View source for Security bug

<!-- Please do not remove or change this AfD message until the discussion has been closed. -->
{{Article for deletion/dated|page=Security bug|timestamp=20250626080117|year=2025|month=June|day=26|substed=yes|help=off}}
<!-- Once discussion is closed, please place on talk page: {{Old AfD multi|page=Security bug|date=26 June 2025|result='''keep'''}} -->
<!-- End of AfD message, feel free to edit beyond this point -->
{{merge to|Vulnerability (computer security)|discuss=Talk:Vulnerability (computer security)#Merge proposal|date=May 2025}}
{{Short description|Type of software bug}}

A '''security bug''' or '''security defect''' is a [[software bug]] that can be exploited to gain unauthorized access or privileges on a computer system. Security bugs introduce [[Vulnerability (computing)|security vulnerabilities]] by compromising one or more of:
* [[Authentication]] of [[user (computing)|user]]s and other entities<ref name="mitre">{{cite web|title=CWE/SANS TOP 25 Most Dangerous Software Errors|url=http://cwe.mitre.org/top25/index.html#CWE-306|publisher=SANS|accessdate=13 July 2012}}</ref> 
* [[Authorization]] of [[access control|access rights]] and [[Privilege (computing)|privileges]]<ref name="mitre" /> 
* Data [[confidentiality]]
* [[Data integrity]]

Security bugs do not need be identified nor [[Exploit (computer security)|exploited]] to be qualified as such and are assumed to be much more common than known vulnerabilities in almost any system.

==Causes==
{{main|Vulnerability (computing)}}
Security bugs, like all other [[software bugs]], stem from [[root cause analysis|root causes]] that can generally be traced to either absent or inadequate:<ref>{{cite web|url=http://swreflections.blogspot.com/2008/11/software-quality-and-software-security.html|title=Software Quality and Software Security|date=2008-11-02|access-date=2017-04-28}}</ref>
* [[Software developer]] training
* [[Use case]] analysis
* [[Software engineering methodology]]
* [[Quality assurance]] testing
* and other [[best practice]]s

==Taxonomy==
Security bugs generally fall into a fairly small number of broad categories that include:<ref>{{Cite journal|last1=Alhazmi|first1=Omar H.|last2=Woo|first2=Sung-Whan|last3=Malaiya|first3=Yashwant K.|date=Jan 2006|title=Security vulnerability categories in major software systems|url=https://www.researchgate.net/publication/220885085|journal=Proceedings of the Third IASTED International Conference on Communication, Network, and Information Security}}</ref>
* [[Memory safety]] (e.g. [[buffer overflow]] and [[dangling pointer]] bugs)
* [[Race condition]]
* Secure input and output handling
* Faulty use of an [[API]]
* Improper [[use case]] handling
* Improper [[exception handling]]
* [[Resource leak]]s, often but not always due to improper exception handling
* Preprocessing input strings before they are checked for being acceptable

==Mitigation==
See [[software security assurance]].

== See also ==

* [[Computer security]]
* [[Hacking: The Art of Exploitation]]
* [[IT risk]]
* [[Threat (computer)]]
* [[Vulnerability (computing)]]
* [[Hardware bug]]
* [[Secure coding]]

==References==

{{Reflist}}

==Further reading==
* {{cite web| url=https://www.owasp.org/index.php/Top_10_2013-Top_10 |title=2013 Top 10 List |date=21 August 2015 |author=Open Web Application Security Project}}
* {{cite web|title=CWE/SANS TOP 25 Most Dangerous Software Errors|url=http://cwe.mitre.org/top25/index.html#CWE-862|publisher=SANS|accessdate=13 July 2012}}

{{Information security}}

[[Category:Computer security]]
[[Category:Software bugs]]
[[Category:Software testing]]