Weakness (CWE)
CWE-122: Heap-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the heap.
How to prevent it (7 mitigations)
-
Pre-design: Use a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
-
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
Source: MITRE CWE-122
4,090 results · Feed
-
High 7.8
The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted P…
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
-
High 7.8
Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in …
-
High 7.8
Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in t…
-
High 8.8
A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted java…
-
Medium 4.3
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines…
-
Critical 9.6
Usb bluetooth device ACL read cb buffer overflow
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.0
Windows Bind Filter Driver Elevation of Privilege Vulnerability
Windows Bind Filter Driver Elevation of Privilege Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
Medium 6.6CVE-2023-21560 Public exploit
Windows Boot Manager Security Feature Bypass Vulnerability
Windows Boot Manager Security Feature Bypass Vulnerability
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Critical 9.8
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-bran…
-
Critical 9.8
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4…
-
Critical 9.8
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A…
-
High 8.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageI…
-
High 8.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageI…
-
High 8.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageI…
-
High 8.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageI…
-
High 8.1
Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Projec…
-
High 8.1
Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Projec…
-
Medium 6.5
Heap buffer overflow in pjproject when decoding STUN message
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a cert…
-
Medium 6.5
PJSIP vulnerable to heap buffer overflow when decoding STUN message
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown att…
-
Medium 6.3
Axiomatic Bento4 mp42aac heap-based overflow
A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remot…
-
High 8.6
A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when c…