1741
Reference Description
CVE-2006-5051 Chain: Signal handler contains too much functionality (CWE-828), introducing
a race condition (CWE-362) that leads to a double free (CWE-415).
https://www.cve.org/CVERecord?id=CVE-2006-5051
CVE-2001-1349 unsafe calls to library functions from signal handler
https://www.cve.org/CVERecord?id=CVE-2001-1349
CVE-2004-0794 SIGURG can be used to remotely interrupt signal handler; other variants exist.
https://www.cve.org/CVERecord?id=CVE-2004-0794
CVE-2004-2259 SIGCHLD signal to FTP server can cause crash under heavy load while
executing non-reentrant functions like malloc/free.
https://www.cve.org/CVERecord?id=CVE-2004-2259
CVE-2002-1563 SIGCHLD not blocked in a daemon loop while counter is modified, causing
counter to get out of sync.
https://www.cve.org/CVERecord?id=CVE-2002-1563
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding SIG31-C Do not access or modify shared objects
in signal handlers
References
[REF-360]Michal Zalewski. "Delivering Signals for Fun and Profit". < https://lcamtuf.coredump.cx/
signals.txt >.2023-04-07.
[REF-361]"Race Condition: Signal Handling". < https://vulncat.fortify.com/en/detail?
id=desc.structural.cpp.race_condition_signal_handling#:~:text=Signal%20handling%20race
%20conditions%20can,installed%20to%20handle%20multiple%20signals.s >.2023-04-07.
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Weakness ID : 829
Structure : Simple
Abstraction : Base
Description
The product imports, requires, or includes executable functionality (such as a library) from a source
that is outside of the intended control sphere.
Extended Description
When including third-party functionality, such as a web widget, library, or other source of
functionality, the product must effectively trust that functionality. Without sufficient protection
mechanisms, the functionality could be malicious in nature (either by coming from an untrusted
source, being spoofed, or being modified in transit from a trusted source). The functionality might
also contain its own weaknesses, or grant access to additional functionality and state information
that should be kept private to the base system, such as system state information, sensitive
application data, or the DOM of a web application.
CWE Version 4.14
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CWE-829: Inclusion of Functionality from Untrusted Control Sphere