Fallos del tipo CWE-787

5139 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-28841HIGHAdobe Bridge Font Out-of-bounds Write Remote Code Execution VulnerabilityEPSS 2.4%CVE-2022-28840HIGHAdobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.4%CVE-2022-24097HIGHAdobe After Effects Out-of-bounds Write could lead to Arbitrary code executionEPSS 2.4%CVE-2022-30114HIGHA heap-based buffer overflow in a network service in Fastweb FASTGate MediaAccess FGA2130FWB, firmware version 18.3.n.0482_FW_230_FGA2130, aEPSS 2.4%CVE-2022-23282HIGHPaint 3D Remote Code Execution VulnerabilityEPSS 2.4%CVE-2024-20726HIGH[TianfuCup] JP2K Image Parsing Out-Of-Bounds WriteEPSS 2.4%CVE-2019-19378HIGHIn the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/EPSS 2.4%CVE-2023-20109MEDIUMA vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an EPSS 2.3%KEVCVE-2021-35994HIGHAdobe After Effects JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2021-21053HIGHAdobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code ExecutionEPSS 2.3%CVE-2022-30664HIGHAdobe Animate SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2021-28596HIGHAdobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-23186HIGHAdobe Illustrator Out-of-bounds Write could lead to Arbitrary code executionEPSS 2.3%CVE-2021-36072HIGHAdobe Bridge SGI File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-24105HIGHAdobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-28275HIGHAdobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-28278HIGHAdobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-28844HIGHAdobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-28276HIGHAdobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%CVE-2022-28845HIGHAdobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.3%