Falhas do tipo CWE-190

1.956 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2017-17408—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. UserEPSS 6.5%CVE-2022-28615CRITICALRead beyond bounds in ap_strcmp_match()EPSS 6.5%CVE-2018-17958HIGHQemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.EPSS 6.3%CVE-2019-11048MEDIUMTemporary files are not cleaned after OOM when parsing HTTP request dataEPSS 6.3%CVE-2023-35644HIGHWindows Sysmain Service Elevation of Privilege VulnerabilityEPSS 6.3%CVE-2019-3857HIGHAn integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUESEPSS 6.1%CVE-2019-3856HIGHAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requEPSS 6.1%CVE-2023-2136CRITICALInteger overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to poteEPSS 5.8%KEVCVE-2018-16839MEDIUMCurl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.EPSS 5.8%CVE-2023-21823HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 5.6%KEVCVE-2023-38142HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 5.6%CVE-2022-22822CRITICALaddBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 5.5%CVE-2014-4608HIGHMultiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kerEPSS 5.4%CVE-2022-28614—read beyond bounds via ap_rwrite()EPSS 5.1%CVE-2022-23852CRITICALExpat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.EPSS 5.1%CVE-2008-4309HIGHInteger overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and EPSS 5.1%CVE-2021-26461—malloc, realloc and memalign implementations are vulnerable to integer wrap-aroundsEPSS 5.0%CVE-2023-21579HIGHAdobe Acrobat Reader DC Font Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 4.9%CVE-2023-36478HIGHHTTP/2 HPACK integer overflow and buffer allocationEPSS 4.8%CVE-2022-25315CRITICALIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.EPSS 4.8%