CWE-131 · Incorrect Calculation of Buffer Size (page 2)
Page 2 of 3 — CVEs classified under CWE-131, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46729 | High | 7.8 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix incorrect size calculation for loop [WHY] fe_clk_en has size of 5 bu… |
CVE-2024-46684 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined create_elf_fdpic_t… |
CVE-2024-39808 | Medium | 4.6 | 2024-09-11 | Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Con… |
CVE-2024-45287 | High | 7.5 | 2024-09-05 | A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the par… |
CVE-2022-48889 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof-nau8825: fix module alias overflow The maximum name length for a platfor… |
CVE-2024-43843 | High | 7.8 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix out-of-bounds issue when preparing trampoline image We get the size of th… |
CVE-2024-42259 | High | 7.8 | 2024-08-14 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of t… |
CVE-2024-5000 | High | 7.5 | 2024-06-04 | An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorr… |
CVE-2024-30405 | High | 7.5 | 2024-04-12 | An Incorrect Calculation of Buffer Size vulnerability in Juniper Networks Junos OS SRX 5000 Series devices using SPC2 line cards while ALGs are enabled allows… |
CVE-2024-26752 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid acco… |
CVE-2024-26721 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address Commit bd077259d0… |
CVE-2024-27237 | Medium | 5.5 | 2024-03-11 | In wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local information disclos… |
CVE-2023-52558 | High | 7.5 | 2024-03-01 | In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after r… |
CVE-2023-52557 | High | 7.5 | 2024-03-01 | In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length. |
CVE-2023-50736 | Critical | 9.0 | 2024-02-28 | A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker t… |
CVE-2021-46943 | High | 7.8 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: media: staging/intel-ipu3: Fix set_fmt error handling If there in an error during a set_f… |
CVE-2024-23606 | Critical | 9.8 | 2024-02-20 | An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A special… |
CVE-2024-23805 | High | 7.5 | 2024-02-14 | Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when… |
CVE-2023-6387 | High | 7.5 | 2024-02-02 | A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execu… |
CVE-2023-6780 | Medium | 5.3 | 2024-01-31 | An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue… |
CVE-2024-23622 | Critical | 10.0 | 2024-01-26 | A stack-based buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerabilit… |
CVE-2024-23621 | Critical | 10.0 | 2024-01-26 | A buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerability to achieve… |
CVE-2023-5941 | Critical | 9.8 | 2023-11-08 | In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not c… |
CVE-2023-45871 | High | 7.5 | 2023-10-15 | An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for… |
CVE-2023-4257 | High | 7.6 | 2023-10-13 | Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. |
CVE-2023-20798 | Medium | 4.4 | 2023-08-07 | In pda, there is a possible out of bounds read due to an incorrect calculation of buffer size. This could lead to local information disclosure with System exec… |
CVE-2023-36824 | High | 7.4 | 2023-07-11 | Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some ca… |
CVE-2023-30575 | Medium | 6.5 | 2023-06-07 | Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowi… |
CVE-2023-2687 | Low | 2.9 | 2023-06-02 | Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap. |
CVE-2023-24819 | Critical | 9.8 | 2023-04-24 | RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 20… |
CVE-2022-33211 | Critical | 9.8 | 2023-04-13 | memory corruption in modem due to improper check while calculating size of serialized CoAP message |
CVE-2022-25731 | High | 7.5 | 2023-04-13 | Information disclosure in modem due to buffer over-read while processing packets from DNS server |
CVE-2023-20627 | Medium | 6.7 | 2023-03-07 | In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2023-1175 | Medium | 6.6 | 2023-03-04 | Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. |
CVE-2023-0568 | High | 7.5 | 2023-02-16 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths… |
CVE-2022-4378 | High | 7.8 | 2023-01-05 | A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local… |
CVE-2022-32651 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32650 | Medium | 6.7 | 2023-01-03 | In mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32649 | Medium | 6.7 | 2023-01-03 | In jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. Use… |
CVE-2022-32630 | Medium | 6.7 | 2022-12-05 | In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sy… |
CVE-2022-32624 | Medium | 6.7 | 2022-12-05 | In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sy… |
CVE-2022-41907 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have pa… |
CVE-2022-41887 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` i… |
CVE-2022-41886 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have p… |
CVE-2022-41885 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patc… |
CVE-2022-31630 | Medium | 6.5 | 2022-11-14 | In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file… |
CVE-2022-32618 | Medium | 6.8 | 2022-11-08 | In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an atta… |
CVE-2022-32617 | Medium | 6.8 | 2022-11-08 | In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an atta… |
CVE-2022-39377 | High | 7.0 | 2022-11-08 | sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_stru… |
CVE-2022-43945 | High | 7.5 | 2022-11-04 | The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD t… |
CVE-2022-26474 | Medium | 6.7 | 2022-10-07 | In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sys… |
CVE-2021-35134 | High | 8.4 | 2022-09-02 | Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivit… |
CVE-2022-2520 | Medium | 6.5 | 2022-08-31 | A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a craft… |
CVE-2021-4155 | Medium | 5.5 | 2022-08-24 | A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker coul… |
CVE-2022-2873 | Medium | 5.5 | 2022-08-22 | An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA… |
CVE-2021-38435 | Medium | 6.6 | 2022-05-05 | RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a b… |
CVE-2021-38423 | Medium | 6.6 | 2022-05-05 | All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow. |
CVE-2022-22137 | Medium | 6.5 | 2022-05-03 | A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to… |
CVE-2021-4206 | High | 8.2 | 2022-04-29 | A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor o… |
CVE-2021-44510 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause a calculation of the size of… |
CVE-2021-40052 | High | 7.5 | 2022-03-10 | There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect availability. |
CVE-2021-40048 | High | 7.5 | 2022-03-10 | There is an incorrect buffer size calculation vulnerability in the video framework. Successful exploitation of this vulnerability will affect availability. |
CVE-2021-40526 | Medium | 4.8 | 2021-10-25 | Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack t… |
CVE-2020-36475 | High | 7.5 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limi… |
CVE-2021-22415 | High | 7.5 | 2021-08-02 | There is an Incorrect Calculation of Buffer Size Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause kernel exceptions w… |
CVE-2021-22392 | High | 7.5 | 2021-08-02 | There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause verification bypass and direction… |
CVE-2021-22391 | High | 7.5 | 2021-08-02 | There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. |
CVE-2021-21793 | High | 8.8 | 2021-07-08 | An out-of-bounds write vulnerability exists in the JPG sof_nb_comp header processing functionality of Accusoft ImageGear 19.8 and 19.9. A specially crafted mal… |
CVE-2021-21824 | Critical | 9.8 | 2021-06-11 | An out-of-bounds write vulnerability exists in the JPG Handle_JPEG420 functionality of Accusoft ImageGear 19.9. A specially crafted malformed file can lead to… |
CVE-2020-11240 | High | 7.8 | 2021-06-09 | Memory corruption due to ioctl command size was incorrectly set to the size of a pointer and not enough storage is allocated for the copy of the user argument… |
CVE-2021-3491 | High | 7.8 | 2021-06-04 | The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being u… |
CVE-2021-29608 | Medium | 5.3 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.RaggedTensorToTensor`, an attacker can exploit… |
CVE-2021-29545 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in converting sparse tens… |
CVE-2021-29542 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow by passing crafted inputs to `tf.raw_ops.St… |
CVE-2021-29537 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `QuantizedResizeBilinear` by passing in… |
CVE-2021-29536 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `QuantizedReshape` by passing in invalid… |
CVE-2021-29535 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `QuantizedMul` by passing in invalid thr… |
CVE-2021-29529 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in `tf.raw_ops.QuantizedResizeBilinear` b… |
CVE-2021-29521 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a s… |
CVE-2021-0254 | Critical | 9.8 | 2021-04-22 | A buffer size validation vulnerability in the overlayd service of Juniper Networks Junos OS may allow an unauthenticated remote attacker to send specially craf… |
CVE-2021-21782 | High | 8.8 | 2021-03-31 | An out-of-bounds write vulnerability exists in the SGI format buffer size processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed fi… |
CVE-2021-21776 | High | 8.8 | 2021-03-31 | An out-of-bounds write vulnerability exists in the SGI Format Buffer Size Processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed fi… |
CVE-2021-21773 | High | 7.8 | 2021-03-31 | An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file ca… |
CVE-2021-28039 | Medium | 6.5 | 2021-03-05 | An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom… |
CVE-2021-27378 | Critical | 9.8 | 2021-02-18 | An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random… |
CVE-2020-13585 | High | 8.8 | 2021-02-10 | An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead… |
CVE-2020-13546 | High | 7.8 | 2021-02-10 | In SoftMaker Software GmbH SoftMaker Office TextMaker 2021 (revision 1014), a specially crafted document can cause the document parser to miscalculate a length… |
CVE-2020-17087 | High | 7.8 | 2020-11-11 | Windows Kernel Local Elevation of Privilege Vulnerability |
CVE-2020-1680 | Medium | 5.3 | 2020-10-16 | On Juniper Networks MX Series with MS-MIC or MS-MPC card configured with NAT64 configuration, receipt of a malformed IPv6 packet may crash the MS-PIC component… |
CVE-2020-6108 | High | 7.8 | 2020-10-15 | An exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem… |
CVE-2020-6106 | Medium | 5.5 | 2020-10-15 | An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted fi… |
CVE-2020-6116 | High | 7.8 | 2020-09-17 | An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a… |
CVE-2020-6113 | High | 7.8 | 2020-09-17 | An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-referenc… |
CVE-2020-14385 | Medium | 5.5 | 2020-09-15 | A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable ext… |
CVE-2020-3640 | High | 7.8 | 2020-09-08 | u'Resizing the usage table header before passing all the checks leads to the function exiting with a usage table in invalid state when a HLOS adversary calls t… |
CVE-2020-6070 | High | 7.8 | 2020-08-10 | An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a log… |
CVE-2020-15350 | Critical | 9.8 | 2020-07-07 | RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the requir… |
CVE-2020-11901 | Critical | 9.0 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. |
CVE-2019-14078 | High | 7.8 | 2020-06-02 | Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-19282 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd3), SIMATIC BATCH V… |