337
Reference Description
https://www.cve.org/CVERecord?id=CVE-2014-0160
CVE-2009-2523 Chain: product does not handle when an input string is not NULL terminated,
leading to buffer over-read or heap-based buffer overflow.
https://www.cve.org/CVERecord?id=CVE-2009-2523
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 970 SFP Secondary Cluster: Faulty Buffer Access 888 2405
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Relationship
These problems may be resultant from missing sentinel values (CWE-463) or trusting a userinfluenced
input length variable.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Buffer over-read
Software Fault Patterns SFP8 Faulty Buffer Access
References
[REF-1034]Raoul Strackx, Yves Younan, Pieter Philippaerts, Frank Piessens, Sven Lachmund
and Thomas Walter. "Breaking the memory secrecy assumption". 2009 March 1. ACM. < https://
dl.acm.org/doi/10.1145/1519144.1519145 >.2023-04-07.
[REF-1035]Fermin J. Serna. "The info leak era on software exploitation". 2012 July 5. < https://
media.blackhat.com/bh-us-12/Briefings/Serna/BH_US_12_Serna_Leak_Era_Slides.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-127: Buffer Under-read
Weakness ID : 127
Structure : Simple
Abstraction : Variant
Description
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that
reference memory locations prior to the targeted buffer.
Extended Description
This typically occurs when the pointer or its index is decremented to a position before the buffer,
when pointer arithmetic results in a position before the beginning of the valid memory location, or
when a negative index is used. This may result in exposure of sensitive information or possibly a
crash.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-127: Buffer Under-read
CWE-127: Buffer Under-read