Weakness (CWE)
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
How to prevent it (5 mitigations)
-
Implementation
Ensure that critical variables are initialized before first use [REF-1485].
-
Build and Compilation
Most compilers will complain about the use of uninitialized variables if warnings are turned on.
-
Implementation, Operation
When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.
-
Requirements
Choose a language that is not susceptible to these issues.
-
Architecture and Design
Mitigating technologies such as safe string libraries and container abstractions could be introduced.
Source: MITRE CWE-457
13 results · Clear filters · Feed
-
Critical 9.4
SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messa…
-
Critical 9.1
Uninitialized memory in MIME parsing
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
-
Critical 9.6
Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to …
-
Critical 9.8
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn object with kme…
-
Critical 9.6
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code ins…
-
Critical 9.8
batman-adv: tp_meter: avoid use of uninit sender vars
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER …
-
Critical 9.8
Uninitialized memory in the Audio/Video: Web Codecs component
Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
-
Critical 9.1
Uninitialized memory in the Graphics: Text component
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
-
Critical 9.8
OpenBSD NFS double-free vulnerability
In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.
-
Critical 9.8
HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.
-
Critical 9.8
Buffer copy without checking size of input in Audio.
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
-
Critical 9.1
An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_201211…
-
Critical 9.8CVE-2021-40418 EPSS 18%
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assi…