CWE-190
AllowedInteger Overflow or Wraparound
Abstraction: Base · Status: Stable
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
3867 vulnerabilities reference this CWE, most recent first.
GHSA-WG3G-GGH3-7WGP
Vulnerability from github – Published: 2023-12-05 03:30 – Updated: 2025-10-22 00:32Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
{
"affected": [],
"aliases": [
"CVE-2023-33107"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-05T03:15:14Z",
"severity": "HIGH"
},
"details": "Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.",
"id": "GHSA-wg3g-ggh3-7wgp",
"modified": "2025-10-22T00:32:59Z",
"published": "2023-12-05T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33107"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33107"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WGH7-54F2-X98R
Vulnerability from github – Published: 2023-10-10 21:16 – Updated: 2024-06-21 21:33An integer overflow in MetaDataBuilder.checkSize allows for HTTP/2 HPACK header values to
exceed their size limit.
In MetaDataBuilder.java, the following code determines if a header name or value
exceeds the size limit, and throws an exception if the limit is exceeded:
291 public void checkSize(int length, boolean huffman) throws SessionException
292 {
293 // Apply a huffman fudge factor
294 if (huffman)
295 length = (length * 4) / 3;
296 if ((_size + length) > _maxSize)
297 throw new HpackException.SessionException("Header too large %d > %d",
_size + length, _maxSize);
298 }
However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. (_size+length) will now be negative, and the check on line 296 will not be triggered.
Furthermore, MetaDataBuilder.checkSize allows for user-entered HPACK header value sizes to be
negative, potentially leading to a very large buffer allocation later on when the
user-entered size is multiplied by 2.
In MetaDataBuilder.java, the following code determines if a header name or value
exceeds the size limit, and throws an exception if the limit is exceeded:
public void checkSize(int length, boolean huffman) throws SessionException
{
// Apply a huffman fudge factor
if (huffman)
length = (length * 4) / 3;
if ((_size + length) > _maxSize)
throw new HpackException.SessionException("Header too large %d > %d", _size
+ length, _maxSize);
}
However, no exception is thrown in the case of a negative size.
Later, in Huffman.decode, the user-entered length is multiplied by 2 before allocating a buffer:
public static String decode(ByteBuffer buffer, int length) throws
HpackException.CompressionException
{
Utf8StringBuilder utf8 = new Utf8StringBuilder(length * 2);
// ...
This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server.
Exploit Scenario 1
An attacker repeatedly sends HTTP messages with the HPACK header 0x00ffffffffff02.
Each time this header is decoded:
+ HpackDecode.decode will determine that a Huffman-coded value of length
805306494 needs to be decoded.
+ MetaDataBuilder.checkSize will approve this length.
+ Huffman.decode will allocate a 1.6 GB string array.
+ Huffman.decode will have a buffer overflow error, and the array will be deallocated
the next time garbage collection happens. (Note: this can be delayed by appending
valid huffman-coded characters to the end of the header.)
Depending on the timing of garbage collection, the number of threads, and the amount of memory available on the server, this may cause the server to run out of memory.
Exploit Scenario 2
An attacker repeatedly sends HTTP messages with the HPACK header 0x00ff8080ffff0b. Each time this header is decoded: + HpackDecode.decode will determine that a Huffman-coded value of length -1073758081 needs to be decoded + MetaDataBuilder.checkSize will approve this length + The number will be multiplied by 2 to get 2147451134, and Huffman.decode will allocate a 2.1 GB string array + Huffman.decode will have a buffer overflow error, and the array will be deallocated the next time garbage collection happens (Note that this deallocation can be delayed by adding valid Huffman-coded characters to the end of the header)
Depending on the timing of garbage collection, the number of threads, and the amount of memory available on the server, this may cause the server to run out of memory.
Impact
Users of HTTP/2 can be impacted by a remote denial of service attack.
Patches
Fixed in Jetty 10.0.16 and Jetty 11.0.16 Fixed in Jetty 9.4.53 Jetty 12.x is unaffected.
Workarounds
No workarounds possible, only patched versions of Jetty.
References
- https://github.com/eclipse/jetty.project/pull/9634
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.0.15"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-hpack"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.0.15"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-hpack"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.0.15"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http3:http3-qpack"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.0.15"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http3:http3-qpack"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.4.52"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-hpack"
},
"ranges": [
{
"events": [
{
"introduced": "9.3.0"
},
{
"fixed": "9.4.53"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-36478"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-10T21:16:23Z",
"nvd_published_at": "2023-10-10T17:15:11Z",
"severity": "HIGH"
},
"details": "An integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to\nexceed their size limit. \n\nIn `MetaDataBuilder.java`, the following code determines if a header name or value\nexceeds the size limit, and throws an exception if the limit is exceeded:\n\n```java\n291 public void checkSize(int length, boolean huffman) throws SessionException\n292 {\n293 // Apply a huffman fudge factor\n294 if (huffman)\n295 length = (length * 4) / 3;\n296 if ((_size + length) \u003e _maxSize)\n297 throw new HpackException.SessionException(\"Header too large %d \u003e %d\",\n_size + length, _maxSize);\n298 }\n```\n\nHowever, when length is very large and huffman is true, the multiplication by 4 in line 295\nwill overflow, and length will become negative. (_size+length) will now be negative, and\nthe check on line 296 will not be triggered.\n\nFurthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be\nnegative, potentially leading to a very large buffer allocation later on when the\nuser-entered size is multiplied by 2.\n\nIn `MetaDataBuilder.java`, the following code determines if a header name or value\nexceeds the size limit, and throws an exception if the limit is exceeded:\n\n```java\npublic void checkSize(int length, boolean huffman) throws SessionException\n{\n// Apply a huffman fudge factor\nif (huffman)\nlength = (length * 4) / 3;\nif ((_size + length) \u003e _maxSize)\nthrow new HpackException.SessionException(\"Header too large %d \u003e %d\", _size\n+ length, _maxSize);\n}\n```\n\nHowever, no exception is thrown in the case of a negative size.\nLater, in `Huffman.decode`, the user-entered length is multiplied by 2 before allocating a buffer:\n\n```java\npublic static String decode(ByteBuffer buffer, int length) throws\nHpackException.CompressionException\n{\nUtf8StringBuilder utf8 = new Utf8StringBuilder(length * 2);\n// ...\n```\n\nThis means that if a user provides a negative length value (or, more precisely, a length\nvalue which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a\nvery large positive number when multiplied by 2, then the user can cause a very large\nbuffer to be allocated on the server.\n\n\n### Exploit Scenario 1\nAn attacker repeatedly sends HTTP messages with the HPACK header 0x00ffffffffff02.\nEach time this header is decoded:\n+ `HpackDecode.decode` will determine that a Huffman-coded value of length\n805306494 needs to be decoded.\n+ `MetaDataBuilder.checkSize` will approve this length.\n+ Huffman.decode will allocate a 1.6 GB string array.\n+ Huffman.decode will have a buffer overflow error, and the array will be deallocated\nthe next time garbage collection happens. (Note: this can be delayed by appending\nvalid huffman-coded characters to the end of the header.)\n\nDepending on the timing of garbage collection, the number of threads, and the amount of\nmemory available on the server, this may cause the server to run out of memory.\n\n\n### Exploit Scenario 2\nAn attacker repeatedly sends HTTP messages with the HPACK header 0x00ff8080ffff0b. Each\ntime this header is decoded:\n + HpackDecode.decode will determine that a Huffman-coded value of length\n-1073758081 needs to be decoded\n + MetaDataBuilder.checkSize will approve this length\n + The number will be multiplied by 2 to get 2147451134, and Huffman.decode will\nallocate a 2.1 GB string array\n + Huffman.decode will have a buffer overflow error, and the array will be deallocated\nthe next time garbage collection happens (Note that this deallocation can be\ndelayed by adding valid Huffman-coded characters to the end of the header)\n\nDepending on the timing of garbage collection, the number of threads, and the amount of\nmemory available on the server, this may cause the server to run out of memory.\n\n### Impact\nUsers of HTTP/2 can be impacted by a remote denial of service attack.\n\n### Patches\nFixed in Jetty 10.0.16 and Jetty 11.0.16\nFixed in Jetty 9.4.53\nJetty 12.x is unaffected.\n\n### Workarounds\nNo workarounds possible, only patched versions of Jetty.\n\n### References\n* https://github.com/eclipse/jetty.project/pull/9634",
"id": "GHSA-wgh7-54f2-x98r",
"modified": "2024-06-21T21:33:57Z",
"published": "2023-10-10T21:16:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r"
},
{
"type": "WEB",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36478"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/jetty.project/pull/9634"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse/jetty.project"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231116-0011"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240621-0006"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5540"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/18/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "HTTP/2 HPACK integer overflow and buffer allocation"
}
GHSA-WGJ3-WXRF-QQG3
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2022-05-24 22:01An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.
{
"affected": [],
"aliases": [
"CVE-2019-18805"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-07T14:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.",
"id": "GHSA-wgj3-wxrf-qqg3",
"modified": "2022-05-24T22:01:05Z",
"published": "2022-05-24T22:01:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18805"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0740"
},
{
"type": "WEB",
"url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.11"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19fad20d15a6494f47f85d869f00b11343ee5c78"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20191205-0001"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00039.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WGJM-63CH-MWJ3
Vulnerability from github – Published: 2026-04-11 03:30 – Updated: 2026-06-30 03:36GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28807.
{
"affected": [],
"aliases": [
"CVE-2026-4150"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-11T01:16:16Z",
"severity": "HIGH"
},
"details": "GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28807.",
"id": "GHSA-wgjm-63ch-mwj3",
"modified": "2026-06-30T03:36:15Z",
"published": "2026-04-11T03:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4150"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-217"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4150.json"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/gimp/-/commit/00afdabdadeb5457fd897878b1e5aebc3780af10"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457535"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-4150"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26168"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25907"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25901"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25899"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20691"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20554"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20553"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20552"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19362"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:17533"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16484"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WGVF-2WQ5-8WQH
Vulnerability from github – Published: 2022-05-14 03:03 – Updated: 2022-05-14 03:03The mintToken function of a smart contract implementation for GATcoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
{
"affected": [],
"aliases": [
"CVE-2018-13564"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-09T06:29:00Z",
"severity": "HIGH"
},
"details": "The mintToken function of a smart contract implementation for GATcoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
"id": "GHSA-wgvf-2wq5-8wqh",
"modified": "2022-05-14T03:03:34Z",
"published": "2022-05-14T03:03:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13564"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/GATcoin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WH38-WFPG-R5VQ
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-21837"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-18T13:15:00Z",
"severity": "HIGH"
},
"details": "Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.",
"id": "GHSA-wh38-wfpg-r5vq",
"modified": "2022-05-24T19:11:34Z",
"published": "2022-05-24T19:11:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21837"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4966"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WH4F-RQ6R-F55P
Vulnerability from github – Published: 2022-05-13 01:39 – Updated: 2022-05-13 01:39The mintToken function of a smart contract implementation for Air-Contact Token (AIR), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
{
"affected": [],
"aliases": [
"CVE-2018-13179"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-05T02:29:00Z",
"severity": "HIGH"
},
"details": "The mintToken function of a smart contract implementation for Air-Contact Token (AIR), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
"id": "GHSA-wh4f-rq6r-f55p",
"modified": "2022-05-13T01:39:40Z",
"published": "2022-05-13T01:39:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13179"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
},
{
"type": "WEB",
"url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/AirContactToken"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WH6Q-6FG6-58RX
Vulnerability from github – Published: 2022-05-17 02:43 – Updated: 2025-04-20 03:38libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.
{
"affected": [],
"aliases": [
"CVE-2017-9197"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-23T04:29:00Z",
"severity": "CRITICAL"
},
"details": "libautotrace.a in AutoTrace 0.31.1 has a \"cannot be represented in type int\" issue in input-tga.c:498:55.",
"id": "GHSA-wh6q-6fg6-58rx",
"modified": "2025-04-20T03:38:10Z",
"published": "2022-05-17T02:43:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9197"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WH73-785P-7WCF
Vulnerability from github – Published: 2024-06-07 00:30 – Updated: 2024-10-10 21:30dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.
{
"affected": [],
"aliases": [
"CVE-2023-49441"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T22:15:09Z",
"severity": "HIGH"
},
"details": "dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.",
"id": "GHSA-wh73-785p-7wcf",
"modified": "2024-10-10T21:30:42Z",
"published": "2024-06-07T00:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49441"
},
{
"type": "WEB",
"url": "https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q4/017332.html"
},
{
"type": "WEB",
"url": "https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=65c2d6afd67a032f45f40d7e4d620f5d73e5f07d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WH76-54FJ-93Q5
Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2022-05-24 17:01Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters due to incorrect buffer size calculation. in PostScript and PDF printers that use IPS versions prior to 2019.2 in PostScript and PDF printers that use IPS versions prior to 2019.2
{
"affected": [],
"aliases": [
"CVE-2019-10627"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-21T15:15:00Z",
"severity": "HIGH"
},
"details": "Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters due to incorrect buffer size calculation. in PostScript and PDF printers that use IPS versions prior to 2019.2 in PostScript and PDF printers that use IPS versions prior to 2019.2",
"id": "GHSA-wh76-54fj-93q5",
"modified": "2022-05-24T17:01:40Z",
"published": "2022-05-24T17:01:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10627"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/c06458150"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- If possible, choose a language or compiler that performs automatic bounds checking.
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Mitigation MIT-8
Strategy: Input Validation
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Mitigation MIT-36
- Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
- Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-26
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.