363
Reference Description
CVE-2001-0334 expansion overflow: buffer overflow using wildcards
https://www.cve.org/CVERecord?id=CVE-2001-0334
CVE-2001-0248 expansion overflow: long pathname + glob = overflow
https://www.cve.org/CVERecord?id=CVE-2001-0248
CVE-2001-0249 expansion overflow: long pathname + glob = overflow
https://www.cve.org/CVERecord?id=CVE-2001-0249
CVE-2002-0184 special characters in argument are not properly expanded
https://www.cve.org/CVERecord?id=CVE-2002-0184
CVE-2004-0434 small length value leads to heap overflow
https://www.cve.org/CVERecord?id=CVE-2004-0434
CVE-2002-1347 multiple variants
https://www.cve.org/CVERecord?id=CVE-2002-1347
CVE-2005-0490 needs closer investigation, but probably expansion-based
https://www.cve.org/CVERecord?id=CVE-2005-0490
CVE-2004-0940 needs closer investigation, but probably expansion-based
https://www.cve.org/CVERecord?id=CVE-2004-0940
CVE-2008-0599 Chain: Language interpreter calculates wrong buffer size (CWE-131) by using
"size = ptr ? X : Y" instead of "size = (ptr ? X : Y)" expression.
https://www.cve.org/CVERecord?id=CVE-2008-0599
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 742 CERT C Secure Coding Standard (2008) Chapter 9 -
Memory Management (MEM)
734 2345
MemberOf 802 2010 Top 25 - Risky Resource Management 800 2354
MemberOf 865 2011 Top 25 - Risky Resource Management 900 2371
MemberOf 876 CERT C++ Secure Coding Section 08 - Memory
Management (MEM)
868 2376
MemberOf 884 CWE Cross-section 884 2567
MemberOf 974 SFP Secondary Cluster: Incorrect Buffer Length
Computation
888 2406
MemberOf 1158 SEI CERT C Coding Standard - Guidelines 04. Integers
(INT)
1154 2456
MemberOf 1162 SEI CERT C Coding Standard - Guidelines 08. Memory
Management (MEM)
1154 2458
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Maintenance
This is a broad category. Some examples include: simple math errors, incorrectly updating
parallel counters, not accounting for size differences when "transforming" one input to another
format (e.g. URL canonicalization or other transformation that can generate a result that's larger
than the original input, i.e. "expansion"). This level of detail is rarely available in public reports, so
it is difficult to find good examples.
Maintenance
This weakness may be a composite or a chain. It also may contain layering or perspective
differences. This issue may be associated with many different types of incorrect calculations
(CWE-682), although the integer overflow (CWE-190) is probably the most prevalent. This
CWE Version 4.14
CWE-131: Incorrect Calculation of Buffer Size
CWE-131: Incorrect Calculation of Buffer Size