Fallos del tipo CWE-193

109 resultados

Erro de índice por um (Off-by-One)

Ocorre quando a lógica de um loop ou acesso a array usa um índice incorreto — geralmente começando em 0 quando deveria começar em 1, ou iterando até N quando deveria parar em N-1. O resultado é acesso a posições inválidas de memória, leitura/escrita fora dos limites do buffer, ou skip de um elemento legítimo, criando brechas de segurança e crashes.

Ejemplo

Um loop que processa 10 elementos de um array mas itera de 0 a 10 (incluindo 10) tenta acessar posição 10 que não existe; ou um validador que checa strings até tamanho N mas esquece o caractere final, deixando dados não validados. Ataques exploram isso para corrupção de heap, escape de sandbox ou leitura de memória sensível.

Cómo mitigar

Use iteradores de linguagem de alto nível (for-each, ranges) que abstraem índices; ao usar índices explícitos, teste sempre com boundary values (tamanho-1, tamanho, tamanho+1); aplique assertions e sanitização rigorosa em loops críticos; prefira bibliotecas que fazem bounds-checking automático.

CVE-2021-3156HIGHSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root EPSS 99.3%KEVCVE-2023-44444HIGHGIMP PSP File Parsing Off-By-One Remote Code Execution VulnerabilityEPSS 56.4%CVE-2021-23017—A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cauEPSS 53.5%CVE-2023-28709—Apache Tomcat: Fix for CVE-2023-24998 is incompleteEPSS 49.9%CVE-2002-1816CRITICALOff-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrarEPSS 9.0%CVE-2006-4574HIGHOff-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a dEPSS 4.2%CVE-2019-8272—UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attaEPSS 3.9%CVE-2019-8268—UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadStrEPSS 3.9%CVE-2020-10062CRITICALPacket length decoding error in MQTTEPSS 2.9%CVE-2020-14510CRITICALOFF-BY-ONE ERROR CWE-193EPSS 2.5%CVE-1999-1568HIGHOff-by-one error in NcFTPd FTP server before 2.4.1 allows a remote attacker to cause a denial of service (crash) via a long PORT command.EPSS 2.3%CVE-2024-36136HIGHAn off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting EPSS 2.2%CVE-2021-46848CRITICALGNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.EPSS 2.1%CVE-2020-14508HIGHOFF-BY-ONE ERROR CWE-193EPSS 2.0%CVE-2021-21938CRITICALA heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted fEPSS 1.8%CVE-2022-47517HIGHAn issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (EPSS 1.5%CVE-2024-10442CRITICALOff-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 aEPSS 1.3%CVE-2019-10131MEDIUMAn off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.cEPSS 1.3%CVE-2020-27793—An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crasEPSS 0.9%CVE-2024-38441CRITICALNetatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in EPSS 0.9%