503
Nature Type ID Name Page
MemberOf 738 CERT C Secure Coding Standard (2008) Chapter 5 -
Integers (INT)
734 2342
MemberOf 848 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 5 - Numeric Types and Operations
(NUM)
844 2363
MemberOf 872 CERT C++ Secure Coding Section 04 - Integers (INT) 868 2374
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1137 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 03. Numeric Types and Operations (NUM)
1133 2445
MemberOf 1158 SEI CERT C Coding Standard - Guidelines 04. Integers
(INT)
1154 2456
MemberOf 1159 SEI CERT C Coding Standard - Guidelines 05. Floating
Point (FLP)
1154 2457
MemberOf 1163 SEI CERT C Coding Standard - Guidelines 09. Input
Output (FIO)
1154 2459
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Research Gap
This weakness has traditionally been under-studied and under-reported, although vulnerabilities
in popular software have been published in 2008 and 2009.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Numeric truncation error
CLASP Truncation error
CERT C Secure Coding FIO34-C CWE More
Abstract
Distinguish between characters read
from a file and EOF or WEOF
CERT C Secure Coding FLP34-C CWE More
Abstract
Ensure that floating point conversions
are within range of the new type
CERT C Secure Coding INT02-C Understand integer conversion rules
CERT C Secure Coding INT05-C Do not use input functions to convert
character data if they cannot handle all
possible inputs
CERT C Secure Coding INT31-C CWE More
Abstract
Ensure that integer conversions do not
result in lost or misinterpreted data
The CERT Oracle Secure
Coding Standard for Java
(2011)
NUM12-J Ensure conversions of numeric types to
narrower types do not result in lost or
misinterpreted data
Software Fault Patterns SFP1 Glitch in computation
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-198: Use of Incorrect Byte Ordering
Weakness ID : 198
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor