CWE-131 Incorrect Calculation of Buffer Size
baseThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (349)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-17087US | high7.2OT critical | KEV | ||
Windows Kernel Local Elevation of Privilege Vulnerability | ||||
| CVE-2015-0235US | high10.0 | Exploit | ||
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code… | ||||
| CVE-2011-4862US | high10.0 | Exploit | ||
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU… | ||||
| CVE-2023-36824US | high8.8 | — | ||
Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap o… | ||||
| CVE-2005-3120US | critical9.8 | Exploit | ||
Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian chara… | ||||
| CVE-2003-0899US | critical9.8 | Exploit | ||
Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger t… | ||||
| CVE-2005-2103US | critical9.8 | Exploit | ||
Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an a… | ||||
| CVE-2020-8450US | high7.3 | — | ||
An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. | ||||
| CVE-2020-6113US | high7.8 | — | ||
An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When process… | ||||
| CVE-2004-0571US | high10.0 | — | ||
Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file se… | ||||
| CVE-2001-0249US | critical9.8 | — | ||
Heap overflow in FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to generate… | ||||
| CVE-2020-11901US | critical9.0OT elevated | — | ||
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. | ||||
| CVE-2018-14618US | critical9.8 | — | ||
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password… | ||||
| CVE-2008-0599US | critical9.8 | — | ||
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might… | ||||
| CVE-2004-0940US | high7.8 | Exploit | ||
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via S… | ||||
| CVE-2001-0248US | critical9.8 | — | ||
Buffer overflow in FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate… | ||||
| CVE-2016-0749US | critical9.8 | — | ||
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connectin… | ||||
| CVE-2004-1363US | critical9.8 | — | ||
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check… | ||||
| CVE-2004-0434US | critical9.8 | — | ||
k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2, which le… | ||||
| CVE-2024-45490US | high7.5 | Exploit | ||
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan