cve.bz

CWE-131: Incorrect Calculation of Buffer Size, page 4

Filter

The product does not correctly calculate the size to be used when allocating a buffer.

What the weakness is: CWE-131 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-100 Overflow Buffers Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-131, as MITRE names them. Credits.

Ask an AI about CWE-131

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-131: Incorrect Calculation of Buffer Size and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/131.html and https://cve.bz/cve/cwe/131?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2024-23622EPSS 1.9%

    A stack-based buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerability to achieve remote code execution with SYSTEM privileges.

  2. 9.8CVE-2024-23621EPSS 1.9%

    A buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerability to achieve remote code execution.

  3. 9.8CVE-2023-5941EPSS 1.2%

    In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not correctly update FILE objects' write space members for write-buffered streams whe…

  4. 7.5CVE-2023-45871EPSS 0.6%

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.

  5. 9.8CVE-2023-4257EPSS 1.1%

    Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.

  6. 4.4CVE-2023-20798EPSS 0.09%

    In pda, there is a possible out of bounds read due to an incorrect calculation of buffer size. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch …

  7. 8.8CVE-2023-36824EPSS 77%

    Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corr…

  8. 7.5CVE-2023-30575EPSS 1.0%

    Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through spe…

  9. 3.3CVE-2023-2687EPSS 0.2%

    Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap.

  10. 9.8CVE-2023-24819EPSS 1.0%

    RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of…

  11. 9.8CVE-2022-33211EPSS 0.4%

    memory corruption in modem due to improper check while calculating size of serialized CoAP message

  12. 7.5CVE-2022-25731EPSS 0.4%

    Information disclosure in modem due to buffer over-read while processing packets from DNS server

  13. 6.7CVE-2023-20627EPSS 0.10%

    In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALP…

  14. 6.6CVE-2023-1175EPSS 0.4%

    Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

  15. 8.1CVE-2023-0568EPSS 1.2%

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after…

  16. 7.8CVE-2022-4378EPSS 0.4%

    A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.

  17. 6.7CVE-2022-32651EPSS 0.1%

    In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07225857; Issue I…

  18. 6.7CVE-2022-32650EPSS 0.1%

    In mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07225853; Issue I…

  19. 6.7CVE-2022-32649EPSS 0.1%

    In jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07225840; Issue ID: …

  20. 6.7CVE-2022-32630EPSS 0.1%

    In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitatio…

  21. 6.7CVE-2022-32624EPSS 0.10%

    In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitatio…

  22. 7.5CVE-2022-41907EPSS 0.5%

    TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The f…

  23. 7.5CVE-2022-41887EPSS 0.5%

    TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will c…

  24. 7.5CVE-2022-41886EPSS 0.5%

    TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The …

  25. 7.5CVE-2022-41885EPSS 0.5%

    TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix…

  26. 7.1CVE-2022-31630EPSS 1.3%

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside…

  27. 6.8CVE-2022-32618EPSS 0.2%

    In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privile…

  28. 6.8CVE-2022-32617EPSS 0.2%

    In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privile…

  29. 7.8CVE-2022-39377EPSS 1.4%

    sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures functi…

  30. 7.5CVE-2022-43945EPSS 5.5%

    The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC)…

  31. 6.7CVE-2022-26474EPSS 0.1%

    In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation…

  32. 8.4CVE-2021-35134EPSS 0.1%

    Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

  33. 6.5CVE-2022-2520EPSS 1.3%

    A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input.

  34. 5.5CVE-2021-4155EPSS 0.3%

    A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to t…

  35. 5.5CVE-2022-2873EPSS 0.3%

    An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local …

  36. 9.8CVE-2021-38435EPSS 1.4%

    RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.

  37. 9.8CVE-2021-38423EPSS 1.3%

    All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.

  38. 6.5CVE-2022-22137EPSS 1.1%

    A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to an arbitrary free. An attacker can provide a malicious file to trigger this vul…

  39. 8.2CVE-2021-4206EPSS 0.8%

    A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a ma…

  40. 7.5CVE-2021-44510EPSS 1.7%

    An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c to result in an extremely large …

  41. 7.5CVE-2021-40052EPSS 0.8%

    There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect availability.

  42. 7.5CVE-2021-40048EPSS 0.8%

    There is an incorrect buffer size calculation vulnerability in the video framework. Successful exploitation of this vulnerability will affect availability.

  43. 5.3CVE-2021-40526EPSS 1.0%

    Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network se…

  44. 7.5CVE-2020-36475EPSS 1.9%

    An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service whe…

  45. 7.5CVE-2021-22415EPSS 0.7%

    There is an Incorrect Calculation of Buffer Size Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause kernel exceptions with the code.

  46. 7.5CVE-2021-22392EPSS 0.6%

    There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause verification bypass and directions to abnormal addresses.

  47. 7.5CVE-2021-22391EPSS 0.7%

    There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.

  48. 8.8CVE-2021-21793EPSS 1.1%

    An out-of-bounds write vulnerability exists in the JPG sof_nb_comp header processing functionality of Accusoft ImageGear 19.8 and 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious f…

  49. 9.8CVE-2021-21824EPSS 1.2%

    An out-of-bounds write vulnerability exists in the JPG Handle_JPEG420 functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vuln…

  50. 7.8CVE-2020-11240EPSS 0.2%

    Memory corruption due to ioctl command size was incorrectly set to the size of a pointer and not enough storage is allocated for the copy of the user argument in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Cons…