Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
560 results · Feed
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Task Scheduler Information Disclosure Vulnerability
Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Spaceport.sys Information Disclosure Vulnerability
Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.
-
Medium 5.7
Windows Management Instrumentation Information Disclosure Vulnerability
Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network.
-
Medium 6.5
FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_in…
-
High 8.8
Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary cod…
-
Medium 4.3
Gvfs: sftp: uninitialized heap disclosure in read_string()
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the…
-
Medium 6.5
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read me…
-
Medium 4.3
Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read m…
-
Medium 6.5
Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potent…
-
Medium 6.5
Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read me…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the…
-
Medium 4.3
Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social eng…
-
Medium 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass…
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised t…
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obta…
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outsid…
-
Medium 6.5
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain…
-
Medium 6.5
Uninitialized resource in Video in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised th…
-
Low 3.1
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the…
-
Medium 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origi…
-
Medium 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origi…
-
Low 3.1
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the…
-
Medium 4.3
OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure
OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a…
-
Medium 6.5
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.
-
Medium 5.8
Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty c…
-
Medium 5.9
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.
-
Medium 5.5
Kernel stack disclosure via timer_settime(2)
To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the un…
-
Medium 5.5
Kernel stack disclosure in 32-bit compatibility support
The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive infor…
-
Medium 5.5
Kernel stack disclosure in Linux compatibility layer
The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive i…
-
Low 3.3
Remote DOS via uninitialized memory access in KTLS receive
When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entrie…
-
Medium 4.3
libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is ca…
-
Low 3.1
Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had comprom…
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.
-
Medium 5.3
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences t…
-
Low 0.5
PAN-OS: Information Disclosure Vulnerability in URL Filtering
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability.
-
Medium 5.5
Microsoft Excel Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
-
Medium 5.5
Windows GDI+ Information Disclosure Vulnerability
Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.