Function Call With Incorrect Argument Type
CWE-686
The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
Latest Function Call With Incorrect Argument Type vulnerabilities
- 9.1 Critical severity
Pillow: Function Call With Incorrect Argument Type
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through
- 7.3 High severity
zbus_polkit: Time-of-check Time-of-use (TOCTOU) Race Condition
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i).
- 9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.