Fallos del tipo CWE-190

1664 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um resultado que excede a capacidade máxima (ou mínima) do tipo de dado inteiro, causando um envolvimento (wraparound) silencioso para um valor inesperado. O perigo está em decisões lógicas baseadas nesse valor corrompido — validações de tamanho, cálculos de alocação de memória ou verificações de limites falham silenciosamente.

Ejemplo

Um aplicativo valida que um tamanho de upload é menor que 2GB comparando `size < 2147483648`. Um atacante fornece um valor de 2147483648 bytes em um inteiro de 32 bits com sinal; o valor sofre wraparound para -2147483648, passa na validação, e a alocação subsequente falha ou aloca memória insuficiente, levando a corrupção de heap.

Cómo mitigar

Use verificações explícitas antes de operações: validar se a adição de dois números não vai ultrapassar o limite antes de somar, preferir tipos sem sinal quando o contexto permite valores positivos apenas, ou usar bibliotecas/linguagens com aritmética segura que lançam exceções em overflow (como Python ou linguagens modernas com verificação de bounds).

CVE-2023-45853HIGHMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,EPSS 3.2%CVE-2020-11904—The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.EPSS 3.2%CVE-2018-1084HIGHcorosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.EPSS 3.1%CVE-2018-10911MEDIUMA flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaEPSS 3.1%CVE-2023-35383HIGHMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 3.0%CVE-2014-9192—Trihedral Engineering Limited VTScada Integer OverflowEPSS 2.9%CVE-2023-0754CRITICAL The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely EPSS 2.9%CVE-2020-10070CRITICALMQTT buffer overflow on receive bufferEPSS 2.9%CVE-2022-41318HIGHA buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB auEPSS 2.8%CVE-2022-22827HIGHstoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.8%CVE-2022-22826HIGHnextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.8%CVE-2021-21036HIGHAcrobat Reader DC Integer Overflow Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 2.8%CVE-2017-5130HIGHAn integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remEPSS 2.7%CVE-2021-32762HIGHInteger overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platformsEPSS 2.7%CVE-2022-22825HIGHlookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.6%CVE-2023-41056HIGHRedis vulnerable to integer overflow in certain payloadsEPSS 2.6%CVE-2019-5093HIGHAn exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.EPSS 2.5%CVE-2023-36910CRITICALMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 2.5%CVE-2019-18305—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18304—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%