cve.bz

CWE-125: Out-of-bounds Read, page 175

Filter

The product reads data past the end, or before the beginning, of the intended buffer.

What the weakness is: CWE-125 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-540 Overread Buffers Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-125, as MITRE names them. Credits.

Ask an AI about CWE-125

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-125: Out-of-bounds Read and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/125.html and https://cve.bz/cve/cwe/125?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2019-2037EPSS 0.8%

    In l2cu_send_peer_config_rej of l2c_utils.cc, there is a possible out-of-bound read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not …

  2. 8.8CVE-2019-11339EPSS 2.8%

    The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-…

  3. 9.1CVE-2019-11035EPSS 4.4%

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure …

  4. 9.1CVE-2019-11034EPSS 4.1%

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosur…

  5. 5.5CVE-2019-10949EPSS 2.4%

    Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple out-of-bounds read vulnerabilities may be exploited, allowing information disclosure due to a lack of user input validation for processing specia…

  6. 7.5CVE-2019-6568EPSS 1.4%

    The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected device. The s…

  7. 5.9CVE-2019-5520EPSS 1.0%

    VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds read vulnerability…

  8. 6.8CVE-2019-5517EPSS 1.1%

    VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain multiple out-of-bounds read vulnerabilities…

  9. 6.8CVE-2019-5516EPSS 1.7%

    VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds vulnerability with…

  10. 8.1CVE-2017-7776EPSS 2.8%

    Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.

  11. 9.1CVE-2017-7774EPSS 1.4%

    Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.

  12. 8.1CVE-2017-7771EPSS 1.2%

    Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.

  13. 6.5CVE-2019-3459EPSS 1.8%

    A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.

  14. 7.5CVE-2019-10903EPSS 5.6%

    In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check.

  15. 7.5CVE-2019-10899EPSS 5.6%

    In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.

  16. 7.5CVE-2019-10895EPSS 5.8%

    In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.

  17. 5.5CVE-2019-1798EPSS 1.1%

    A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affecte…

  18. 5.5CVE-2019-1787EPSS 1.7%

    A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an …

  19. 5.5CVE-2019-1786EPSS 1.5%

    A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a…

  20. 8.1CVE-2019-11009EPSS 2.4%

    In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allows attackers to cause a denial of service or information disclosure via a crafted image file.

  21. 8.1CVE-2019-11007EPSS 2.0%

    In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allows attackers to cause a denial of service or information disclosure via an image colormap.

  22. 9.1CVE-2019-11006EPSS 2.9%

    In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which allows attackers to cause a denial of service or information disclosure via an RLE packet.

  23. 8.8CVE-2019-10872EPSS 2.7%

    An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.

  24. 6.5CVE-2019-10871EPSS 2.5%

    An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.

  25. 9.8CVE-2018-10243EPSS 2.3%

    htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header.

  26. 7.5CVE-2018-10242EPSS 1.5%

    Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check.

  27. 7.1CVE-2018-4434EPSS 0.3%

    An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.2.

  28. 7.8CVE-2018-4371EPSS 0.9%

    An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1.

  29. 5.5CVE-2018-4365EPSS 0.7%

    An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12.1.

  30. 5.5CVE-2018-4308EPSS 0.8%

    An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to macOS Mojave 10.14.

  31. 5.5CVE-2018-4283EPSS 0.3%

    An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue affected versions prior to macOS High Sierra 10.13.6.

  32. 5.5CVE-2018-4282EPSS 0.3%

    An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2.

  33. 7.5CVE-2018-4248EPSS 2.4%

    An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2.

  34. 7.5CVE-2018-4203EPSS 1.5%

    An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.

  35. 6.5CVE-2019-10714EPSS 1.9%

    LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.

  36. 6.8CVE-2019-5518EPSS 0.8%

    VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain an out-of-bounds read/wri…

  37. 5.5CVE-2019-10654EPSS 1.2%

    The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive, a different vul…

  38. 8.1CVE-2019-10650EPSS 4.1%

    In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.

  39. 6.5CVE-2018-14814EPSS 1.5%

    WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object.

  40. 7.1CVE-2018-18994EPSS 1.1%

    LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a system crash or allow data exfiltration.

  41. 7.5CVE-2013-2805EPSS 3.9%

    Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it receives a datagram with a…

  42. 7.5CVE-2013-2807EPSS 3.9%

    Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it calculates an incorrect va…

  43. 9.1CVE-2019-3861EPSS 5.1%

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of…

  44. 9.1CVE-2019-3860EPSS 5.4%

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client me…

  45. 7.5CVE-2019-9936EPSS 5.3%

    In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

  46. 9.1CVE-2019-3858EPSS 6.4%

    An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the…

  47. 7.8CVE-2019-9878EPSS 1.2%

    There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftops binary. I…

  48. 7.8CVE-2019-9877EPSS 1.1%

    There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for example) be triggered by sending a crafted pdf file to the pdftops binary. It allows an attacker t…

  49. 6.5CVE-2019-6735EPSS 4.3%

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a m…

  50. 6.5CVE-2019-6733EPSS 4.3%

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open…