPSS 1.7%CVE-2021-21853HIGHMultiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentEPSS 1.7%CVE-2021-21840HIGHAn exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarEPSS 1.7%CVE-2021-21836HIGHAn exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarEPSS 1.7%CVE-2021-21842HIGHAn exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarEPSS 1.7%CVE-2021-21850HIGHAn exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarEPSS 1.7%