Falhas do tipo CWE-190

1.657 resultados

Estouro ou Envolvimento de Inteiro

Ocorre quando uma operação aritmética produz um valor que excede o limite máximo (ou mínimo) que o tipo de dado inteiro pode armazenar, causando o valor envolver-se para o lado oposto ou comportamento inesperado. Isso permite que atacantes contornem validações, aloquem memória inadequada, ou causem travamentos ao explorar essa descontinuidade.

Exemplo

Um servidor de upload limita arquivos a 2 GB verificando se size < 2147483648 (INT_MAX). Um atacante envia size=2147483648, que em inteiro de 32 bits assinado vira -2147483648. A validação passa, mas durante a alocação de buffer o sistema trata como valor negativo ou inesperado, causando falha ou bypass de proteção.

Como mitigar

Use tipos inteiros sem sinal (unsigned) ou de maior capacidade (64 bits) quando apropriado; valide entradas contra limites explícitos *antes* de operações aritméticas; utilize funções de verificação de overflow fornecidas pela linguagem ou biblioteca (ex: __builtin_add_overflow em C, SafeInt em .NET); evite conversões implícitas entre tipos.

CVE-2019-18305—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18304—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2021-20308—Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similaEPSS 2.5%CVE-2019-18301—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18303—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18302—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18298—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18299—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2019-18300—A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 ServEPSS 2.5%CVE-2023-35385CRITICALMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 2.5%CVE-2023-36395HIGHWindows Deployment Services Denial of Service VulnerabilityEPSS 2.5%CVE-2024-28931HIGHMicrosoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.4%CVE-2024-28936HIGHMicrosoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.4%CVE-2022-38725HIGHAn integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service viEPSS 2.4%CVE-2024-28929HIGHMicrosoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.4%CVE-2013-7354MEDIUMMultiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to thEPSS 2.4%CVE-2021-20312—A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefEPSS 2.4%CVE-2024-23531HIGHAn Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker EPSS 2.4%CVE-2018-10893HIGHMultiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server EPSS 2.4%CVE-2024-28942HIGHMicrosoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityEPSS 2.4%