cve.bz

CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 27

Filter

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

Ask an AI about CWE-190

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-190: Integer Overflow or Wraparound and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/190.html and https://cve.bz/cve/cwe/190?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2024-49888EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a sdiv overflow issue Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error: Oops: divide error: 0000 [#1] PREEMPT…

  2. 5.5CVE-2024-47739EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: padata: use integer wrap around to prevent deadlock on seq_nr overflow When submitting more than 2^32 padata objects to padata_do_serial, the current sorting implementat…

  3. 9.8CVE-2024-43566EPSS 1.1%

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  4. 5.5CVE-2024-47661EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid overflow from uint32_t to uint8_t [WHAT & HOW] dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned 0xFFFF. Fix it by changing it…

  5. 7.8CVE-2024-47424EPSS 0.3%

    Adobe Framemaker versions 2020.6, 2022.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…

  6. 7.8CVE-2024-47416EPSS 0.4%

    Animate versions 23.0.7, 24.0.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interact…

  7. 6.7CVE-2024-37976EPSS 0.6%

    Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability

  8. 5.5CVE-2024-34663EPSS 0.08%

    Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memory.

  9. 7.8CVE-2024-42415EPSS 0.5%

    An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a h…

  10. 7.8CVE-2024-36474EPSS 0.4%

    An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processin…

  11. 4.3CVE-2024-20434EPSS 0.3%

    A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the control plane of an affected device. This vulnerability is due to improper handling of frames…

  12. 8.8CVE-2024-9123EPSS 0.5%

    Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

  13. 5.5CVE-2024-46726EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure index calculation will not overflow [WHY & HOW] Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess a…

  14. 5.5CVE-2024-44198EPSS 0.2%

    An integer overflow was addressed through improved input validation. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing maliciously crafted web content may lead to an unexpected proce…

  15. 7.5CVE-2023-45854EPSS 0.3%

    A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd parameter in the add-to-cart function.

  16. 6.5CVE-2024-31416EPSS 0.3%

    The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of these input fields were not checking the length and bounds of the entered value. T…

  17. 7.8CVE-2024-34121EPSS 0.4%

    Illustrator versions 28.6, 27.9.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user intera…

  18. 7.3CVE-2024-43495EPSS 0.9%

    Windows libarchive Remote Code Execution Vulnerability

  19. 9.2CVE-2024-44087EPSS 11%

    A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not …

  20. 7.5CVE-2024-45287EPSS 0.5%

    A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the parsed data.

  21. 5.5CVE-2024-44981EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() UBSAN reports the following 'subtraction overflow' error when booting in a virtual machine on Andro…

  22. 8.4CVE-2024-33035EPSS 0.1%

    Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

  23. 5.5CVE-2024-28044EPSS 0.1%

    in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow.

  24. 9.8CVE-2024-45492EPSS 1.4%

    An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

  25. 9.8CVE-2024-45491EPSS 1.1%

    An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

  26. 7.5CVE-2024-45490EPSS 1.7%

    An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

  27. 5.5CVE-2024-43890EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: tracing: Fix overflow in get_free_elt() "tracing_map->next_elt" in get_free_elt() is at risk of overflowing. Once it overflows, new elements can still be inserted into …

  28. 5.5CVE-2022-48938EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulat…

  29. 9.8CVE-2024-30949EPSS 0.8%

    An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function.

  30. 5.5CVE-2024-43838EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: bpf: fix overflow check in adjust_jmp_off() adjust_jmp_off() incorrectly used the insn->imm field for all overflow check, which is incorrect as that should only be done …

  31. 7.8CVE-2024-34740EPSS 0.2%

    In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges nee…

  32. 7.8CVE-2024-31333EPSS 0.1%

    In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is…

  33. 2.1CVE-2024-7867EPSS 0.2%

    In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero.

  34. 7.8CVE-2024-41851EPSS 0.3%

    InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires us…

  35. 5.3CVE-2024-21844EPSS 0.3%

    Integer overflow in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable denial of service via adjacent access.

  36. 7.8CVE-2024-41858EPSS 0.3%

    InCopy versions 18.5.2, 19.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…

  37. 7.8CVE-2024-38215EPSS 0.7%

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

  38. 8.8CVE-2024-38144EPSS 32%

    Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

  39. 8.8CVE-2024-38128EPSS 1.6%

    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

  40. 7.5CVE-2024-33024EPSS 0.3%

    Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.

  41. 7.8CVE-2024-33022EPSS 0.1%

    Memory corruption while allocating memory in HGSL driver.

  42. 7.5CVE-2023-33976EPSS 0.4%

    TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow…

  43. 5.5CVE-2024-42223EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: tda10048: Fix integer overflow state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 6…

  44. 7.8CVE-2024-42136EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter th…

  45. 4.4CVE-2024-42131EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that v…

  46. 5.5CVE-2024-40784EPSS 0.3%

    An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing a m…

  47. 5.5CVE-2024-42066EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix potential integer overflow in page size calculation Explicitly cast tbo->page_alignment to u64 before bit-shifting to prevent overflow when assigning to min_…

  48. 5.5CVE-2024-6638EPSS 0.2%

    An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This…

  49. 9.8CVE-2024-41184EPSS 0.6%

    In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the user.

  50. 7.8CVE-2022-48837EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndis_set_response() If "BufOffset" is very large the "BufOffset + 8" operation can have an integer overflow.