Weakness (CWE)
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource.
How to prevent it (6 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-665
178 results · Feed
-
High 7.5
Junos OS: PTX1000 and PTX10000 Series, QFX10000 Series using non-AFT architectures: A specific genuine packet inspected by sFlow will cause a reboot.
This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface (AFI) / Advanced Forwarding Toolkit (AFT). Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packe…
-
High 8.1
Code execution vulnerability in HtmlUnit
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specif…
-
Unscored —
LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, whic…
-
Critical 9.8
Moby Docker cp broken with debian containers
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
-
High 8.6
Cisco Prime Network Registrar Denial of Service Vulnerability
A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to restart the server and cause a denial of service (DoS) condition on the affected system. The vulnerability is due to incom…
-
Medium 4.3
Cisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak Vulnerability
A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to receive potentially sensitive information from an affected device. The vulnerability is due to insufficie…
-
Unscored —
UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read st…
-
Unscored —
UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read sta…
-
Medium 5.3CVE-2018-14647 EPSS 11%
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it eas…
-
High 8.5
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its inte…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.…
-
High 7.8
A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the pre…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.…
-
Low 2.3
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and …
-
Medium 6.5
curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good …
-
Medium 6.5CVE-2013-1675 Exploited
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before…
KEV Mar 3, 2022