CWE-787 跨界内存写 类弱点 3165 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-787 越界写入是一种严重的内存安全漏洞，指程序向缓冲区边界之外或起始位置之前写入数据。攻击者利用此缺陷可覆盖相邻内存，导致程序崩溃、数据损坏，甚至通过精心构造的 payload 实现任意代码执行，从而完全控制目标系统。开发者应避免此类风险，需严格实施边界检查，使用安全的内存管理函数，启用编译器防护机制，并遵循最小权限原则，确保所有内存访问均在合法范围内。
int id_sequence[3]; /* Populate the id array. */ id_sequence[0] = 123; id_sequence[1] = 234; id_sequence[2] = 345; id_sequence[3] = 456;int returnChunkSize(void *) { /* if chunk info is valid, return the size of usable memory, * else, return -1 to indicate an error */ ... } int main() { ... memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1)); ... }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-6387 | Silicon Labs Gecko SDK 安全漏洞 — GSDK | 7.5 | High | 2024-02-02 |
| CVE-2023-45734 | OpenHarmony 安全漏洞 — OpenHarmony | 4.2 | Medium | 2024-02-02 |
| CVE-2023-52355 | LibTIFF 安全漏洞 | 7.5 | High | 2024-01-25 |
| CVE-2023-40547 | Shim 缓冲区错误漏洞 — Red Hat Enterprise Linux 7 | 8.3 | High | 2024-01-25 |
| CVE-2024-0409 | X.org Server 安全漏洞 | 7.8 | High | 2024-01-18 |
| CVE-2023-6816 | X.org Server 安全漏洞 — Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | 9.8 | Critical | 2024-01-18 |
| CVE-2024-0646 | Linux kernel 安全漏洞 | 7.0 | High | 2024-01-17 |
| CVE-2023-51743 | Hathway Router CM5100 缓冲区错误漏洞 — Skyworth Router CM5100 | 6.5 | Medium | 2024-01-17 |
| CVE-2023-51742 | Hathway Router CM5100 缓冲区错误漏洞 — Skyworth Router CM5100 | 6.5 | Medium | 2024-01-17 |
| CVE-2024-21591 | Juniper Networks Junos OS 缓冲区错误漏洞 — Junos OS | 9.8 | Critical | 2024-01-12 |
| CVE-2023-49128 | Siemens Solid Edge 缓冲区错误漏洞 — Solid Edge SE2023 | 7.8 | High | 2024-01-09 |
| CVE-2023-37419 | GTKWave 缓冲区错误漏洞 — GTKWave | 7.8 | High | 2024-01-08 |
| CVE-2023-37420 | GTKWave 缓冲区错误漏洞 — GTKWave | 7.8 | High | 2024-01-08 |
| CVE-2023-37416 | GTKWave 缓冲区错误漏洞 — GTKWave | 7.8 | High | 2024-01-08 |
| CVE-2023-37417 | GTKWave 缓冲区错误漏洞 — GTKWave | 7.8 | High | 2024-01-08 |
| CVE-2023-37418 | GTKWave 缓冲区错误漏洞 — GTKWave | 7.8 | High | 2024-01-08 |
| CVE-2021-40367 | Siemens Syngo FastView 缓冲区错误漏洞 — syngo fastView | 7.8 | High | 2024-01-04 |
| CVE-2021-42028 | Siemens Syngo FastView 缓冲区错误漏洞 — syngo fastView | 7.8 | High | 2024-01-04 |
| CVE-2022-2081 | Hitachi Energy RTU500 安全漏洞 — RTU500 series CMU firmware | 7.5 | High | 2024-01-04 |
| CVE-2023-50711 | vmm-sys-util 安全漏洞 — vmm-sys-util | 5.7 | Medium | 2024-01-02 |
| CVE-2023-5180 | Open Design Alliance Drawings SDK 安全漏洞 — ODA Drawings SDK - All Versions < 2024.12 | 7.8 | High | 2023-12-26 |
| CVE-2023-4255 | w3m 安全漏洞 — w3m | 5.5 | Medium | 2023-12-21 |
| CVE-2023-6931 | Linux kernel 缓冲区错误漏洞 — Linux Kernel | 7.8 | High | 2023-12-19 |
| CVE-2023-6228 | libtiff 安全漏洞 — Red Hat Enterprise Linux 8 | 3.3 | Low | 2023-12-18 |
| CVE-2023-48639 | Adobe Substance 3D Designer 缓冲区错误漏洞 — Substance3D - Designer | 7.8 | High | 2023-12-13 |
| CVE-2023-48632 | Adobe After Effects 缓冲区错误漏洞 — After Effects | 7.8 | High | 2023-12-13 |
| CVE-2023-48625 | Adobe Substance 3D Sampler 缓冲区错误漏洞 — Substance3D - Sampler | 7.8 | High | 2023-12-13 |
| CVE-2023-48627 | Adobe Substance 3D Sampler 缓冲区错误漏洞 — Substance3D - Sampler | 7.8 | High | 2023-12-13 |
| CVE-2023-48628 | Adobe Substance 3D Sampler 缓冲区错误漏洞 — Substance3D - Sampler | 7.8 | High | 2023-12-13 |
| CVE-2023-48630 | Adobe Substance 3D Sampler 缓冲区错误漏洞 — Substance3D - Sampler | 7.8 | High | 2023-12-13 |
CWE-787（跨界内存写） 是常见的弱点类别，本平台收录该类弱点关联的 3165 条 CVE 漏洞。