2518 vulnerabilities classified as CWE-121 (栈缓冲区溢出). AI Chinese analysis included.
CWE-121 represents a critical memory safety weakness where program data exceeds the allocated bounds of a stack-allocated buffer, corrupting adjacent memory structures. Attackers typically exploit this vulnerability by injecting malicious payloads that overwrite the function’s return address or saved frame pointer, thereby hijacking control flow to execute arbitrary code with the privileges of the compromised process. This exploitation is particularly dangerous because stack buffers are local variables, making the attack surface common in low-level languages like C and C++. Developers mitigate this risk by enforcing strict input validation, utilizing safe string handling functions that prevent unbounded writes, and adopting modern programming languages with automatic memory management. Additionally, implementing compiler-level protections such as stack canaries and Address Space Layout Randomization significantly raises the barrier for successful exploitation, ensuring system integrity remains intact against buffer overflow attempts.
#define BUFSIZE 256 int main(int argc, char **argv) { char buf[BUFSIZE]; strcpy(buf, argv[1]); }void host_lookup(char *user_supplied_addr){ struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); /*routine that ensures user_supplied_addr is in the right format for conversion */ validate_addr_form(user_supplied_addr); addr = inet_addr(user_supplied_addr); hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET); strcpy(hostname, hp->h_name); }| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2019-10164 | PostgreSQL 缓冲区错误漏洞 — PostgreSQL | 8.8 | - | 2019-06-26 |
| CVE-2018-20655 | Facebook WhatsApp和WhatsApp Business 缓冲区错误漏洞 — WhatsApp for iOS | 9.8 | - | 2019-06-14 |
| CVE-2018-6339 | Facebook WhatsApp Business 缓冲区错误漏洞 — WhatsApp for Android | 9.1 | - | 2019-06-14 |
| CVE-2018-6349 | Facebook WhatsApp和WhatsApp Business 缓冲区错误漏洞 — WhatsApp for Android | 9.8 | - | 2019-06-14 |
| CVE-2019-10967 | Emerson Electric Ovation OCR400 Controller 缓冲区错误漏洞 — Emerson Ovation OCR400 Controller | 8.8 | - | 2019-05-28 |
| CVE-2015-1006 | 多款Opto 22产品缓冲区错误漏洞 — PAC Project Professional | 9.8 | - | 2019-05-10 |
| CVE-2019-10954 | Rockwell Automation CompactLogix 5370 Stack-based Buffer Overflow — CompactLogix 5370 L1 controllers | 7.5 | - | 2019-05-01 |
| CVE-2019-3930 | 多款路由器缓冲区错误漏洞 — Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | 9.8 | - | 2019-04-30 |
| CVE-2019-10947 | Delta Electronics Delta Industrial Automation CNCSoft 缓冲区错误漏洞 — Delta Industrial Automation CNCSoft | 7.8 | - | 2019-04-17 |
| CVE-2019-0008 | QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) process — Junos OS | 9.8 | - | 2019-04-10 |
| CVE-2019-6550 | Advantech WebAccess/SCADA 缓冲区错误漏洞 — WebAccess/SCADA | 9.8 | - | 2019-04-05 |
| CVE-2019-6553 | Rockwell Automation RSLinx Classic 缓冲区错误漏洞 — RSLinx Classic | 9.8 | - | 2019-04-04 |
| CVE-2014-9189 | Honeywell International Experion PKS 缓冲区错误漏洞 — Experion PKS | 9.8 | - | 2019-03-25 |
| CVE-2015-1007 | 多款Opto 22产品缓冲区错误漏洞 — PAC Project Professional | 7.8 | - | 2019-03-25 |
| CVE-2016-5800 | Fatek Automation PM Designer和Automation FV Designer 缓冲区错误漏洞 — Automation PM Designer V3 | 7.5 | - | 2019-03-21 |
| CVE-2018-17937 | gpsd和microjson 缓冲区错误漏洞 — gpsd and microjson (Open Source Project) | 8.8 | - | 2019-03-13 |
| CVE-2019-8269 | UltraVNC 缓冲区错误漏洞 — UltraVNC | 7.5 | - | 2019-03-09 |
| CVE-2019-8276 | UltraVNC 缓冲区错误漏洞 — UltraVNC | 7.5 | - | 2019-03-09 |
| CVE-2019-3921 | Nokia Alcatel Lucent I-240W-Q GPON ONT 缓冲区错误漏洞 — Alcatel Lucent I-240W-Q GPON ONT | 8.8 | - | 2019-03-05 |
| CVE-2019-3922 | Nokia Alcatel Lucent I-240W-Q GPON ONT 缓冲区错误漏洞 — Alcatel Lucent I-240W-Q GPON ONT | 9.8 | - | 2019-03-05 |
| CVE-2019-8263 | UltraVNC 缓冲区错误漏洞 — UltraVNC | 6.5 | - | 2019-03-05 |
| CVE-2019-6537 | WECON Technologies LeviStudioU 缓冲区错误漏洞 — WECON LeviStudioU | 7.8 | - | 2019-02-13 |
| CVE-2019-3822 | Haxx libcurl 缓冲区错误漏洞 — curl | 9.8 | - | 2019-02-06 |
| CVE-2018-5410 | Dokan file system driver contains a stack-based buffer overflow — Open Source File System | 7.8 | - | 2019-01-07 |
| CVE-2018-20247 | Foxit Quick PDF Library 缓冲区错误漏洞 — Foxit Quick PDF Library | 8.8 | - | 2018-12-24 |
| CVE-2018-11463 | 多款Siemens产品缓冲区错误漏洞 — SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 | 7.8 | - | 2018-12-12 |
| CVE-2018-18993 | Omron CX-One 缓冲区错误漏洞 — CX-One (CX-Programmer and CX-Server) | 7.8 | - | 2018-12-04 |
| CVE-2018-17930 | Teledyne DALSA Sherlock 缓冲区错误漏洞 — Teledyne DALSA Sherlock | 9.8 | - | 2018-11-28 |
| CVE-2018-17614 | Losant Arduino MQTT Client 缓冲区错误漏洞 — Losant Arduino MQTT Client | 8.8 | - | 2018-11-13 |
| CVE-2018-17916 | Schneider Electric InduSoft Web Studio和InTouch Edge HMI 缓冲区错误漏洞 — InduSoft Web Studio, and InTouch Edge HMI (formerly InTouch Machine Edition) | 9.8 | - | 2018-11-02 |
Vulnerabilities classified as CWE-121 (栈缓冲区溢出) represent 2518 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.