cve.bz

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, page 147

Filter

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

What the weakness is: CWE-119 at MITRE

Related attack patterns (CAPEC): 12
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-44 Overflow Binary Resource File Likelihood: High · Severity: Very High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-100 Overflow Buffers Likelihood: High · Severity: Very High
  • CAPEC-123 Buffer Manipulation Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-119, as MITRE names them. Credits.

Ask an AI about CWE-119

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/119.html and https://cve.bz/cve/cwe/119?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2017-5482EPSS 5.5%

    The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2016-8575.

  2. 9.8CVE-2017-5342EPSS 5.5%

    In tcpdump before 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print().

  3. 9.8CVE-2017-5341EPSS 5.3%

    The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otv_print().

  4. 9.8CVE-2017-5205EPSS 3.6%

    The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print().

  5. 9.8CVE-2017-5204EPSS 6.0%

    The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print().

  6. 9.8CVE-2017-5203EPSS 3.8%

    The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().

  7. 9.8CVE-2017-5202EPSS 3.8%

    The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print().

  8. 9.8CVE-2016-8575EPSS 5.5%

    The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482.

  9. 9.8CVE-2016-8574EPSS 3.2%

    The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print().

  10. 9.8CVE-2016-7993EPSS 3.4%

    A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).

  11. 9.8CVE-2016-7992EPSS 3.4%

    The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print().

  12. 9.8CVE-2016-7986EPSS 3.2%

    The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions.

  13. 9.8CVE-2016-7985EPSS 3.2%

    The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().

  14. 9.8CVE-2016-7984EPSS 3.4%

    The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print().

  15. 9.8CVE-2016-7983EPSS 3.9%

    The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().

  16. 9.8CVE-2016-7975EPSS 3.4%

    The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().

  17. 9.8CVE-2016-7974EPSS 3.2%

    The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.

  18. 9.8CVE-2016-7973EPSS 3.2%

    The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.

  19. 9.8CVE-2016-7940EPSS 3.4%

    The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions.

  20. 9.8CVE-2016-7939EPSS 3.5%

    The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions.

  21. 9.8CVE-2016-7937EPSS 3.2%

    The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:vat_print().

  22. 9.8CVE-2016-7936EPSS 3.2%

    The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:udp_print().

  23. 9.8CVE-2016-7935EPSS 3.4%

    The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtp_print().

  24. 9.8CVE-2016-7934EPSS 3.4%

    The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcp_print().

  25. 9.8CVE-2016-7933EPSS 3.2%

    The PPP parser in tcpdump before 4.9.0 has a buffer overflow in print-ppp.c:ppp_hdlc_if_print().

  26. 9.8CVE-2016-7932EPSS 3.1%

    The PIM parser in tcpdump before 4.9.0 has a buffer overflow in print-pim.c:pimv2_check_checksum().

  27. 9.8CVE-2016-7931EPSS 3.2%

    The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print-mpls.c:mpls_print().

  28. 9.8CVE-2016-7930EPSS 3.2%

    The LLC/SNAP parser in tcpdump before 4.9.0 has a buffer overflow in print-llc.c:llc_print().

  29. 9.8CVE-2016-7929EPSS 3.2%

    The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniper_parse_header().

  30. 9.8CVE-2016-7928EPSS 3.4%

    The IPComp parser in tcpdump before 4.9.0 has a buffer overflow in print-ipcomp.c:ipcomp_print().

  31. 9.8CVE-2016-7927EPSS 3.2%

    The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-802_11.c:ieee802_11_radio_print().

  32. 9.8CVE-2016-7926EPSS 3.2%

    The Ethernet parser in tcpdump before 4.9.0 has a buffer overflow in print-ether.c:ethertype_print().

  33. 9.8CVE-2016-7925EPSS 3.2%

    The compressed SLIP parser in tcpdump before 4.9.0 has a buffer overflow in print-sl.c:sl_if_print().

  34. 9.8CVE-2016-7924EPSS 3.5%

    The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:oam_print().

  35. 9.8CVE-2016-7923EPSS 3.4%

    The ARP parser in tcpdump before 4.9.0 has a buffer overflow in print-arp.c:arp_print().

  36. 9.8CVE-2016-7922EPSS 3.2%

    The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ah_print().

  37. 9.8CVE-2016-9636EPSS 8.3%

    Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by pro…

  38. 9.8CVE-2016-9635EPSS 8.8%

    Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by pro…

  39. 9.8CVE-2016-9634EPSS 8.8%

    Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via th…

  40. 5.5CVE-2016-9298EPSS 1.9%

    Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.

  41. 9.8CVE-2016-8411EPSS 0.9%

    Buffer overflow vulnerability while processing QMI QOS TLVs. Product: Android. Versions: versions that have qmi_qos_srvc.c. Android ID: 31805216. References: QC CR#912775.

  42. 9.8CVE-2016-9307EPSS 2.2%

    Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed 3DS format files.

  43. 9.8CVE-2016-9306EPSS 2.2%

    Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DAE format files.

  44. 8.8CVE-2016-9304EPSS 1.8%

    Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DFX format files.

  45. 9.8CVE-2016-9303EPSS 4.1%

    Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code or cause an infinite loop condition when reading or converting malformed FBX format files.

  46. 7.5CVE-2017-5495EPSS 19%

    All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their …

  47. 7.8CVE-2017-2972EPSS 2.8%

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion module related to JPEG parsing. Successful exploitation could…

  48. 7.8CVE-2017-2971EPSS 9.1%

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the JPEG decoder routine. Successful exploitation could lead to arbitrary code executi…

  49. 7.8CVE-2017-2970EPSS 7.4%

    Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the XSLT engine related to template manipulation. Successful exploitation could lead t…

  50. 9.8CVE-2016-7567ExploitEPSS 12%

    Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted string.