cve.bz

CWE-125: Out-of-bounds Read, page 143

Filter

The product reads data past the end, or before the beginning, of the intended buffer.

What the weakness is: CWE-125 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-540 Overread Buffers Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-125, as MITRE names them. Credits.

Ask an AI about CWE-125

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2021-25287EPSS 2.9%

    An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

  2. 5.5CVE-2021-3522EPSS 5.4%

    GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.

  3. 9.1CVE-2020-12403EPSS 1.5%

    A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was n…

  4. 7.8CVE-2021-27490EPSS 2.0%

    Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.

  5. 9.8CVE-2021-33590EPSS 1.5%

    GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.

  6. 7.1CVE-2021-32614EPSS 1.0%

    A flaw was found in dmg2img through 20170502. fill_mishblk() does not check the length of the read buffer, and copy 0xCC bytes from it. The length of the buffer is controlled by an attacker. By providing a length smaller than 0xCC, memcpy …

  7. 7.1CVE-2021-3548EPSS 1.0%

    A flaw was found in dmg2img through 20170502. dmg2img did not validate the size of the read buffer during memcpy() inside the main() function. This possibly leads to memory layout information leaking in the data. This might be used in a ch…

  8. 4.4CVE-2021-20177EPSS 0.3%

    A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5…

  9. 9.8CVE-2020-13601EPSS 0.9%

    Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44

  10. 7.5CVE-2021-30195EPSS 7.6%

    CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.

  11. 9.1CVE-2021-30194EPSS 1.1%

    CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.

  12. 8.8CVE-2021-32629EPSS 0.5%

    Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a …

  13. 6.5CVE-2021-21989EPSS 0.5%

    VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious actor with access to a virtual machine or r…

  14. 6.5CVE-2021-21988EPSS 0.5%

    VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (JPEG2000 Parser). A malicious actor with access to a virtual machine…

  15. 6.5CVE-2021-21987EPSS 0.6%

    VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious actor with access to a virtual machine or r…

  16. 9.1CVE-2020-36331EPSS 2.3%

    A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.

  17. 9.1CVE-2020-36330EPSS 2.2%

    A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.

  18. 9.1CVE-2018-25013EPSS 2.1%

    A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

  19. 9.1CVE-2018-25012EPSS 2.1%

    A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().

  20. 9.1CVE-2018-25010EPSS 2.2%

    A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().

  21. 9.1CVE-2018-25009EPSS 2.1%

    A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

  22. 8.6CVE-2021-3517EPSS 17%

    There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigg…

  23. 9.8CVE-2021-22668EPSS 1.8%

    Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.

  24. 7.1CVE-2020-24119EPSS 1.1%

    A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect.

  25. 7.1CVE-2021-29613EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `tf.raw_ops.CTCLoss` allows an attacker to trigger an OOB read from heap. The fix will be included in TensorFlow 2.5.0. We will also cherrypick…

  26. 7.8CVE-2021-29606EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of `Split_V`(https://github.com/tensorflow/tensorflow/blob/c59c37e7b2d56…

  27. 7.1CVE-2021-29590EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. The implementations of the `Minimum` and `Maximum` TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor…

  28. 7.8CVE-2021-29583EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behav…

  29. 7.1CVE-2021-29582EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.Dequantize`, an attacker can trigger a read from outside of bounds of heap allocated data. The implementation(https://github.co…

  30. 7.1CVE-2021-29570EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The imp…

  31. 7.1CVE-2021-29569EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The imp…

  32. 7.1CVE-2021-29560EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `tf.raw_ops.RaggedTensorToTensor`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/d942…

  33. 7.1CVE-2021-29559EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can access data outside of bounds of heap allocated array in `tf.raw_ops.UnicodeEncode`. This is because the implementation(https://github.com/tensorflow/te…

  34. 7.1CVE-2021-29553EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can read data outside of bounds of heap allocated buffer in `tf.raw_ops.QuantizeAndDequantizeV3`. This is because the implementation(https://github.com/tens…

  35. 5.5CVE-2021-29551EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixTriangularSolve`(https://github.com/tensorflow/tensorflow/blob/8cae746d8449c7dda5298327353d68613f16e798/tensorflow/core/kernels/linalg/matr…

  36. 5.5CVE-2021-29547EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a segfault and denial of service via accessing data outside of bounds in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because t…

  37. 7.1CVE-2021-29532EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can force accesses outside the bounds of heap allocated arrays by passing in invalid tensor values to `tf.raw_ops.RaggedCross`. This is because the implemen…

  38. 6.0CVE-2021-20221EPSS 0.3%

    An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory…

  39. 6.5CVE-2020-25713EPSS 2.1%

    A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.

  40. 5.5CVE-2020-27824EPSS 1.6%

    A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerabil…

  41. 7.5CVE-2020-27840EPSS 3.9%

    A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest …

  42. 7.5CVE-2021-20277EPSS 4.4%

    A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulne…

  43. 5.4CVE-2021-3504EPSS 1.8%

    A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to…

  44. 5.5CVE-2021-31174EPSS 2.9%

    Microsoft Excel Information Disclosure Vulnerability

  45. 9.1CVE-2021-25848EPSS 1.2%

    Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actu…

  46. 9.1CVE-2021-25847EPSS 1.2%

    Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packe…

  47. 5.5CVE-2021-31471EPSS 2.1%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page …

  48. 3.3CVE-2021-31469EPSS 2.1%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page …

  49. 7.8CVE-2021-31468EPSS 2.8%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open …

  50. 3.3CVE-2021-31467EPSS 2.0%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page …