CWE-190
AllowedInteger Overflow or Wraparound
Abstraction: Base · Status: Stable
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
3867 vulnerabilities reference this CWE, most recent first.
GHSA-RWV3-2QP2-8CG5
Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to edit an object within a .blend library in their Scene in order to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-12082"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-24T19:29:00Z",
"severity": "HIGH"
},
"details": "An exploitable integer overflow exists in the \u0027CustomData\u0027 Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to edit an object within a .blend library in their Scene in order to trigger this vulnerability.",
"id": "GHSA-rwv3-2qp2-8cg5",
"modified": "2022-05-13T01:01:42Z",
"published": "2022-05-13T01:01:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12082"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4248"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0434"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RWVC-6FHR-C2Q7
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2023-06-12 09:30Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.
{
"affected": [],
"aliases": [
"CVE-2019-11484"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-08T05:15:00Z",
"severity": "MODERATE"
},
"details": "Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.",
"id": "GHSA-rwvc-6fhr-c2q7",
"modified": "2023-06-12T09:30:18Z",
"published": "2022-05-24T17:08:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11484"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/usn/usn-4170-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/usn/usn-4170-2"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXH4-5VQX-XJQ8
Vulnerability from github – Published: 2022-04-30 00:00 – Updated: 2022-05-11 00:02A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
{
"affected": [],
"aliases": [
"CVE-2021-4206"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-29T17:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.",
"id": "GHSA-rxh4-5vqx-xjq8",
"modified": "2022-05-11T00:02:03Z",
"published": "2022-04-30T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4206"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2036998"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-27"
},
{
"type": "WEB",
"url": "https://starlabs.sg/advisories/21-4206"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5133"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXHV-G2V6-5H3R
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01The mintToken function of a smart contract implementation for HitToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
{
"affected": [],
"aliases": [
"CVE-2018-13569"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-09T06:29:00Z",
"severity": "HIGH"
},
"details": "The mintToken function of a smart contract implementation for HitToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
"id": "GHSA-rxhv-g2v6-5h3r",
"modified": "2022-05-14T03:01:42Z",
"published": "2022-05-14T03:01:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13569"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/HitToken"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RXJ8-Q442-6JCQ
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflow, which in turn may cause tampering of data, information disclosure, or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).
{
"affected": [],
"aliases": [
"CVE-2021-1059"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-08T15:15:00Z",
"severity": "HIGH"
},
"details": "NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflow, which in turn may cause tampering of data, information disclosure, or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3).",
"id": "GHSA-rxj8-q442-6jcq",
"modified": "2022-05-24T17:38:23Z",
"published": "2022-05-24T17:38:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1059"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5142"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RXRQ-JHG2-4Q22
Vulnerability from github – Published: 2022-05-14 03:13 – Updated: 2022-05-14 03:13The mintToken function of a smart contract implementation for kBit, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
{
"affected": [],
"aliases": [
"CVE-2018-13746"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-09T06:29:00Z",
"severity": "HIGH"
},
"details": "The mintToken function of a smart contract implementation for kBit, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
"id": "GHSA-rxrq-jhg2-4q22",
"modified": "2022-05-14T03:13:26Z",
"published": "2022-05-14T03:13:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13746"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/kBit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RXXJ-RV84-8C37
Vulnerability from github – Published: 2025-04-16 15:34 – Updated: 2025-10-31 21:30In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix page_size variable overflow
Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the page_size and try to use an mkey with 4GB entity size. The 'unsigned int' page_size variable will overflow to '0' and we'll hit the WARN_ON() in alloc_cacheable_mr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Modules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core] CPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? __warn+0x81/0x130 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] ? report_bug+0xfc/0x1e0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] create_real_mr+0x54/0x150 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs] ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs] ? walk_system_ram_range+0x79/0xd0 ? pteoffset_map+0x1b/0x110 ? pte_offset_map_lock+0x80/0x100 ib_uverbs_ioctl+0xac/0x110 [ib_uverbs] __x64_sys_ioctl+0x94/0xb0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150
{
"affected": [],
"aliases": [
"CVE-2025-22091"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T15:16:03Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix page_size variable overflow\n\nChange all variables storing mlx5_umem_mkc_find_best_pgsz() result to\nunsigned long to support values larger than 31 and avoid overflow.\n\nFor example: If we try to register 4GB of memory that is contiguous in\nphysical memory, the driver will optimize the page_size and try to use\nan mkey with 4GB entity size. The \u0027unsigned int\u0027 page_size variable will\noverflow to \u00270\u0027 and we\u0027ll hit the WARN_ON() in alloc_cacheable_mr().\n\nWARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib]\nModules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core]\nCPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43\nTainted: [W]=WARN\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib]\nCode: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 \u003c0f\u003e 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41\nRSP: 0018:ffffc900006ffac8 EFLAGS: 00010246\nRAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001\nRDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600\nRBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000\nR10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240\nR13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00\nFS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __warn+0x81/0x130\n ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib]\n ? report_bug+0xfc/0x1e0\n ? handle_bug+0x55/0x90\n ? exc_invalid_op+0x17/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib]\n create_real_mr+0x54/0x150 [mlx5_ib]\n ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs]\n ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs]\n ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs]\n ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]\n ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs]\n ? walk_system_ram_range+0x79/0xd0\n ? ___pte_offset_map+0x1b/0x110\n ? __pte_offset_map_lock+0x80/0x100\n ib_uverbs_ioctl+0xac/0x110 [ib_uverbs]\n __x64_sys_ioctl+0x94/0xb0\n do_syscall_64+0x50/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fb7ecf0737b\nCode: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48\nRSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b\nRDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003\nRBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4\nR10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4\nR13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150\n \u003c/TASK\u003e",
"id": "GHSA-rxxj-rv84-8c37",
"modified": "2025-10-31T21:30:56Z",
"published": "2025-04-16T15:34:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22091"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/01fd737776ca0f17a96d83cd7f0840ce130b9a02"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/05b215d5e219c0228b9c7082ba9bcf176c576646"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e0c09f639ca0e102f250df8787740c2013e9d1b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f0c2427412b43cdf1b7b0944749ea17ddb97d5a5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V25X-FRPW-QG4X
Vulnerability from github – Published: 2022-05-03 03:18 – Updated: 2022-05-03 03:18Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
{
"affected": [],
"aliases": [
"CVE-2007-3387"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-07-30T23:17:00Z",
"severity": "MODERATE"
},
"details": "Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.",
"id": "GHSA-v25x-frpw-qg4x",
"modified": "2022-05-03T03:18:14Z",
"published": "2022-05-03T03:18:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-3387"
},
{
"type": "WEB",
"url": "https://issues.foresightlinux.org/browse/FL-471"
},
{
"type": "WEB",
"url": "https://issues.rpath.com/browse/RPL-1596"
},
{
"type": "WEB",
"url": "https://issues.rpath.com/browse/RPL-1604"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11149"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=187139"
},
{
"type": "WEB",
"url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=248194"
},
{
"type": "WEB",
"url": "http://osvdb.org/40127"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26188"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26251"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26254"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26255"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26257"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26278"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26281"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26283"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26292"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26293"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26297"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26307"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26318"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26325"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26342"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26343"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26358"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26365"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26370"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26395"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26403"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26405"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26407"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26410"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26413"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26425"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26432"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26436"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26467"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26468"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26470"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26514"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26607"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26627"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26862"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26982"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27156"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27281"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27308"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27637"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30168"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200709-12.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200709-17.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200710-20.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200711-34.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200805-13.xml"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2007\u0026m=slackware-security.761882"
},
{
"type": "WEB",
"url": "http://sourceforge.net/project/shownotes.php?release_id=535497"
},
{
"type": "WEB",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2007-401.htm"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1347"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1348"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1349"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1350"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1352"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1354"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1355"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1357"
},
{
"type": "WEB",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200710-08.xml"
},
{
"type": "WEB",
"url": "http://www.kde.org/info/security/advisory-20070730-1.txt"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:158"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:159"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:160"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:161"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:162"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:163"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:164"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:165"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2007_15_sr.html"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2007_16_sr.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0720.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0729.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0730.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0731.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0732.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0735.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/476508/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/476519/30/5400/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/476765/30/5340/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25124"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1018473"
},
{
"type": "WEB",
"url": "http://www.slackware.org/security/viewer.php?l=slackware-security\u0026y=2007\u0026m=slackware-security.423670"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-496-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-496-2"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/2704"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/2705"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-V2J6-3Q6Q-GM3G
Vulnerability from github – Published: 2026-06-21 18:32 – Updated: 2026-06-21 18:32libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
{
"affected": [],
"aliases": [
"CVE-2026-56406"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-21T16:16:27Z",
"severity": "MODERATE"
},
"details": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.",
"id": "GHSA-v2j6-3q6q-gm3g",
"modified": "2026-06-21T18:32:19Z",
"published": "2026-06-21T18:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56406"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/pull/1255"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-V2RR-WFQP-88FW
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2022-06-08 00:00An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send a packet to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2019-5040"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-20T21:15:00Z",
"severity": "HIGH"
},
"details": "An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send a packet to trigger this vulnerability.",
"id": "GHSA-v2rr-wfqp-88fw",
"modified": "2022-06-08T00:00:52Z",
"published": "2022-05-24T16:54:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5040"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0803"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- If possible, choose a language or compiler that performs automatic bounds checking.
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Mitigation MIT-8
Strategy: Input Validation
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Mitigation MIT-36
- Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
- Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-26
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.