Falhas do tipo CWE-193

109 resultados

Erro de Limite de Fora por Um (Off-by-One)

Um erro de lógica onde um loop, índice de array ou comparação numérica erra por exatamente uma unidade, acessando posição inválida de memória ou pulando uma iteração crítica. Isso causa corrupção de dados, leitura além dos limites ou execução incorreta de lógica sensível.

Exemplo

Um loop que deveria processar 100 elementos (índices 0-99) itera até 100 inclusive, tentando acessar o índice 100 que não existe. Ou um verificador que compara `if (tamanho <= 256)` quando deveria ser `<`, deixando passar um byte além do permitido.

Como mitigar

Use idiomas seguros: iteradores de linguagens modernas (for-each), funções de biblioteca que já tratam limites, e valide explicitamente ranges antes de loops. Em código crítico, teste cases nas bordas (0, 1, tamanho-1, tamanho) e use análise estática que detecta comparações suspeitas.

CVE-2021-3156HIGHSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root EPSS 99.3%KEVCVE-2023-44444HIGHGIMP PSP File Parsing Off-By-One Remote Code Execution VulnerabilityEPSS 56.4%CVE-2021-23017—A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cauEPSS 53.5%CVE-2023-28709—Apache Tomcat: Fix for CVE-2023-24998 is incompleteEPSS 49.9%CVE-2002-1816CRITICALOff-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrarEPSS 9.0%CVE-2006-4574HIGHOff-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a dEPSS 4.2%CVE-2019-8272—UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attaEPSS 3.9%CVE-2019-8268—UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadStrEPSS 3.9%CVE-2020-10062CRITICALPacket length decoding error in MQTTEPSS 2.9%CVE-2020-14510CRITICALOFF-BY-ONE ERROR CWE-193EPSS 2.5%CVE-1999-1568HIGHOff-by-one error in NcFTPd FTP server before 2.4.1 allows a remote attacker to cause a denial of service (crash) via a long PORT command.EPSS 2.3%CVE-2024-36136HIGHAn off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting EPSS 2.2%CVE-2021-46848CRITICALGNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.EPSS 2.1%CVE-2020-14508HIGHOFF-BY-ONE ERROR CWE-193EPSS 2.0%CVE-2021-21938CRITICALA heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted fEPSS 1.8%CVE-2022-47517HIGHAn issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (EPSS 1.5%CVE-2024-10442CRITICALOff-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 aEPSS 1.3%CVE-2019-10131MEDIUMAn off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.cEPSS 1.3%CVE-2020-27793—An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crasEPSS 0.9%CVE-2024-38441CRITICALNetatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in EPSS 0.9%