CWE-908: Use of Uninitialized Resource, page 18

The product uses or accesses a resource that has not been initialized.

What the weakness is: CWE-908 at MITRE

1. 9.8CVE-2019-15900EPSS 2.1%2019-10-18

   An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in …

2. 8.2CVE-2019-17533EPSS 1.7%2019-10-13

   Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

3. 7.5CVE-2019-16866EPSS 3.5%2019-10-03

   Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.

4. 6.5CVE-2019-9416EPSS 0.7%2019-09-27

   In libstagefright there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: …

5. 6.5CVE-2019-9415EPSS 0.7%2019-09-27

   In libstagefright there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: …

6. 6.5CVE-2019-9411EPSS 0.7%2019-09-27

   In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

7. 6.5CVE-2019-9410EPSS 0.7%2019-09-27

   In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

8. 6.5CVE-2019-9409EPSS 0.7%2019-09-27

   In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android…

9. 6.5CVE-2019-9408EPSS 0.7%2019-09-27

   In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

10. 6.5CVE-2019-9406EPSS 0.7%2019-09-27

    In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android…

11. 6.5CVE-2019-9391EPSS 0.6%2019-09-27

    In libxaac, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: …

12. 5.5CVE-2019-9369EPSS 0.1%2019-09-27

    In Bluetooth, there is a use of uninitialized variable. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10An…

13. 6.5CVE-2019-9361EPSS 0.7%2019-09-27

    In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

14. 6.5CVE-2019-9359EPSS 0.7%2019-09-27

    In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

15. 6.5CVE-2019-9338EPSS 0.8%2019-09-27

    In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

16. 6.5CVE-2019-9337EPSS 0.8%2019-09-27

    In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

17. 6.5CVE-2019-9336EPSS 0.8%2019-09-27

    In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

18. 6.5CVE-2019-9335EPSS 0.8%2019-09-27

    In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

19. 6.5CVE-2019-9334EPSS 0.7%2019-09-27

    In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android…

20. 7.5CVE-2019-9329EPSS 0.5%2019-09-27

    In Bluetooth, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure, with no additional privileges required. User interaction is not needed for exploitation. Product: AndroidVers…

21. 6.5CVE-2019-9322EPSS 0.7%2019-09-27

    In libavc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidV…

22. 6.5CVE-2019-2172EPSS 0.6%2019-09-27

    In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…

23. 6.5CVE-2019-2171EPSS 0.6%2019-09-27

    In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…

24. 6.5CVE-2019-2170EPSS 0.6%2019-09-27

    In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…

25. 6.5CVE-2019-2169EPSS 0.6%2019-09-27

    In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…

26. 6.5CVE-2019-2168EPSS 0.6%2019-09-27

    In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…

27. 6.5CVE-2019-2167EPSS 0.6%2019-09-27

    In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…

28. 6.5CVE-2019-2166EPSS 0.6%2019-09-27

    In libxaac there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersion…

29. 6.5CVE-2019-2140EPSS 0.6%2019-09-27

    In libxaac, there is a possible information disclosure due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersio…

30. 6.5CVE-2019-11750EPSS 1.3%2019-09-27

    A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

31. 9.8CVE-2019-5067EPSS 3.4%2019-09-18

    An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can cause a read and write from uninitialized memory, resulting in memory corruption and…

32. 5.5CVE-2019-1254EPSS 1.3%2019-09-11

    An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerability'.

33. 7.5CVE-2019-16144EPSS 1.6%2019-09-09

    An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.

34. 7.5CVE-2019-15553EPSS 1.8%2019-08-26

    An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.

35. 6.5CVE-2018-20992EPSS 1.4%2019-08-26

    An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.

36. 7.1CVE-2019-13220EPSS 1.0%2019-08-15

    Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.

37. 7.5CVE-2019-11694EPSS 1.5%2019-07-23

    A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information…

38. 5.3CVE-2019-1010299EPSS 1.5%2019-07-15

    The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait impleme…

39. 5.5CVE-2019-1010319EPSS 1.5%2019-07-11

    WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously c…

40. 5.5CVE-2019-1010317EPSS 1.5%2019-07-11

    WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously craft…

41. 5.5CVE-2019-2118EPSS 0.2%2019-07-08

    In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for explo…

42. 8.8CVE-2019-2105EPSS 0.7%2019-07-08

    In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User int…

43. 5.5CVE-2019-2104EPSS 0.2%2019-07-08

    In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not …

44. 8.8CVE-2019-13135EPSS 3.3%2019-07-01

    ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.

45. 5.3CVE-2019-13117EPSS 6.5%2019-07-01

    In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a…

46. 6.5CVE-2019-5818EPSS 1.6%2019-06-27

    Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.

47. 4.3CVE-2018-6132EPSS 0.9%2019-06-27

    Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.

48. 5.5CVE-2019-2004EPSS 0.2%2019-06-19

    In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local information disclosure with no additional execution privileges needed. User interaction is not need…

49. 5.3CVE-2019-11038EPSS 4.3%2019-06-19

    When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that w…

50. 9.8CVE-2019-7321EPSS 3.2%2019-06-13

    Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to execute arbitrary code.