Falhas do tipo CWE-190

1.649 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2019-11048MEDIUMTemporary files are not cleaned after OOM when parsing HTTP request dataEPSS 6.3%CVE-2023-35644HIGHWindows Sysmain Service Elevation of Privilege VulnerabilityEPSS 6.3%CVE-2018-17958HIGHQemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.EPSS 6.2%CVE-2019-3856HIGHAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requEPSS 6.1%CVE-2019-3857HIGHAn integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUESEPSS 6.1%CVE-2023-38142HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 6.0%CVE-2018-16839MEDIUMCurl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.EPSS 5.8%CVE-2023-2136CRITICALInteger overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to poteEPSS 5.7%KEVCVE-2022-37454CRITICALThe Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers toEPSS 5.7%CVE-2023-21823HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 5.6%KEVCVE-2014-4608HIGHMultiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kerEPSS 5.4%CVE-2021-26461—malloc, realloc and memalign implementations are vulnerable to integer wrap-aroundsEPSS 5.0%CVE-2008-4309HIGHInteger overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and EPSS 5.0%CVE-2023-21579HIGHAdobe Acrobat Reader DC Font Parsing Integer Overflow Remote Code Execution VulnerabilityEPSS 4.9%CVE-2022-28614—read beyond bounds via ap_rwrite()EPSS 4.9%CVE-2022-22822CRITICALaddBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 4.8%CVE-2022-25315CRITICALIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.EPSS 4.8%CVE-2021-21309MEDIUMInteger overflow on 32-bit systemsEPSS 4.7%CVE-2022-25314HIGHIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.EPSS 4.7%CVE-2016-8622LOWThe URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would beEPSS 4.7%