CWE-415 Double Free
variantThe product calls free() twice on the same memory address.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (1208)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-33824US | —OT kritisch | KEV | ||
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-62215US | —OT kritisch | KEV | ||
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2021-22600US | high7.0OT kritisch | KEV | ||
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgr… | ||||
| CVE-2021-26411US | medium5.1OT kritisch | KEV | ||
Internet Explorer Memory Corruption Vulnerability | ||||
| CVE-2020-9859US | high7.8OT kritisch | KEV | ||
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6… | ||||
| CVE-2020-6820US | high8.1OT kritisch | KEV | ||
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerab… | ||||
| CVE-2018-4990US | high8.8OT kritisch | KEV | ||
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation c… | ||||
| CVE-2014-0502US | high8.8OT kritisch | KEV | ||
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR b… | ||||
| CVE-2015-0359US | high10.0 | Exploit | ||
Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to e… | ||||
| CVE-2018-0101US | critical10.0 | Exploit | ||
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause… | ||||
| CVE-2003-0545US | critical9.8 | — | ||
Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a cer… | ||||
| CVE-2023-25136US | medium6.5 | Exploit | ||
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unaut… | ||||
| CVE-2002-0048US | high10.0 | Exploit | ||
Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service an… | ||||
| CVE-2019-11932US | high8.8 | Exploit | ||
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.… | ||||
| CVE-2007-0046US | high7.5 | Exploit | ||
Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error… | ||||
| CVE-2006-5051US | high8.1 | Exploit | ||
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is en… | ||||
| CVE-2019-8044US | critical9.8 | Exploit | ||
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 20… | ||||
| CVE-2019-1144US | high9.3 | Exploit | ||
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerabi… | ||||
| CVE-2018-5379US | critical9.8 | — | ||
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A suc… | ||||
| CVE-2021-0397US | critical9.8 | Exploit | ||
In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileg… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan