CWE-190
AllowedInteger Overflow or Wraparound
Abstraction: Base · Status: Stable
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
3869 vulnerabilities reference this CWE, most recent first.
GHSA-JR2W-425Q-9MFC
Vulnerability from github – Published: 2022-05-17 01:17 – Updated: 2025-04-20 03:44Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow.
{
"affected": [],
"aliases": [
"CVE-2017-12797"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-29T15:29:00Z",
"severity": "MODERATE"
},
"details": "Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow.",
"id": "GHSA-jr2w-425q-9mfc",
"modified": "2025-04-20T03:44:03Z",
"published": "2022-05-17T01:17:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12797"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/mpg123/bugs/254"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/mpg123/mailman/message/35987663"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JR8X-23WG-CC7Q
Vulnerability from github – Published: 2022-04-29 02:58 – Updated: 2022-04-29 02:58Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file.
{
"affected": [],
"aliases": [
"CVE-2004-0788"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-10-20T04:00:00Z",
"severity": "MODERATE"
},
"details": "Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file.",
"id": "GHSA-jr8x-23wg-cc7q",
"modified": "2022-04-29T02:58:21Z",
"published": "2022-04-29T02:58:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0788"
},
{
"type": "WEB",
"url": "https://bugzilla.fedora.us/show_bug.cgi?id=2005"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17387"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10506"
},
{
"type": "WEB",
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000875"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17657"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2004/dsa-546"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/577654"
},
{
"type": "WEB",
"url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:095"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:214"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2004-447.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2004-466.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/419771/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/11195"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRQ6-66H3-57Q6
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01The mintToken function of a smart contract implementation for Numisma, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
{
"affected": [],
"aliases": [
"CVE-2018-13544"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-09T06:29:00Z",
"severity": "HIGH"
},
"details": "The mintToken function of a smart contract implementation for Numisma, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
"id": "GHSA-jrq6-66h3-57q6",
"modified": "2022-05-14T03:01:58Z",
"published": "2022-05-14T03:01:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13544"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/Numisma"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JRQH-QJ76-C265
Vulnerability from github – Published: 2022-05-14 03:19 – Updated: 2025-04-12 13:03Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.
{
"affected": [],
"aliases": [
"CVE-2016-5261"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-08-05T01:59:00Z",
"severity": "HIGH"
},
"details": "Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR \u003c 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.",
"id": "GHSA-jrqh-qj76-c265",
"modified": "2025-04-12T13:03:03Z",
"published": "2022-05-14T03:19:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5261"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1287266"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2016-86"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1912.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3674"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2016/mfsa2016-75.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92260"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036508"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3044-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JV4R-HC9X-R99X
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.
{
"affected": [],
"aliases": [
"CVE-2020-35198"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-12T11:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block\u0027s size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.",
"id": "GHSA-jv4r-hc9x-r99x",
"modified": "2022-05-24T19:02:16Z",
"published": "2022-05-24T19:02:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35198"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2020-35198"
},
{
"type": "WEB",
"url": "https://support2.windriver.com/index.php?page=security-notices"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JV6M-V86W-343P
Vulnerability from github – Published: 2026-04-24 15:32 – Updated: 2026-07-14 15:31In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix integer underflow in chain mode
The jumbo_frm() chain-mode implementation unconditionally computes
len = nopaged_len - bmax;
where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments):
is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);
When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware.
Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.
{
"affected": [],
"aliases": [
"CVE-2026-31649"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-24T15:16:44Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix integer underflow in chain mode\n\nThe jumbo_frm() chain-mode implementation unconditionally computes\n\n len = nopaged_len - bmax;\n\nwhere nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is\nBUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit()\ndecides to invoke jumbo_frm() based on skb-\u003elen (total length including\npage fragments):\n\n is_jumbo = stmmac_is_jumbo_frm(priv, skb-\u003elen, enh_desc);\n\nWhen a packet has a small linear portion (nopaged_len \u003c= bmax) but a\nlarge total length due to page fragments (skb-\u003elen \u003e bmax), the\nsubtraction wraps as an unsigned integer, producing a huge len value\n(~0xFFFFxxxx). This causes the while (len != 0) loop to execute\nhundreds of thousands of iterations, passing skb-\u003edata + bmax * i\npointers far beyond the skb buffer to dma_map_single(). On IOMMU-less\nSoCs (the typical deployment for stmmac), this maps arbitrary kernel\nmemory to the DMA engine, constituting a kernel memory disclosure and\npotential memory corruption from hardware.\n\nFix this by introducing a buf_len local variable clamped to\nmin(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then\nalways safe: it is zero when the linear portion fits within a single\ndescriptor, causing the while (len != 0) loop to be skipped naturally,\nand the fragment loop in stmmac_xmit() handles page fragments afterward.",
"id": "GHSA-jv6m-v86w-343p",
"modified": "2026-07-14T15:31:54Z",
"published": "2026-04-24T15:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31649"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/10d12b9240ebf96c785f0e2e4228318cd5f3a3eb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/275bdf762e82082f064e60a92448fa2ac43cf95b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c91b39912278d0878f9ba60ba04d2518b18a08d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/513e06735f5be575b409d195822195348b164e48"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51f4e090b9f87b40c21b6daadb5c06e6c0a07b67"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6fca757c20396dc2e604dcc61922264e9e3dc803"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b7b8012193fd98236d7ae05d4b553f010a77b2ef"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JV9J-WGX3-2884
Vulnerability from github – Published: 2022-05-14 01:05 – Updated: 2025-04-20 03:48Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
{
"affected": [],
"aliases": [
"CVE-2017-1000229"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-17T05:29:00Z",
"severity": "HIGH"
},
"details": "Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.",
"id": "GHSA-jv9j-wgx3-2884",
"modified": "2025-04-20T03:48:43Z",
"published": "2022-05-14T01:05:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000229"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00030.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201801-02"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/optipng/bugs/65"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4058"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JVJ8-3G49-F23W
Vulnerability from github – Published: 2026-01-13 15:37 – Updated: 2026-06-30 03:35Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, and Firefox ESR < 140.7.
{
"affected": [],
"aliases": [
"CVE-2026-0880"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-13T14:16:38Z",
"severity": "HIGH"
},
"details": "Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, and Firefox ESR \u003c 140.7.",
"id": "GHSA-jvj8-3g49-f23w",
"modified": "2026-06-30T03:35:25Z",
"published": "2026-01-13T15:37:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0880"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0667"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2073"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2074"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2220"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2231"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2271"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2286"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-0880"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2005014"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428975"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0880.json"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-01"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-02"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-03"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-04"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-05"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0694"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0924"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1320"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1413"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1414"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1415"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1471"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1487"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2043"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2044"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2047"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2069"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2070"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JVJ9-7HF6-7FR7
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04Buffer overflow might occur while parsing unified command due to lack of check of input data received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
{
"affected": [],
"aliases": [
"CVE-2020-11235"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T05:15:00Z",
"severity": "HIGH"
},
"details": "Buffer overflow might occur while parsing unified command due to lack of check of input data received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
"id": "GHSA-jvj9-7hf6-7fr7",
"modified": "2022-05-24T19:04:44Z",
"published": "2022-05-24T19:04:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11235"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JVM4-FPVM-VR72
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2025-11-25 18:32An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
{
"affected": [],
"aliases": [
"CVE-2018-12371"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-09T14:15:00Z",
"severity": "MODERATE"
},
"details": "An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR \u003c 60.1, Thunderbird \u003c 60, and Firefox \u003c 61.",
"id": "GHSA-jvm4-fpvm-vr72",
"modified": "2025-11-25T18:32:17Z",
"published": "2022-05-24T17:22:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12371"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1465686"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2018-15"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2018-16"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2018-19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- If possible, choose a language or compiler that performs automatic bounds checking.
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Mitigation MIT-8
Strategy: Input Validation
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Mitigation MIT-36
- Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
- Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-26
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.