Falhas do tipo CWE-680

105 resultados

Transbordamento de inteiro levando a transbordamento de buffer

Ocorre quando uma operação aritmética com inteiros ultrapassa os limites do tipo (overflow), resultando em um valor menor do que o esperado. Esse valor reduzido é então usado para alocar memória ou indexar um buffer, permitindo escrita fora dos limites. O atacante explora a discrepância entre o cálculo matemático correto e o resultado inteiro para injetar código ou corromper dados.

Exemplo

Um programa recebe o tamanho de um arquivo e calcula espaço para alocação como `tamanho + sizeof(header)`. Se tamanho é INT_MAX, a soma sofre overflow e retorna um valor pequeno; o buffer alocado fica insuficiente, e dados subsequentes são escritos além de seus limites.

Como mitigar

Valide o tamanho de entrada antes de operações aritméticas (garanta que a soma não ultrapasse o máximo do tipo). Use tipos inteiros sem sinal quando apropriado e considere bibliotecas de aritmética segura. Implemente verificações explícitas: `if (tamanho > INT_MAX - sizeof(header)) reject()` antes de alocar.

CVE-2022-24834HIGHHeap overflow issue with the Lua cjson library used by RedisEPSS 41.4%CVE-2021-32761HIGHInteger overflow issues with *BIT commands on 32-bit systemsEPSS 31.0%CVE-2020-6116HIGHAn arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawinEPSS 28.4%CVE-2021-40417CRITICALWhen parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that weEPSS 15.7%CVE-2021-32628HIGHVulnerability in handling large ziplistsEPSS 13.5%CVE-2021-30354—Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in funcEPSS 8.4%CVE-2018-8787—FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_DecompressEPSS 8.4%CVE-2018-8786—FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_EPSS 8.2%CVE-2018-8795—rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmEPSS 7.4%CVE-2018-8794—rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updEPSS 6.7%CVE-2020-13576CRITICALA code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request cEPSS 5.9%CVE-2021-21783CRITICALA code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request cEPSS 5.0%CVE-2021-32625HIGHRedis vulnerability in STRALGO LCS on 32-bit systemsEPSS 4.2%CVE-2021-32687HIGHInteger overflow issue with intsets in RedisEPSS 4.1%CVE-2025-32023HIGHRedis allows out of bounds writes in hyperloglog commands leading to RCEEPSS 4.0%CVE-2021-32627HIGHInteger overflow issue with Streams in RedisEPSS 4.0%CVE-2021-41099HIGHInteger overflow issue with strings in RedisEPSS 3.7%CVE-2019-5087HIGHAn exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.EPSS 3.6%CVE-2019-5086HIGHAn exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, vEPSS 3.2%CVE-2021-32762HIGHInteger overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platformsEPSS 2.7%