CWE-190: Integer Overflow or Wraparound (Year 2038 problem, Y2K38, Y2038, Epochalypse), page 36

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

What the weakness is: CWE-190 at MITRE

1. 5.5CVE-2022-47451EPSS 0.2%2023-02-12

   In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

2. 5.5CVE-2022-47322EPSS 0.09%2023-02-12

   In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

3. 5.5CVE-2022-38680EPSS 0.09%2023-02-12

   In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

4. 5.5CVE-2022-38674EPSS 0.09%2023-02-12

   In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

5. 7.8CVE-2022-33248EPSS 0.1%2023-02-12

   Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

6. 7.5CVE-2023-0705EPSS 0.7%2023-02-07

   Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

7. 5.5CVE-2023-0615EPSS 0.2%2023-02-06

   A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a…

8. 6.7CVE-2023-20602EPSS 0.10%2023-02-06

   In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494107; …

9. 9.8CVE-2022-2329EPSS 2.1%2023-02-01

   A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affe…

10. 9.8CVE-2022-28331EPSS 1.6%2023-01-31

    On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

11. 6.5CVE-2022-25147EPSS 1.4%2023-01-31

    Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6…

12. 9.8CVE-2022-24963EPSS 1.5%2023-01-31

    Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

13. 7.5CVE-2022-38725EPSS 2.4%2023-01-23

    An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition…

14. 5.5CVE-2023-23144EPSS 0.3%2023-01-20

    Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.

15. 5.5CVE-2023-22458EPSS 72%2023-01-20

    Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This p…

16. 5.5CVE-2022-35977EPSS 14%2023-01-20

    Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memo…

17. 7.8CVE-2023-21579EPSS 4.9%2023-01-18

    Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the contex…

18. 9.8CVE-2022-41903EPSS 44%2023-01-17

    Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the …

19. 9.8CVE-2022-23521EPSS 56%2023-01-17

    Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns an…

20. 9.8CVE-2022-1812EPSS 31%2023-01-14

    Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.

21. 7.8CVE-2023-23559EPSS 0.3%2023-01-13

    In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.

22. 8.8CVE-2022-40983EPSS 1.1%2023-01-12

    An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Targ…

23. 9.8CVE-2022-3515EPSS 1.7%2023-01-12

    A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, fo…

24. 5.5CVE-2021-26346EPSS 0.2%2023-01-11

    Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.

25. 7.8CVE-2023-21765EPSS 0.5%2023-01-10

    Windows Print Spooler Elevation of Privilege Vulnerability

26. 7.8CVE-2023-21754EPSS 0.5%2023-01-10

    Windows Kernel Elevation of Privilege Vulnerability

27. 7.8CVE-2023-21730EPSS 0.5%2023-01-10

    Microsoft Cryptographic Services Elevation of Privilege Vulnerability

28. 7.8CVE-2023-21561EPSS 0.4%2023-01-10

    Microsoft Cryptographic Services Elevation of Privilege Vulnerability

29. 7.5CVE-2023-21557EPSS 2.1%2023-01-10

    Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

30. 7.5CVE-2023-22895EPSS 1.2%2023-01-10

    The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

31. 9.8CVE-2022-43974EPSS 1.8%2023-01-09

    MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send a crafted TLS Message to cause a buffer overflow and achieve remote code execution. This is fixed in 4.6.0.

32. 7.8CVE-2022-33266EPSS 0.1%2023-01-09

    Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.

33. 7.8CVE-2022-33219EPSS 0.1%2023-01-09

    Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.

34. 7.8CVE-2022-47660EPSS 0.3%2023-01-05

    GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is has an integer overflow in isomedia/isom_write.c

35. 7.1CVE-2022-47092EPSS 0.3%2023-01-05

    GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8316

36. 5.5CVE-2022-44432EPSS 0.1%2023-01-04

    In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.

37. 5.5CVE-2022-44426EPSS 0.1%2023-01-04

    In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.

38. 5.5CVE-2022-44425EPSS 0.1%2023-01-04

    In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.

39. 8.8CVE-2022-2743EPSS 0.6%2023-01-02

    Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to perform an out of bounds memory write via crafted UI…

40. 7.1CVE-2022-42265EPSS 0.3%2022-12-30

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure or data tampering.

41. 7.1CVE-2022-42263EPSS 0.3%2022-12-30

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an Integer overflow may lead to denial of service or information disclosure.

42. 5.5CVE-2022-42259EPSS 0.3%2022-12-30

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service.

43. 7.3CVE-2022-42258EPSS 0.3%2022-12-30

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service, data tampering, or information disclosure.

44. 7.3CVE-2022-42257EPSS 0.3%2022-12-30

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure, data tampering or denial of service.

45. 7.8CVE-2022-42256EPSS 0.3%2022-12-30

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow in index validation may lead to denial of service, information disclosure, or data tampering.

46. 7.3CVE-2022-34673EPSS 0.2%2022-12-30

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.

47. 8.6CVE-2022-41318EPSS 3.1%2022-12-25

    A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations,…

48. 8.8CVE-2022-42898EPSS 6.9%2022-12-25

    PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resul…

49. 8.8CVE-2022-34481EPSS 0.8%2022-12-22

    In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large for the container. This vulnerability affects Firefox < 102, Firefox ESR < 91.11,…

50. 9.8CVE-2022-47629EPSS 1.7%2022-12-20

    Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.