1011
Reference Description
CVE-2002-0059 Double free from malformed compressed data.
https://www.cve.org/CVERecord?id=CVE-2002-0059
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 398 7PK - Code Quality 700 2323
MemberOf 742 CERT C Secure Coding Standard (2008) Chapter 9 -
Memory Management (MEM)
734 2345
MemberOf 876 CERT C++ Secure Coding Section 08 - Memory
Management (MEM)
868 2376
MemberOf 969 SFP Secondary Cluster: Faulty Memory Release 888 2404
MemberOf 1162 SEI CERT C Coding Standard - Guidelines 08. Memory
Management (MEM)
1154 2458
MemberOf 1237 SFP Primary Cluster: Faulty Resource Release 888 2482
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Relationship
This is usually resultant from another weakness, such as an unhandled error or race condition
between threads. It could also be primary to weaknesses such as buffer overflows.
Theoretical
It could be argued that Double Free would be most appropriately located as a child of "Use
after Free", but "Use" and "Release" are considered to be distinct operations within vulnerability
theory, therefore this is more accurately "Release of a Resource after Expiration or Release",
which doesn't exist yet.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER DFREE - Double-Free Vulnerability
7 Pernicious Kingdoms Double Free
CLASP Doubly freeing memory
CERT C Secure Coding MEM00-
C
Allocate and free memory in the same
module, at the same level of abstraction
CERT C Secure Coding MEM01-
C
Store a new value in pointers
immediately after free()
CERT C Secure Coding MEM30-
C
CWE More Specific Do not access freed memory
CERT C Secure Coding MEM31-
C
Free dynamically allocated memory
exactly once
Software Fault Patterns SFP12 Faulty Memory Release
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE Version 4.14
CWE-416: Use After Free
CWE-416: Use After Free