Weakness (CWE)
CWE-124: Buffer Underwrite
The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
How to prevent it (2 mitigations)
-
Requirements
Choose a language that is not susceptible to these issues.
-
Implementation
All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.
Source: MITRE CWE-124
24 results · Clear filters · Feed
-
Medium 5.4
IBM MQ Appliance is affected by an improper validation vulnerability
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
-
Medium 5.6
ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-…
-
Medium 5.9
psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding paramete…
-
Medium 4.3
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an…
-
Medium 4.6
Vim: Out-of-bounds Access in Popup Opacity Handling
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead o…
-
Medium 6.7
OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations
OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt …
-
Medium 5.8
Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.
-
Medium 5.9
Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can…
-
Medium 4.6
Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker t…
-
Medium 6.5
Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function proc…
-
Medium 4.4
Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the star…
-
Medium 6.5
Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authenti…
-
Medium 6.1
A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9…
-
Medium 5.3
Vim has Heap-based Buffer Underflow in Emacs tags parsing
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts…
-
Medium 4.6
Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bound…
-
Medium 4.8
Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when th…
-
Medium 6.0
OpenPrinting CUPS vulnerable to stack based out-of-bound write
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which ru…
-
Medium 6.3
Wazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissions
Wazuh is a free and open source platform used for threat prevention, detection, and response. A heap-based out-of-bounds WRITE occurs in decode_win_permissions, resulting in writing a NULL byte 2 bytes before the start of the buffer allocated to decoded_it. A…
-
Medium 6.5
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of ser…
-
Medium 6.5
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of ser…
-
Medium 4.8
Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar
A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.
-
Medium 4.3
There is a buffer error vulnerability in some Huawei product. An unauthenticated attacker may send special UPNP message…
-
Medium 5.9
Cap'n Proto WebSocket message can cause crash
Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant val…
-
Medium 4.1
Buffer Underwrite in ares_inet_net_pton()
c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes wh…