Weakness (CWE)
CWE-193: Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
How to prevent it (1 mitigation)
-
Implementation
When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
Source: MITRE CWE-193
169 results · Feed
-
Medium 5.5
crypto: qat/qat_420xx - fix off by one in uof_get_name()
In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_420xx - fix off by one in uof_get_name() This is called from uof_get_name_420xx() where "num_objs" is the ARRAY_SIZE() of fw_objs[]. The > needs to be >= to prevent an out of …
-
Critical 9.1
off-by-one-error
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
-
Medium 5.3
Suricata defrag: off by one can lead to policy bypass
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft pac…
-
High 8.2
bhyve(8) privileged guest escape via USB controller
An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privileged software running in a guest VM can exploit the vulnerability to achieve code execution on the hos…
-
High 7.5
An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash th…
-
Critical 9.8
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to …
-
High 7.5
Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, bec…
-
High 7.8CVE-2023-44444 EPSS 56%
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must vi…
-
Medium 5.3
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum…
-
Medium 5.5CVE-2024-1441 Public exploit
Libvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an u…
-
Medium 5.5
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RD…
-
High 7.5
Vyper has incorrect storage layout for contracts containing large arrays
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable neede…
-
Medium 6.3
Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
-
High 7.1
Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver
Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
-
Low 2.2
Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64
Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is l…
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
-
Critical 9.8
Contiki-NG has off-by-one error in Antelope DBMS
Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contiki-NG operating system in versions 4.8 and prior. The problem exists in the Contiki File System (CFS)…
-
Low 3.7
redis-py Race Condition vulnerability
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to …
-
Low 3.1
wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64
wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the in…
-
High 7.1
Off-by-one Error in gpac/gpac
Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.
-
Medium 5.3
A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.…
-
High 7.5
An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause …
-
Medium 5.9
Read one byte past a buffer when normalizing Unicode
Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any t…
-
Medium 5.5
An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could sup…
-
High 8.6
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Po…
-
Critical 9.1
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
-
High 7.8
off-by-one in io_uring module.
-
High 7.8
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when t…
-
Unscored —
An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an att…
-
High 7.1
A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft Imag…
-
Critical 9.8
A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. …
-
Medium 5.9
Off-by-one Error in v2fly/v2ray-core
Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.
-
Unscored —
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT command…
-
Critical 9.8
Buffer Overflow in galois_2p8
In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2…
-
Unscored —
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from …
-
Low 2.5
Heap buffer overflow caused by rounding
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` by manipulating input values so that float rounding results in off-by-one error in accessing image el…
-
High 7.8
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privileg…
KEV Apr 6, 2022 -
Critical 9.1
Out of bounds read in simple-slab
An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.
-
Critical 9.8
OFF-BY-ONE ERROR CWE-193
GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.