1067 vulnerabilities classified as CWE-119 (内存缓冲区边界内操作的限制不恰当). AI Chinese analysis included.
CWE-119 represents a critical memory safety weakness where software performs read or write operations beyond the intended boundaries of a memory buffer. This flaw typically arises from insufficient validation of input lengths or loop counters, allowing attackers to manipulate program execution flow. By crafting malicious inputs that exceed buffer limits, adversaries can overwrite adjacent memory, corrupt data structures, or inject executable code, often leading to remote code execution or system crashes. Developers mitigate this risk by implementing rigorous bounds checking before any memory access, utilizing safe string handling functions that enforce length limits, and adopting modern programming languages with automatic memory management. Additionally, employing static analysis tools and fuzzing techniques during development helps identify out-of-bounds accesses early, ensuring that all buffer operations remain strictly within allocated memory regions to prevent exploitation.
void host_lookup(char *user_supplied_addr){ struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); /*routine that ensures user_supplied_addr is in the right format for conversion */ validate_addr_form(user_supplied_addr); addr = inet_addr(user_supplied_addr); hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET); strcpy(hostname, hp->h_name); }char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to < */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return ds| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2021-34783 | Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Software-Based SSL/TLS Denial of Service Vulnerability — Cisco Adaptive Security Appliance (ASA) Software | 8.6 | High | 2021-10-27 |
| CVE-2021-34781 | Cisco Firepower Threat Defense Software SSH Connections Denial of Service Vulnerability — Cisco Adaptive Security Appliance (ASA) Software | 8.6 | High | 2021-10-27 |
| CVE-2021-34859 | Teamviewer TeamViewer 缓冲区错误漏洞 — TeamViewer | 7.8 | - | 2021-10-25 |
| CVE-2021-34856 | Corel Parallels Desktop 缓冲区错误漏洞 — Desktop | 8.2 | - | 2021-10-25 |
| CVE-2021-38473 | AUVESY Versiondog — Versiondog | 8.0 | High | 2021-10-22 |
| CVE-2021-3746 | Archlinux libtpms 缓冲区错误漏洞 — libtpms | 5.7 | - | 2021-10-19 |
| CVE-2021-38436 | FATEK Automation WinProladder — WinProladder | 7.8 | High | 2021-10-18 |
| CVE-2021-38442 | FATEK Automation WinProladder — WinProladder | 7.8 | High | 2021-10-18 |
| CVE-2021-41121 | Memory corruption in Vyper — vyper | 7.5 | High | 2021-10-06 |
| CVE-2021-33737 | Siemens SIAMTIC CP343-1 缓冲区错误漏洞 — SIMATIC CP 343-1 (incl. SIPLUS variants) | 7.5 | High | 2021-09-14 |
| CVE-2021-22789 | Schneider Electric Modicon M580 CPU 缓冲区错误漏洞 — Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions) | 6.5 | - | 2021-09-02 |
| CVE-2021-3605 | Industrial Light And Magic（lim） OpenEXR 缓冲区错误漏洞 — OpenEXR | 5.5 | - | 2021-08-25 |
| CVE-2021-3635 | Linux kernel 缓冲区错误漏洞 — kernel | 4.4 | - | 2021-08-13 |
| CVE-2021-1111 | NVIDIA Bootloader 缓冲区错误漏洞 — NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 series, Jetson TX2 NX | 6.7 | Medium | 2021-08-11 |
| CVE-2021-34306 | Siemens JT2GO 缓冲区错误漏洞 — JT2Go | 7.8 | - | 2021-07-13 |
| CVE-2021-3571 | ptp4l 缓冲区错误漏洞 — linuxptp | 5.9 | - | 2021-07-09 |
| CVE-2021-3570 | ptp4l 缓冲区错误漏洞 — linuxptp | 8.8 | - | 2021-07-09 |
| CVE-2021-21794 | Accusoft ImageGear 缓冲区错误漏洞 — Accusoft" | 8.8 | - | 2021-07-08 |
| CVE-2021-3598 | Industrial Light and Magic OpenEXR 缓冲区错误漏洞 — OpenEXR | 5.5 | - | 2021-07-06 |
| CVE-2021-27477 | JTEKT TOYOPUC-Plus 缓冲区错误漏洞 — JTEKT Corporation TOYOPUC PLC | 7.5 | - | 2021-07-01 |
| CVE-2021-32992 | winproladder 缓冲区错误漏洞 — FATEK Automation WinProladder | 9.8 | - | 2021-06-29 |
| CVE-2021-32493 | Arch Linux 缓冲区错误漏洞 — djvulibre | 7.8 | - | 2021-06-24 |
| CVE-2021-32492 | Arch Linux 缓冲区错误漏洞 — djvulibre | 7.8 | - | 2021-06-24 |
| CVE-2021-32490 | DjVuLibre 缓冲区错误漏洞 — djvulibre | 7.8 | - | 2021-06-24 |
| CVE-2021-33004 | Advantech WebAccess HMI Designer 缓冲区错误漏洞 — WebAccess HMI Designer | 7.8 | - | 2021-06-24 |
| CVE-2021-31495 | OpenText Brava! 缓冲区错误漏洞 — Brava! Desktop | 7.8 | - | 2021-06-15 |
| CVE-2021-31493 | OpenText Brava! 缓冲区错误漏洞 — Brava! Desktop | 7.8 | - | 2021-06-15 |
| CVE-2021-21833 | Accusoft ImageGear 输入验证错误漏洞 — Accusoft | 8.8 | - | 2021-06-11 |
| CVE-2021-22761 | IGSS Definition 缓冲区错误漏洞 — IGSS Definition (Def.exe) V15.0.0.21140 and prior | 7.8 | - | 2021-06-11 |
| CVE-2021-1527 | Cisco Webex Player Memory Corruption Vulnerability — Cisco Webex Meetings | 5.3 | Medium | 2021-06-04 |
Vulnerabilities classified as CWE-119 (内存缓冲区边界内操作的限制不恰当) represent 1067 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.