Weakness (CWE)
CWE-122: Heap-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the heap.
How to prevent it (7 mitigations)
-
Pre-design: Use a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
-
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
Source: MITRE CWE-122
2,892 results · Clear filters · Feed
-
High 7.8CVE-2020-24435 EPSS 53%
Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code Execution
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in …
-
High 8.5
Heap buffer overflow in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern. It is possible for `reverse_index_map(i)` to be an index outside of bounds of `grad_values`, thus resulting in…
-
High 8.5
Heap buffer overflow in Tensorflow
In Tensorflow version 2.3.0, the `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same shape as the data. The check exists for `DenseCountSparseOutput`, where both tensors are fully speci…
-
High 8.8CVE-2020-6146 EPSS 75%
An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.…
-
High 7.7
Heap buffer overflow in libIEC61850
In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remo…
-
High 7.8
DaviewIndy Heap-based Buffer Overflow Vulnerability
DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
-
High 7.8
DaviewIndy Heap-based Buffer Overflow Vulnerability
DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
-
High 8.4
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R67…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.…
-
High 7.7
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2…
-
High 7.9
Broadcom wl driver is vulnerable to heap buffer overflow
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by sending specially-crafted WiF…
-
High 7.9
Broadcom wl driver is vulnerable to heap buffer overflow
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap buffer overflow is triggered in wlc_wpa_sup_eapol. In the worst case scenario, by sending specially-…
-
High 7.9
Broadcom brcmfmac driver is vulnerable to a heap buffer overflow
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffe…
-
High 8.8
An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20.0.2019.3.15. A …
-
High 8.8CVE-2019-14901 EPSS 16%
A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip dr…
-
High 8.0
A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell…
-
High 7.8
A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip d…
-
High 7.8
A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marv…
-
High 8.8
An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20. A specially cr…
-
High 8.8
A buffer overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Docu…
-
High 8.8
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document i…
-
High 8.8
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory …
-
High 8.8
A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory …
-
High 8.8
A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document i…
-
High 7.5
An exploitable command execution vulnerability exists in the ASN1 certificate writing functionality of Openweave-core v…
-
High 8.8
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A spec…
-
High 8.8
An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A spec…
-
High 7.2CVE-2019-10192 EPSS 26%
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x …
-
High 8.0
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel modu…
-
High 7.8CVE-2019-5436 EPSS 50%
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4…
-
High 7.8
DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malfor…
-
High 7.8
DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malfor…
-
High 8.8
A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server …
-
High 7.5
A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulne…
-
High 7.5
An issue has been found in libIEC61850 v1.3. It is a SEGV in ControlObjectClient_setCommandTerminationHandler in client…
-
High 8.1
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap proble…
-
High 7.6
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames…
-
High 7.5CVE-2018-14618 EPSS 11%
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Cur…
-
High 7.8
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too smal…
-
High 7.5
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker cou…