CWE-401: Missing Release of Memory after Effective Lifetime, page 33
Filter
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
What the weakness is: CWE-401 at MITRE
Ask an AI about CWE-401
Show the prompt
Explain CWE-401: Missing Release of Memory after Effective Lifetime and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/401.html and https://cve.bz/cve/cwe/401?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2022-2906EPSS 2.0%
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
- 5.5CVE-2022-35085EPSS 0.3%
SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
- 7.5CVE-2022-39005EPSS 0.6%
The MPTCP module has the memory leak vulnerability. Successful exploitation of this vulnerability can cause memory leaks.
- 7.5CVE-2022-39004EPSS 0.6%
The MPTCP module has the memory leak vulnerability. Successful exploitation of this vulnerability can cause memory leaks.
- 5.5CVE-2022-38600EPSS 0.4%
Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via vf.c and vf_vo.c.
- 6.5CVE-2022-40439EPSS 0.7%
An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file.
- 4.4CVE-2022-31222EPSS 0.2%
Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the applica…
- 7.5CVE-2022-40281EPSS 0.7%
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer_certificate, leading to information disclosure.
- 7.8CVE-2022-22067EPSS 0.3%
Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- 3.3CVE-2021-3574EPSS 0.5%
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.
- 7.5CVE-2021-42523EPSS 0.9%
There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxm…
- 7.5CVE-2021-42522EPSS 0.8%
There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was caused by the incorrect use of libxml2 API. The vendor forgot to call 'g_free()' to release the return value of 'xmlGetPr…
- 7.5CVE-2021-4213EPSS 1.7%
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory proce…
- 7.5CVE-2021-3905EPSS 2.1%
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
- 5.5CVE-2021-3764EPSS 0.3%
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is…
- 5.5CVE-2021-3736EPSS 0.2%
A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information.
- 7.5CVE-2021-3690EPSS 1.8%
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.
- 5.5CVE-2022-36152EPSS 0.3%
tifig v0.2.2 was discovered to contain a memory leak via operator new[](unsigned long) at /asan/asan_new_delete.cpp.
- 6.5CVE-2022-35433EPSS 0.8%
ffjpeg commit caade60a69633d74100bd3c2528bddee0b6a1291 was discovered to contain a memory leak via /src/jfif.c.
- 5.5CVE-2022-35110EPSS 0.3%
SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
- 7.5CVE-2021-33646EPSS 2.0%
The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.
- 7.5CVE-2021-33645EPSS 2.0%
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.
- 8.2CVE-2022-1012EPSS 4.4%
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.
- 7.8CVE-2022-35858EPSS 0.4%
The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientO…
- 7.1CVE-2022-1651EPSS 0.3%
A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to leak unauthorized kernel i…
- 5.5CVE-2021-33452EPSS 0.3%
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c.
- 5.5CVE-2021-33451EPSS 0.3%
An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c.
- 5.5CVE-2021-33450EPSS 0.3%
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- 5.5CVE-2021-33437EPSS 0.3%
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c.
- 7.5CVE-2022-22209EPSS 1.0%
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network based attacker to cause a Denial of Service (DoS). On all Junos platforms, the Kernel Routing T…
- 7.5CVE-2022-22205EPSS 0.8%
A Missing Release of Memory after Effective Lifetime vulnerability in the Application Quality of Experience (appqoe) subsystem of the PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated network based attacker to cause …
- 5.3CVE-2022-22204EPSS 0.7%
An Improper Release of Memory Before Removing Last Reference vulnerability in the Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Juniper Networks Junos OS allows unauthenticated network-based attacker to cause a parti…
- 5.5CVE-2021-4135EPSS 0.2%
A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to ge…
- 7.1CVE-2022-26365EPSS 0.3%
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions befo…
- 7.5CVE-2021-41690EPSS 1.8%
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a m…
- 7.5CVE-2021-41687EPSS 1.8%
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker ca…
- 7.5CVE-2022-33105EPSS 3.1%
Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
- 7.5CVE-2021-41490EPSS 1.2%
Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.
- 8.8CVE-2021-40633EPSS 1.7%
A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.
- 7.5CVE-2021-35078EPSS 0.4%
Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdra…
- 7.5CVE-2018-17240EPSS 3.8%
There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password).
- 7.5CVE-2022-29693EPSS 1.3%
Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.
- 7.8CVE-2021-42197EPSS 1.2%
An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used. It allows an attacker to cause code execution.
- 7.5CVE-2022-29932EPSS 2.7%
The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request.
- 7.5CVE-2022-20785EPSS 7.1%
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104…
- 7.5CVE-2022-28487EPSS 2.0%
Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality.
- 7.5CVE-2021-42218EPSS 1.2%
OMPL v1.5.2 contains a memory leak in VFRRT.cpp
- 7.5CVE-2021-41959EPSS 1.2%
JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after RegExp, which causes a memory leak.
- 5.5CVE-2022-1515EPSS 0.7%
A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially result in DoS.
- 6.5CVE-2022-23159EPSS 0.6%
Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE and ISI_PRIV_AUTH_PROVIDERS privileges could ex…