cve.bz

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, page 78

Filter

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

What the weakness is: CWE-119 at MITRE

Related attack patterns (CAPEC): 12
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-44 Overflow Binary Resource File Likelihood: High · Severity: Very High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-100 Overflow Buffers Likelihood: High · Severity: Very High
  • CAPEC-123 Buffer Manipulation Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-119, as MITRE names them. Credits.

Ask an AI about CWE-119

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/119.html and https://cve.bz/cve/cwe/119?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.0CVE-2019-15246EPSS 0.6%

    Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user…

  2. 8.0CVE-2019-15245EPSS 0.6%

    Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user…

  3. 8.0CVE-2019-15244EPSS 0.6%

    Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user…

  4. 8.0CVE-2019-15243EPSS 0.6%

    Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user…

  5. 8.0CVE-2019-15242EPSS 0.6%

    Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user…

  6. 8.0CVE-2019-15241EPSS 0.6%

    Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user…

  7. 8.0CVE-2019-15240EPSS 0.6%

    Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user…

  8. 9.8CVE-2018-21027EPSS 2.4%

    Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.

  9. 7.8CVE-2019-14569EPSS 0.3%

    Pointer corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.

  10. 9.8CVE-2019-17320EPSS 2.2%

    NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying file name from an attacker controlled FTP server. That leads attacker to execute arbitrary code by se…

  11. 7.8CVE-2019-5699EPSS 0.5%

    NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bounds check, which may lead to buffer overflow resulting in escalation of privileges and code execution…

  12. 7.5CVE-2018-5732EPSS 5.2%

    Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a sp…

  13. 7.5CVE-2018-11768EPSS 6.6%

    In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.

  14. 8.8CVE-2019-12688EPSS 3.3%

    A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient input validation. An a…

  15. 8.8CVE-2019-12687EPSS 3.3%

    A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient input validation. An a…

  16. 7.5CVE-2019-12673EPSS 1.8%

    A vulnerability in the FTP inspection engine of Cisco Adaptive Security (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an aff…

  17. 9.8CVE-2019-11929EPSS 4.0%

    Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4…

  18. 4.3CVE-2019-2191EPSS 0.1%

    In LG's LAF component, there is a possible leak of information in a protected disk partition due to a missing bounds check. This could lead to local information disclosure via USB with User execution privileges needed. User interaction is …

  19. 4.3CVE-2019-2190EPSS 0.1%

    In LG's LAF component, there is a possible leak of information in a protected disk partition due to a missing bounds check. This could lead to local information disclosure via USB with User execution privileges needed. User interaction is …

  20. 7.8CVE-2019-10978EPSS 0.9%

    Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the design…

  21. 6.5CVE-2019-16707EPSS 1.6%

    Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.

  22. 7.8CVE-2019-1214KEVEPSS 1.4%

    An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.

  23. 7.5CVE-2019-11467EPSS 1.3%

    In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than …

  24. 9.8CVE-2019-11926EPSS 2.3%

    Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9…

  25. 9.8CVE-2019-11925EPSS 2.1%

    Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all…

  26. 7.5CVE-2019-16058EPSS 1.5%

    An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits dependi…

  27. 6.4CVE-2019-15946EPSS 0.4%

    OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.

  28. 6.4CVE-2019-15945EPSS 0.4%

    OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.

  29. 7.5CVE-2019-12223EPSS 2.4%

    An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The us…

  30. 7.8CVE-2019-13522EPSS 1.4%

    An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Versions 1.8.41 and prior.

  31. 7.8CVE-2019-13518EPSS 1.4%

    An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor Versions 2.1.0 and prior.

  32. 9.8CVE-2019-15786EPSS 1.6%

    ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.

  33. 9.8CVE-2019-15785EPSS 2.7%

    FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.

  34. 9.8CVE-2019-15783EPSS 1.5%

    Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.

  35. 7.8CVE-2017-14202EPSS 0.6%

    Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Z…

  36. 9.8CVE-2019-9933EPSS 1.5%

    Various Lexmark products have a Buffer Overflow (issue 3 of 3).

  37. 9.8CVE-2019-9932EPSS 1.5%

    Various Lexmark products have a Buffer Overflow (issue 2 of 3).

  38. 9.8CVE-2019-13484EPSS 1.8%

    In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of &nbsp; expansion in appfeed.c.

  39. 9.8CVE-2019-13452EPSS 1.8%

    In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c.

  40. 9.8CVE-2019-13451EPSS 2.4%

    In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c.

  41. 9.8CVE-2019-15548EPSS 1.6%

    An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.

  42. 9.8CVE-2018-20998EPSS 1.7%

    An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to memory corruption.

  43. 9.8CVE-2018-20995EPSS 1.6%

    An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates are mishandled.

  44. 9.8CVE-2019-14307EPSS 3.0%

    Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for SNMP, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depen…

  45. 9.8CVE-2019-14305EPSS 3.0%

    Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for Wi-Fi, mDNS, POP3, SMTP, and notification alerts, which allow an attacker to cause a denial of service or code execution via crafted requests to the …

  46. 9.8CVE-2019-14300EPSS 3.1%

    Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the prin…

  47. 9.8CVE-2018-21000EPSS 2.0%

    An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap memory corruption.

  48. 9.8CVE-2019-14308EPSS 3.1%

    Several Ricoh printers have multiple buffer overflows parsing LPD packets, which allow an attacker to cause a denial of service or code execution via crafted requests to the LPD service. Affected firmware versions depend on the printer mod…

  49. 7.2CVE-2019-1871EPSS 3.3%

    A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with …

  50. 5.5CVE-2019-3634EPSS 0.2%

    Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe re…