301
Reference Description
https://www.cve.org/CVERecord?id=CVE-2020-29557
CVE-2009-2550 Classic stack-based buffer overflow in media player using a long entry in a
playlist
https://www.cve.org/CVERecord?id=CVE-2009-2550
CVE-2009-2403 Heap-based buffer overflow in media player using a long entry in a playlist
https://www.cve.org/CVERecord?id=CVE-2009-2403
CVE-2009-0689 large precision value in a format string triggers overflow
https://www.cve.org/CVERecord?id=CVE-2009-0689
CVE-2009-0690 negative offset value leads to out-of-bounds read
https://www.cve.org/CVERecord?id=CVE-2009-0690
CVE-2009-1532 malformed inputs cause accesses of uninitialized or previously-deleted objects,
leading to memory corruption
https://www.cve.org/CVERecord?id=CVE-2009-1532
CVE-2009-1528 chain: lack of synchronization leads to memory corruption
https://www.cve.org/CVERecord?id=CVE-2009-1528
CVE-2021-29529 Chain: machine-learning product can have a heap-based buffer overflow
(CWE-122) when some integer-oriented bounds are calculated by using
ceiling() and floor() on floating point values (CWE-1339)
https://www.cve.org/CVERecord?id=CVE-2021-29529
CVE-2009-0558 attacker-controlled array index leads to code execution
https://www.cve.org/CVERecord?id=CVE-2009-0558
CVE-2009-0269 chain: -1 value from a function call was intended to indicate an error, but is
used as an array index instead.
https://www.cve.org/CVERecord?id=CVE-2009-0269
CVE-2009-0566 chain: incorrect calculations lead to incorrect pointer dereference and memory
corruption
https://www.cve.org/CVERecord?id=CVE-2009-0566
CVE-2009-1350 product accepts crafted messages that lead to a dereference of an arbitrary
pointer
https://www.cve.org/CVERecord?id=CVE-2009-1350
CVE-2009-0191 chain: malformed input causes dereference of uninitialized memory
https://www.cve.org/CVERecord?id=CVE-2009-0191
CVE-2008-4113 OS kernel trusts userland-supplied length value, allowing reading of sensitive
information
https://www.cve.org/CVERecord?id=CVE-2008-4113
CVE-2005-1513 Chain: integer overflow in securely-coded mail program leads to buffer
overflow. In 2005, this was regarded as unrealistic to exploit, but in 2020, it
was rediscovered to be easier to exploit due to evolutions of the technology.
https://www.cve.org/CVERecord?id=CVE-2005-1513
CVE-2003-0542 buffer overflow involving a regular expression with a large number of captures
https://www.cve.org/CVERecord?id=CVE-2003-0542
CVE-2017-1000121chain: unchecked message size metadata allows integer overflow (CWE-190)
leading to buffer overflow (CWE-119).
https://www.cve.org/CVERecord?id=CVE-2017-1000121
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119: Improper Restriction of Operations
within the Bounds of a Memory Buffer 302
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 726 OWASP Top Ten 2004 Category A5 - Buffer Overflows 711 2336
MemberOf 740 CERT C Secure Coding Standard (2008) Chapter 7 -
Arrays (ARR)
734 2344
MemberOf 741 CERT C Secure Coding Standard (2008) Chapter 8 -
Characters and Strings (STR)
734 2344
MemberOf 742 CERT C Secure Coding Standard (2008) Chapter 9 -
Memory Management (MEM)
734 2345
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 744 CERT C Secure Coding Standard (2008) Chapter 11 -
Environment (ENV)
734 2348
MemberOf 752 2009 Top 25 - Risky Resource Management 750 2353
MemberOf 874 CERT C++ Secure Coding Section 06 - Arrays and the
STL (ARR)
868 2375
MemberOf 875 CERT C++ Secure Coding Section 07 - Characters and
Strings (STR)
868 2376
MemberOf 876 CERT C++ Secure Coding Section 08 - Memory
Management (MEM)
868 2376
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 878 CERT C++ Secure Coding Section 10 - Environment
(ENV)
868 2378
MemberOf 970 SFP Secondary Cluster: Faulty Buffer Access 888 2405
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1157 SEI CERT C Coding Standard - Guidelines 03.
Expressions (EXP)
1154 2455
MemberOf 1160 SEI CERT C Coding Standard - Guidelines 06. Arrays
(ARR)
1154 2457
MemberOf 1161 SEI CERT C Coding Standard - Guidelines 07.
Characters and Strings (STR)
1154 2458
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1306 CISQ Quality Measures - Reliability 1305 2483
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Applicable Platform
It is possible in any programming languages without memory management support to attempt
an operation outside of the bounds of a memory buffer, but the consequences will vary widely
depending on the language, platform, and chip architecture.
CWE Version 4.14
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119: Improper Restriction of Operations
within the Bounds of a Memory Buffer