Weakness (CWE)
CWE-823: Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
More detail
The offset might be out-of-range if it comes from an untrusted source, is the result of an incorrect calculation, or occurs because of another error.
If an attacker can control or influence the offset so that it points outside of the intended boundaries of the structure, then the attacker may be able to read or write to memory locations that are used elsewhere in the product. As a result, the attack might change the state of the product as accessed through program variables, cause a crash or instable behavior, and possibly lead to code execution.
Source: MITRE CWE-823
113 results · Feed
-
Critical 9.8
Use of Out-of-range Pointer Offset in Multi-mode Call Processor
Memory Corruption in Multi-mode Call Processor while processing bit mask API.
-
High 8.6
SQUID-2023:4 Denial of Service in SSL Certificate validation
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…
-
Critical 9.8
Use of Out-of-range Pointer Offset in Modem
Memory corruption in Modem while processing security related configuration before AS Security Exchange.
-
High 8.6
A vulnerability in the Multicast Leaf Recycle Elimination (mLRE) feature of Cisco IOS XE Software for Cisco ASR 1000 Se…
-
High 7.8
Use of Out-of-range Pointer Offset in WLAN HAL
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
-
Medium 6.7
Multiple Type Confusion Vulnerability
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
-
High 7.8
Use of Out-of-range Pointer Offset in Qualcomm IPC
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
-
Medium 6.5
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC…
-
Medium 6.5
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC…
-
Medium 6.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
-
High 8.4
Use of Out-of-range Pointer Offset in Data Modem
Memory corruption in modem due to use of out of range pointer offset while processing qmi msg
-
High 8.4
Use of Out-of-range Pointer Offset in MODEM
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
-
Medium 6.7
Use of out-of-range pointer offset in Audio
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
-
Medium 5.0
A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645. A specially-craf…
-
High 7.1
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular us…
-
High 8.1
CODESYS runtime system prone to denial of service due to use of out of range pointer
Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local mem…
-
Medium 5.0
An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. A specially-craf…
-
Medium 6.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
-
High 7.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
-
High 8.4
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
-
High 8.4
Use of Out-of-range Pointer Offset in mruby/mruby
Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
-
High 8.4
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
-
High 8.1
CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
-
High 7.1
Use of Out-of-range Pointer Offset in bfabiszewski/libmobi
libmobi is vulnerable to Use of Out-of-range Pointer Offset
-
High 7.1
Use of Out-of-range Pointer Offset in bfabiszewski/libmobi
libmobi is vulnerable to Use of Out-of-range Pointer Offset
-
Medium 6.5
Enclave memory overwrite/overread vulnerability in Asylo UntrustedCacheMalloc::GetBuffer
An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
-
Medium 6.5
Arbitrary enclave memory overwrite vulnerability in Asylo TrustedPrimitives::UntrustedCall
An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
-
High 8.1
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…
-
High 7.4
Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability
A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient i…
-
High 7.5
A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic …
-
High 8.8CVE-2020-6112 EPSS 17%
An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc…
-
Medium 6.4
Arbitrary trusted memory overwrite vulnerability in Asylo
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to…
-
Unscored —CVE-2016-2161 EPSS 21%
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and e…