1073 vulnerabilities classified as CWE-119 (内存缓冲区边界内操作的限制不恰当). AI Chinese analysis included.
CWE-119 represents a critical memory safety weakness where software performs read or write operations beyond the intended boundaries of a memory buffer. This flaw typically arises from insufficient validation of input lengths or loop counters, allowing attackers to manipulate program execution flow. By crafting malicious inputs that exceed buffer limits, adversaries can overwrite adjacent memory, corrupt data structures, or inject executable code, often leading to remote code execution or system crashes. Developers mitigate this risk by implementing rigorous bounds checking before any memory access, utilizing safe string handling functions that enforce length limits, and adopting modern programming languages with automatic memory management. Additionally, employing static analysis tools and fuzzing techniques during development helps identify out-of-bounds accesses early, ensuring that all buffer operations remain strictly within allocated memory regions to prevent exploitation.
void host_lookup(char *user_supplied_addr){ struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); /*routine that ensures user_supplied_addr is in the right format for conversion */ validate_addr_form(user_supplied_addr); addr = inet_addr(user_supplied_addr); hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET); strcpy(hostname, hp->h_name); }char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to < */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return ds| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2023-0202 | NVIDIA DGX 安全漏洞 — NVIDIA DGX servers | 7.5 | High | 2023-04-22 |
| CVE-2021-33797 | Artifex Software Artifex MuJS 输入验证错误漏洞 — mujs | 9.8 | - | 2023-04-17 |
| CVE-2023-1579 | GNU Binutils 缓冲区错误漏洞 — binutils | 7.8 | - | 2023-04-03 |
| CVE-2023-0198 | NVIDIA GPU Display Driver for Linux 缓冲区错误漏洞 — vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), , NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) | 6.6 | Medium | 2023-04-01 |
| CVE-2023-0191 | 多款NVIDIA产品 缓冲区错误漏洞 — vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) | 7.1 | High | 2023-04-01 |
| CVE-2023-0188 | 多款NVIDIA产品 缓冲区错误漏洞 — vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) | 5.5 | Medium | 2023-04-01 |
| CVE-2023-1679 | DriverGenius IOCTL mydrivers64.sys 0x9C40A108 memory corruption — DriverGenius | 5.3 | Medium | 2023-03-28 |
| CVE-2023-1678 | DriverGenius IOCTL mydrivers64.sys 0x9C40A0E0 memory corruption — DriverGenius | 5.3 | Medium | 2023-03-28 |
| CVE-2023-1676 | DriverGenius IOCTL mydrivers64.sys 0x9C402088 memory corruption — DriverGenius | 7.8 | High | 2023-03-28 |
| CVE-2023-27286 | IBM Aspera code execution — Aspera | 8.4 | High | 2023-03-28 |
| CVE-2023-27284 | IBM Aspera code execution — Aspera | 8.4 | High | 2023-03-28 |
| CVE-2023-28638 | Stack references to locations outside buffers may become invalid if they exist during a GC compaction in Snappier — Snappier | 7.0 | High | 2023-03-27 |
| CVE-2023-1073 | Linux kernel 缓冲区错误漏洞 — kernel | 6.6 | - | 2023-03-27 |
| CVE-2023-1629 | JiangMin Antivirus IOCTL kvcore.sys 0x222010 memory corruption — Antivirus | 5.3 | Medium | 2023-03-25 |
| CVE-2023-1626 | Jianming Antivirus IoControlCode kvcore.sys memory corruption — Antivirus | 5.3 | Medium | 2023-03-25 |
| CVE-2021-43317 | UPX 缓冲区错误漏洞 — upx | 7.5 | - | 2023-03-24 |
| CVE-2021-43316 | UPX 缓冲区错误漏洞 — upx | 7.5 | - | 2023-03-24 |
| CVE-2021-43315 | UPX 缓冲区错误漏洞 — upx | 7.5 | - | 2023-03-24 |
| CVE-2021-43314 | UPX 缓冲区错误漏洞 — upx | 7.5 | - | 2023-03-24 |
| CVE-2021-43313 | UPX 安全漏洞 — upx | 7.5AI | HighAI | 2023-03-24 |
| CVE-2021-43312 | UPX 缓冲区错误漏洞 — upx | 7.5 | - | 2023-03-24 |
| CVE-2021-43311 | UPX 缓冲区错误漏洞 — upx | 7.5 | - | 2023-03-24 |
| CVE-2021-3674 | Rizin 缓冲区错误漏洞 — rizin | 7.8 | - | 2023-03-24 |
| CVE-2022-34423 | Dell PowerEdge Server BIOS 缓冲区错误漏洞 — PowerEdge Platform | 7.5 | High | 2023-03-16 |
| CVE-2022-34422 | Dell PowerEdge Server BIOS 缓冲区错误漏洞 — PowerEdge Platform | 7.5 | High | 2023-03-16 |
| CVE-2022-34421 | Dell PowerEdge Server BIOS 缓冲区错误漏洞 — PowerEdge Platform | 7.5 | High | 2023-03-16 |
| CVE-2022-34420 | Dell PowerEdge Server BIOS 缓冲区错误漏洞 — PowerEdge Platform | 7.5 | High | 2023-03-16 |
| CVE-2022-34419 | Dell PowerEdge Server BIOS 缓冲区错误漏洞 — PowerEdge Platform | 7.5 | High | 2023-03-16 |
| CVE-2022-34418 | Dell PowerEdge Server BIOS 缓冲区错误漏洞 — PowerEdge Platform | 7.5 | High | 2023-03-16 |
| CVE-2022-34417 | Dell PowerEdge Server BIOS 缓冲区错误漏洞 — PowerEdge Platform | 7.5 | High | 2023-03-16 |
Vulnerabilities classified as CWE-119 (内存缓冲区边界内操作的限制不恰当) represent 1073 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.