cve.bz

CWE-193: Off-by-one Error, page 4

Filter

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

What the weakness is: CWE-193 at MITRE. All weaknesses

Ask an AI about CWE-193

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-193: Off-by-one Error and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/193.html and https://cve.bz/cve/cwe/193?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2024-26995EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal…

  2. 5.3CVE-2024-31585EPSS 0.3%

    FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

  3. 5.5CVE-2024-26766EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in…

  4. 5.5CVE-2024-1441EPSS 0.4%

    An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt d…

  5. 7.8CVE-2021-47046EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offsets[] array did not have an entry for HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it l…

  6. 5.5CVE-2024-23849EPSS 0.3%

    In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.

  7. 7.5CVE-2023-46247EPSS 0.7%

    Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a st…

  8. 9.8CVE-2023-46853EPSS 0.9%

    In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

  9. 10.0CVE-2023-4260EPSS 0.9%

    Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.

  10. 8.8CVE-2023-4259EPSS 0.8%

    Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.

  11. 5.3CVE-2023-41880EPSS 0.7%

    Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a cons…

  12. 7.8CVE-2022-33064EPSS 0.3%

    An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.

  13. 9.8CVE-2023-38429EPSS 1.2%

    An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access.

  14. 7.5CVE-2023-28709EPSS 48%

    The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be re…

  15. 7.5CVE-2023-30546EPSS 0.6%

    Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contiki-NG operating system in versions 4.8 and prior. The problem exists in the Conti…

  16. 3.7CVE-2023-28858EPSS 1.0%

    redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially cre…

  17. 4.3CVE-2023-27477EPSS 0.6%

    wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand i…

  18. 5.5CVE-2023-0818EPSS 0.4%

    Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.

  19. 7.1CVE-2022-34684EPSS 0.3%

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or information disclosure.

  20. 5.3CVE-2022-36354EPSS 0.8%

    A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-o…

  21. 7.5CVE-2022-47517EPSS 1.6%

    An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read bec…

  22. 7.5CVE-2022-41916EPSS 1.0%

    Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINI…

  23. 5.5CVE-2022-3821EPSS 0.4%

    An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Serv…

  24. 8.6CVE-2022-3872EPSS 1.1%

    An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious gues…

  25. 9.1CVE-2021-46848EPSS 2.8%

    GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

  26. 9.8CVE-2022-39274EPSS 2.0%

    LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflow. Improper size validation of the incoming radio frames can lead to an 65280-by…

  27. 7.8CVE-2022-3103EPSS 0.3%

    off-by-one in io_uring module.

  28. 7.8CVE-2021-3999EPSS 0.8%

    A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a s…

  29. 7.5CVE-2020-27793EPSS 1.2%

    An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crash, and perform a denail of service attack.

  30. 9.8CVE-2022-34970EPSS 4.0%

    Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute arbitrary code in the context of the vulnerable service.

  31. 5.5CVE-2022-30155EPSS 5.3%

    Windows Kernel Denial of Service Vulnerability

  32. 7.1CVE-2022-23400EPSS 0.8%

    A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10. A specially-crafted PSD file can overflow a stack buffer, which could either lead to denial of service or, …

  33. 8.8CVE-2021-21938EPSS 1.9%

    A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerabil…

  34. 5.5CVE-2022-25051EPSS 0.8%

    An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.

  35. 9.1CVE-2021-4070EPSS 0.9%

    Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.

  36. 6.5CVE-2021-3930EPSS 0.3%

    An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to…

  37. 9.8CVE-2022-24988EPSS 1.1%

    In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.

  38. 5.5CVE-2021-44007EPSS 0.8%

    A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an off-by-one error in the heap while parsing specially crafted TIFF files. This cou…

  39. 7.7CVE-2021-23017ExploitEPSS 53%

    A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

  40. 7.8CVE-2021-29529EPSS 0.3%

    TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` by manipulating input values so that float rounding results in off-by-one error i…

  41. 9.8CVE-2021-31875EPSS 2.2%

    In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter d…

  42. 6.0CVE-2020-27171EPSS 0.6%

    An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that d…

  43. 7.8CVE-2021-3156KEVExploitEPSS >99.9%

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

  44. 7.5CVE-2020-35893EPSS 1.4%

    An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory.

  45. 8.8CVE-2020-29040EPSS 0.4%

    An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly gain privileges because of an off-by-one error. NOTE: this issue is caused by an …

  46. 9.8CVE-2020-14510EPSS 2.5%

    GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.

  47. 9.8CVE-2020-14508EPSS 2.0%

    GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code or cause a denial-of-service condition.

  48. 7.8CVE-2020-3969EPSS 0.5%

    VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an off-by-one heap-overflow vulnerability in …

  49. 9.8CVE-2020-10062EPSS 2.9%

    An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

  50. 7.8CVE-2019-19721EPSS 2.0%

    An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to …