arXiv:2611.14164v1 Announce Type: cross Abstract: Vulnerabilities in applications, including browsers, media players, online services and document readers, etc. are often exploited and cause a serious damage. The vulnerabilities could exist in your system maybe because of some coding errors, design oversights, outdated software, AI generated codes or maybe transferred from another system during development (e.g., code clones). The propagation of software vulnerabilities is a critical concern in cybersecurity. This study examines the root cause problem of vulnerabilities propagation with experiments. We analyzed the propagation of CVE (Common Vulnerabilities and Exposures) based vulnerabilities within and between different software projects (IntraProject vs. InterProject). We performed several experiments on CVE based vulnerability dataset (retrieved from NVD source) by using our vulnerability detection tool (SQVDT). In the results, we discovered similar patterns of vulnerable code in several very famous recently used software, including latest version of Linux, Android operating systems, and in thousands of open source projects available on GitHub. We found several very high severity level (CVSS) vulnerabilities that propagated from one system to another system, just because of copy/paste (reuse) the code. Furthermore, we performed an empirical evaluation and verification of these vulnerable patterns that propagated to other systems by also considering the frequency of their propagation. Finlay, we recommended the impact of these vulnerabilities propagation on the interconnected systems.
Continue to arXiv Software Engineering →You are being forwarded in 6s — stay on this page