1728
Reference Description
CVE-2009-3129 Spreadsheet program processes a record with an invalid size field, which is
later used as an offset.
https://www.cve.org/CVERecord?id=CVE-2009-3129
CVE-2009-2694 Instant messaging library does not validate an offset value specified in a
packet.
https://www.cve.org/CVERecord?id=CVE-2009-2694
CVE-2009-2687 Language interpreter does not properly handle invalid offsets in JPEG image,
leading to out-of-bounds memory access and crash.
https://www.cve.org/CVERecord?id=CVE-2009-2687
CVE-2009-0690 negative offset leads to out-of-bounds read
https://www.cve.org/CVERecord?id=CVE-2009-0690
CVE-2008-4114 untrusted offset in kernel
https://www.cve.org/CVERecord?id=CVE-2008-4114
CVE-2010-2873 "blind trust" of an offset value while writing heap memory allows corruption of
function pointer,leading to code execution
https://www.cve.org/CVERecord?id=CVE-2010-2873
CVE-2010-2866 negative value (signed) causes pointer miscalculation
https://www.cve.org/CVERecord?id=CVE-2010-2866
CVE-2010-2872 signed values cause incorrect pointer calculation
https://www.cve.org/CVERecord?id=CVE-2010-2872
CVE-2007-5657 values used as pointer offsets
https://www.cve.org/CVERecord?id=CVE-2007-5657
CVE-2010-2867 a return value from a function is sign-extended if the value is signed, then used
as an offset for pointer arithmetic
https://www.cve.org/CVERecord?id=CVE-2010-2867
CVE-2009-1097 portions of a GIF image used as offsets, causing corruption of an object
pointer.
https://www.cve.org/CVERecord?id=CVE-2009-1097
CVE-2008-1807 invalid numeric field leads to a free of arbitrary memory locations, then code
execution.
https://www.cve.org/CVERecord?id=CVE-2008-1807
CVE-2007-2500 large number of elements leads to a free of an arbitrary address
https://www.cve.org/CVERecord?id=CVE-2007-2500
CVE-2008-1686 array index issue (CWE-129) with negative offset, used to dereference a
function pointer
https://www.cve.org/CVERecord?id=CVE-2008-1686
CVE-2010-2878 "buffer seek" value - basically an offset?
https://www.cve.org/CVERecord?id=CVE-2010-2878
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Maintenance
There are close relationships between incorrect pointer dereferences and other weaknesses
related to buffer operations. There may not be sufficient community agreement regarding
these relationships. Further study is needed to determine when these relationships are chains,
composites, perspective/layering, or other types of relationships. As of September 2010, most of
the relationships are being captured as chains.
CWE Version 4.14
CWE-824: Access of Uninitialized Pointer
CWE-824: Access of Uninitialized Pointer