Fallos del tipo CWE-680

105 resultados

Transbordamento de inteiro causando transbordamento de buffer

Ocorre quando um cálculo de inteiro transborda (excede o limite do tipo), gerando um valor pequeno ou negativo que é depois usado como tamanho de alocação ou índice de buffer. O código acredita ter espaço suficiente, mas na verdade alocou pouco ou até nada, permitindo escrita fora dos limites da memória.

Ejemplo

Uma função recebe dois inteiros de 32 bits (tamanho + overhead) que, quando somados, causam overflow e resultam em um valor pequeno. A alocação malloc(tamanho + overhead) aloca poucos bytes, mas o código copia dados grandes para esse buffer, sobrescrevendo memória adjacente.

Cómo mitigar

Valide os operandos antes de operações aritméticas que alimentam alocações de memória; use tipos inteiros maiores (64-bit) quando apropriado; aplique testes de saturação (verificar se a soma/multiplicação ultrapassaria o máximo permitido) antes de usar o resultado em malloc, memcpy ou indexação de arrays.

CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.4%CVE-2021-32761HIGHInteger overflow issues with *BIT commands on 32-bit systemsEPSS 31.0%CVE-2020-6116HIGHAn arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawinEPSS 28.4%CVE-2021-40417CRITICALWhen parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that weEPSS 15.7%CVE-2021-32628HIGHVulnerability in handling large ziplistsEPSS 13.5%CVE-2021-30354—Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in funcEPSS 8.4%CVE-2018-8787—FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_DecompressEPSS 8.4%CVE-2018-8786—FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_EPSS 8.2%CVE-2018-8795—rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmEPSS 7.4%CVE-2018-8794—rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updEPSS 6.7%CVE-2020-13576CRITICALA code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request cEPSS 5.9%CVE-2021-21783CRITICALA code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request cEPSS 5.0%CVE-2021-32625HIGHRedis vulnerability in STRALGO LCS on 32-bit systemsEPSS 4.2%CVE-2021-32687HIGHInteger overflow issue with intsets in RedisEPSS 4.1%CVE-2025-32023HIGHRedis allows out of bounds writes in hyperloglog commands leading to RCEEPSS 4.0%CVE-2021-32627HIGHInteger overflow issue with Streams in RedisEPSS 4.0%CVE-2021-41099HIGHInteger overflow issue with strings in RedisEPSS 3.7%CVE-2019-5087HIGHAn exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.EPSS 3.6%CVE-2019-5086HIGHAn exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, vEPSS 3.2%CVE-2021-32762HIGHInteger overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platformsEPSS 2.7%