312
Nature Type ID Name Page
MemberOf 726 OWASP Top Ten 2004 Category A5 - Buffer Overflows 711 2336
MemberOf 741 CERT C Secure Coding Standard (2008) Chapter 8 -
Characters and Strings (STR)
734 2344
MemberOf 802 2010 Top 25 - Risky Resource Management 800 2354
MemberOf 865 2011 Top 25 - Risky Resource Management 900 2371
MemberOf 875 CERT C++ Secure Coding Section 07 - Characters and
Strings (STR)
868 2376
MemberOf 884 CWE Cross-section 884 2567
MemberOf 970 SFP Secondary Cluster: Faulty Buffer Access 888 2405
MemberOf 1129 CISQ Quality Measures (2016) - Reliability 1128 2440
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1161 SEI CERT C Coding Standard - Guidelines 07.
Characters and Strings (STR)
1154 2458
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Relationship
At the code level, stack-based and heap-based overflows do not differ significantly, so there
usually is not a need to distinguish them. From the attacker perspective, they can be quite
different, since different techniques are required to exploit them.
Terminology
Many issues that are now called "buffer overflows" are substantively different than the "classic"
overflow, including entirely different bug types that rely on overflow exploit techniques, such as
integer signedness errors, integer overflows, and format string bugs. This imprecise terminology
can make it difficult to determine which variant is being reported.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unbounded Transfer ('classic overflow')
7 Pernicious Kingdoms Buffer Overflow
CLASP Buffer overflow
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
OWASP Top Ten 2004 A5 CWE More Specific Buffer Overflows
CERT C Secure Coding STR31-C Exact Guarantee that storage for strings has
sufficient space for character data and
the null terminator
WASC 7 Buffer Overflow
Software Fault Patterns SFP8 Faulty Buffer Access
OMG ASCSM ASCSMCWE-