Weakness (CWE)
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource.
How to prevent it (6 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-665
5 results · Clear filters · Feed
-
High 7.5CVE-2022-46505 Public exploit
An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the m…
-
Critical 9.4
Account takeover via prototype vulnerability
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patche…
-
High 7.8
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in co…
KEV Apr 25, 2022 -
Medium 5.5
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watc…
KEV Nov 3, 2021 -
Critical 9.8
Moby Docker cp broken with debian containers
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.