cve.bz

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, page 73

Filter

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

What the weakness is: CWE-119 at MITRE

Related attack patterns (CAPEC): 12
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-44 Overflow Binary Resource File Likelihood: High · Severity: Very High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-100 Overflow Buffers Likelihood: High · Severity: Very High
  • CAPEC-123 Buffer Manipulation Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-119, as MITRE names them. Credits.

Ask an AI about CWE-119

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/119.html and https://cve.bz/cve/cwe/119?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2021-21457EPSS 1.2%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  2. 8.8CVE-2021-21453EPSS 1.2%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  3. 8.8CVE-2021-21452EPSS 1.2%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  4. 8.8CVE-2021-21451EPSS 1.2%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  5. 8.8CVE-2021-21450EPSS 1.2%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  6. 8.8CVE-2021-21449EPSS 1.2%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  7. 7.5CVE-2020-13573EPSS 4.1%

    A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. A specially crafted network request can lead to a denial of service. An attacker can send a seque…

  8. 9.8CVE-2020-35878EPSS 1.5%

    An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized memory.

  9. 9.8CVE-2020-35877EPSS 1.5%

    An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of out-of-bounds access.

  10. 7.8CVE-2020-8935EPSS 0.1%

    An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating you…

  11. 7.8CVE-2020-13520EPSS 2.1%

    An out of bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 reconstructs paths from binary USD files. A specially crafted malformed file can trigger an out of bounds memory modification which can result in remote…

  12. 6.8CVE-2020-28220EPSS 1.1%

    A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions), that could cause a b…

  13. 5.5CVE-2020-13524EPSS 0.8%

    An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD files. A specially crafted malformed file can trigger an out-of-bounds memory access and modification which results in m…

  14. 5.5CVE-2020-13497EPSS 1.2%

    An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in String Type Index. This vulnerability could…

  15. 6.5CVE-2020-13496EPSS 1.7%

    An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in TfToken Type Index. This vulnerability coul…

  16. 7.5CVE-2020-26243EPSS 2.7%

    Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage…

  17. 7.8CVE-2020-7554EPSS 2.5%

    A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) f…

  18. 7.8CVE-2020-7550EPSS 2.5%

    A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and prior that could cause Remote Code Execution when malicious CGF (Configuration Gro…

  19. 9.8CVE-2020-3470EPSS 4.8%

    Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary …

  20. 9.8CVE-2020-11196EPSS 0.9%

    u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Vo…

  21. 6.9CVE-2020-5388EPSS 0.3%

    Dell Inspiron 15 7579 2-in-1 BIOS versions prior to 1.31.0 contain an Improper SMM communication buffer verification vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arb…

  22. 7.8CVE-2020-3604EPSS 2.6%

    Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation…

  23. 7.8CVE-2020-3603EPSS 2.6%

    Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation…

  24. 7.8CVE-2020-3573EPSS 2.8%

    Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation…

  25. 8.2CVE-2020-10292EPSS 1.5%

    Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from…

  26. 7.8CVE-2020-3693EPSS 0.2%

    u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voic…

  27. 9.8CVE-2019-17006EPSS 3.6%

    In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a…

  28. 7.5CVE-2020-15266EPSS 0.9%

    In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined b…

  29. 8.6CVE-2020-3562EPSS 1.8%

    A vulnerability in the SSL/TLS inspection of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affecte…

  30. 7.8CVE-2020-17003EPSS 4.2%

    <p>A remote code execution vulnerability exists when the Base3D rendering engine improperly handles memory.</p> <p>An attacker who successfully exploited the vulnerability would gain execution on a victim system.</p> <p>The security update…

  31. 7.5CVE-2020-1671EPSS 1.3%

    On Juniper Networks Junos OS platforms configured as DHCPv6 local server or DHCPv6 Relay Agent, Juniper Networks Dynamic Host Configuration Protocol Daemon (JDHCPD) process might crash with a core dump if a malformed DHCPv6 packet is recei…

  32. 9.8CVE-2020-15254EPSS 2.7%

    Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::fro…

  33. 8.8CVE-2020-3544EPSS 0.7%

    A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute arbitrary code on an affected device or cause the device to rel…

  34. 4.0CVE-2020-15213EPSS 0.8%

    In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holdin…

  35. 9.0CVE-2020-15207EPSS 1.2%

    In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, to mimic Python's indexing with negative values, TFLite uses `ResolveAxis` to convert negative values to positive indices. However, the only check that the converted…

  36. 9.8CVE-2020-15205EPSS 1.0%

    In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of …

  37. 5.4CVE-2020-15198EPSS 0.5%

    In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has the same shape as t…

  38. 9.9CVE-2020-15196EPSS 0.9%

    In Tensorflow version 2.3.0, the `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same shape as the data. The check exists for `DenseCountSparseOutput`, where both ten…

  39. 8.8CVE-2020-15195EPSS 0.9%

    In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern. It is possible for `reverse_index_map(i)` to be an index outside of bounds of `grad_values…

  40. 9.8CVE-2020-15373EPSS 2.4%

    Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c could allow remote unauthenticated attackers to perform various attacks.

  41. 6.7CVE-2020-3423EPSS 0.4%

    A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system (…

  42. 7.0CVE-2020-25599EPSS 0.3%

    An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various …

  43. 7.2CVE-2019-15992EPSS 4.1%

    A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrar…

  44. 7.8CVE-2019-15287EPSS 1.8%

    Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to i…

  45. 7.8CVE-2019-15285EPSS 1.8%

    Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to i…

  46. 7.8CVE-2019-15283EPSS 1.8%

    Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to i…

  47. 9.8CVE-2020-25614EPSS 1.9%

    xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.

  48. 5.5CVE-2020-14392EPSS 0.6%

    An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.

  49. 7.8CVE-2020-14345EPSS 0.6%

    A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and int…

  50. 5.3CVE-2013-7490EPSS 2.7%

    An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption.