VYPR

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

ClassStableLikelihood: High

Description

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-100 · CAPEC-123 · CAPEC-14 · CAPEC-24 · CAPEC-42 · CAPEC-44 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-8 · CAPEC-9

CVEs mapped to this weakness (14,447)

page 466 of 723
  • CVE-2007-4582Aug 29, 2007
    Acti
    Network Video Recorder
    risk 0.04cvss —epss 0.10

    Buffer overflow in the nvUnifiedControl.AUnifiedControl.1 ActiveX control in nvUnifiedControl.dll 1.1.45.0 in ACTi Network Video Recorder (NVR) SP2 2.0 allows remote attackers to execute arbitrary code via a long second argument to the SetText method.

  • CVE-2007-4584Aug 29, 2007
    Bitchx
    Bitchx
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in a MODE command, related to the p_mode variable.

  • CVE-2007-4586Aug 29, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.09

    Multiple buffer overflows in php_iisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iis_getservicestate…

  • CVE-2007-4566Aug 28, 2007
    Alpha Centauri Software
    Sidvault LDAP Server
    risk 0.04cvss —epss 0.15

    Multiple buffer overflows in the login mechanism in sidvault in Alpha Centauri Software SIDVault LDAP Server before 2.0f allow remote attackers to execute arbitrary code via crafted LDAP packets, as demonstrated by a long dc entry in an LDAP bind.

  • CVE-2007-4391Aug 17, 2007
    Yahoo
    Messenger
    risk 0.04cvss —epss 0.09

    Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then…

  • CVE-2007-4034Jul 27, 2007
    Yahoo
    Widgets
    risk 0.04cvss —epss 0.13

    Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the…

  • CVE-2007-4033Jul 27, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.19

    Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll…

  • CVE-2007-4005Jul 26, 2007
    Mike Dubman
    Windows Rsh Daemon
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 allows remote attackers to execute arbitrary code via a long string to the shell port (514/tcp). NOTE: this might overlap CVE-2007-4006.

  • CVE-2007-3832Jul 17, 2007
    Cerulean Studios
    Trillian
    risk 0.04cvss —epss 0.12

    Buffer overflow in the AOL Instant Messenger (AIM) protocol handler in AIM.DLL in Cerulean Studios Trillian allows remote attackers to execute arbitrary code via a malformed aim: URI, as demonstrated by a long URI beginning with the aim:///#1111111/ substring.

  • CVE-2007-3655Jul 10, 2007
    Sun Corporation
    Jre
    risk 0.04cvss —epss 0.12

    Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.

  • CVE-2007-3294Jun 20, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.09

    Multiple buffer overflows in libtidy, as used in the Tidy extension for PHP 5.2.3 and possibly other products, allow context-dependent attackers to execute arbitrary code via (1) a long second argument to the tidy_parse_string function or (2) an unspecified vector to the…

  • CVE-2007-3169Jun 11, 2007
    Edraw
    Office Viewer Component
    risk 0.04cvss —epss 0.12

    Buffer overflow in a certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions before 5.0, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) or execute arbitrary code via a long first argument…

  • CVE-2007-3148Jun 11, 2007
    Yahoo
    Messenger
    risk 0.04cvss —epss 0.12

    Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the receive method.

  • CVE-2007-2981Jun 1, 2007
    LEAD Technologies
    Leadtools Raster Ocr Document Object Library
    risk 0.04cvss —epss 0.06

    Buffer overflow in a certain ActiveX control in LEAD Technologies LEADTOOLS Raster OCR Document Object Library (ltrdc14e.dll) 14.5.0.44 allows remote attackers to execute arbitrary code via a long DictionaryFileName property.

  • CVE-2007-2856May 24, 2007
    Dart
    Powertcp Zip Compression
    risk 0.04cvss —epss 0.07

    Buffer overflow in the Dart Communications PowerTCP ZIP Compression ActiveX control in DartZip.dll 1.8.5.3, when Internet Explorer 6 is used, allows user-assisted remote attackers to execute arbitrary code via a long first argument to the QuickZip function, a related issue to…

  • CVE-2007-2827May 22, 2007
    LEAD Technologies
    Leadtools Isis Activex Control
    risk 0.04cvss —epss 0.06

    Heap-based buffer overflow in LEAD Technologies LEADTOOLS ISIS ActiveX Control (ltisi14E.ocx) 14.5.0.44 and earlier allows remote attackers to execute arbitrary code via a long DriverName property.

  • CVE-2007-2666May 14, 2007
    Scintilla
    Scintilla
    risk 0.04cvss —epss 0.16

    Stack-based buffer overflow in LexRuby.cxx (SciLexer.dll) in Scintilla 1.73, as used by notepad++ 4.1.1 and earlier, allows user-assisted remote attackers to execute arbitrary code via certain Ruby (.rb) files with long lines. NOTE: this was originally reported as a…

  • CVE-2007-1735Mar 28, 2007
    NOS Microsystems
    Wordperfect
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in Corel WordPerfect Office X3 (13.0.0.565) allows user-assisted remote attackers to execute arbitrary code via a long printer selection (PRS) name in a Wordperfect document.

  • CVE-2007-1413Mar 12, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.11

    Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows context-dependent attackers to execute arbitrary code via a long value in the third argument (object id).

  • CVE-2007-1381Mar 10, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.09

    The wddx_deserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strlcpy where strlcat was intended and uses improper arguments, which allows context-dependent attackers to execute arbitrary code…