VYPR

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

ClassStableLikelihood: High

Description

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-100 · CAPEC-123 · CAPEC-14 · CAPEC-24 · CAPEC-42 · CAPEC-44 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-8 · CAPEC-9

CVEs mapped to this weakness (14,335)

page 692 of 717
  • CVE-2008-3626Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application…

  • CVE-2008-3624Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a QuickTime Virtual Reality (QTVR) movie file with crafted panorama atoms.

  • CVE-2007-6717Sep 11, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Buffer overflow in tftp in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to gain privileges via unspecified vectors.

  • CVE-2008-3916Sep 4, 2008
    GNU
    Ed
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only…

  • CVE-2008-3911Sep 4, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The proc_do_xprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from userspace, which allows local users to overflow a stack-based buffer and have unspecified other impact via a crafted read system call for the…

  • CVE-2008-3908Sep 4, 2008
    Princeton
    WordNet
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via (1) a long argument on the command line; a long (2) WNSEARCHDIR, (3) WNHOME, or (4) WNDBVERSION environment variable; or (5) a user-supplied dictionary (aka…

  • CVE-2008-3146Sep 2, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in packet_ncp2222.inc in Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted NCP packet that causes an invalid pointer to be used.

  • CVE-2008-3854Aug 28, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 1 allow remote attackers to cause a denial of service (system outage) via vectors related to (1) use of XQuery to issue statements; the (2) XMLQUERY, (3) XMLEXISTS, and (4) XMLTABLE…

  • CVE-2008-3853Aug 28, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.06

    Buffer overflow in the DAS server program in the Core DAS function component in IBM DB2 9.1 before FP4a and 9.5 before FP1 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via unspecified vectors. NOTE: this might be related to…

  • CVE-2008-2327Aug 27, 2008
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.04

    Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling…

  • CVE-2008-3705Aug 19, 2008
    Echovnc
    Echovnc
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the CLogger::WriteFormated function in echoware/Logger.cpp in EchoVNC Linux before 1.1.2 allows remote echoServers to execute arbitrary code via a large (1) group or (2) user list, aka a "very crowded echoServer" attack. NOTE: some of these…

  • CVE-2008-2234Aug 18, 2008
    Openwsman
    Openwsman
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in Openwsman 1.2.0 and 2.0.0 allow remote attackers to execute arbitrary code via a crafted "Authorization: Basic" HTTP header.

  • CVE-2008-3659Aug 15, 2008
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this…

  • CVE-2008-3687Aug 14, 2008
    Xen
    Xen
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the flask_security_label function in Xen 3.3, when compiled with the XSM:FLASK module, allows unprivileged domain users (domU) to execute arbitrary code via the flask_op hypercall.

  • CVE-2008-3338Aug 13, 2008
    TIBCO Software
    Hawk
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in TIBCO Hawk (1) AMI C library (libtibhawkami) and (2) Hawk HMA (tibhawkhma), as used in TIBCO Hawk before 4.8.1; Runtime Agent (TRA) before 5.6.0; iProcess Engine 10.3.0 through 10.6.2 and 11.0.0; and Mainframe Service Tracker before 1.1.0 might allow…

  • CVE-2008-3577Aug 10, 2008
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.00

    Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttd_main function. NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments.

  • CVE-2008-2377Aug 8, 2008
    GNU
    Gnutls
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the _gnutls_handshake_hash_buffers_clear function in lib/gnutls_handshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data…

  • CVE-2008-3546Aug 7, 2008
    Git
    Git
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.

  • CVE-2008-3389Aug 5, 2008
    Actian
    Ingres
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running (1) verifydb,…

  • CVE-2008-2320Aug 4, 2008
    Apple Inc.
    Carboncore
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.4, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long…