Integer Coercion Error
CWE-192
Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
We track 2 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5.
How this weakness is prevented
- Requirements: A language which throws exceptions on ambiguous data casts might be chosen.
- Architecture and Design: Design objects and program flow such that multiple or complex casts are unnecessary
- Implementation: Ensure that any data type casting that you must use is entirely understood in order to reduce the plausibility of error in use.
Latest Integer Coercion Error vulnerabilities
- 7.3 High severity
libxml2: Integer Coercion Error
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of
- 7.8 High severity
kernel: Incorrect Conversion between Numeric Types
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potent