Falhas do tipo CWE-125

5.905 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2022-34226HIGHAdobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 5.0%CVE-2019-13331HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interactionEPSS 5.0%CVE-2020-24409HIGHAdobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityEPSS 4.9%CVE-2020-24410HIGHAdobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityEPSS 4.9%CVE-2020-10901LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.9%CVE-2018-17895—LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution.EPSS 4.8%CVE-2016-8621MEDIUMThe `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit shorEPSS 4.8%CVE-2020-10905LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.8%CVE-2020-10903LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.8%CVE-2018-14881CRITICALThe BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).EPSS 4.8%CVE-2020-10894LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. UserEPSS 4.7%CVE-2019-5747HIGHAn issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or reEPSS 4.7%CVE-2019-6728—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction iEPSS 4.6%CVE-2017-13050CRITICALThe RPKI-Router parser in tcpdump before 4.9.2 has a buffer over-read in print-rpki-rtr.c:rpki_rtr_pdu_print().EPSS 4.6%CVE-2017-9049HIGHlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulEPSS 4.6%CVE-2017-13040CRITICALThe MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.EPSS 4.6%CVE-2017-13041CRITICALThe ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().EPSS 4.6%CVE-2020-9750HIGHOut-of-bounds read vulnerability in Adobe Animate 20.5EPSS 4.5%CVE-2017-13019CRITICALThe PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().EPSS 4.5%CVE-2017-13038CRITICALThe PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().EPSS 4.5%