CVE-2024-3935

CVE-2024-3935 affects Eclipse Mosquitto: 2.0.0–2.0.18 expose a double-free crash when a broker with an outgoing bridge uses topic remapping and receives a crafted PUBLISH from a remote connection. Connected advisories confirm the issue across multiple distributions and show remediation through up...

CVE-2024-10525 Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its onsubscribe callback. This affects the mosquittosub and mosquittorr clients...

CVE-2024-10525 Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its onsubscribe callback. This affects the mosquittosub and mosquittorr clients...

CVE-2024-10525

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its onsubscribe callback. This affects the mosquittosub and mosquittorr clients...

CVE-2024-10525

CVE-2024-10525 concerns Eclipse Mosquitto. A crafted SUBACK packet with no reason codes could cause out-of-bounds memory access in libmosquitto when handling on_subscribe, affecting mosquitto_sub and mosquitto_rr clients. Affected range is from 1.3.2 through 2.0.18 per the CVE summary. Connected ...

CVE-2024-10525 Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its onsubscribe callback. This affects the mosquittosub and mosquittorr clients...

CVE-2024-10525

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its onsubscribe callback. This affects the mosquittosub and mosquittorr clients...

Eclipse Mosquitto 安全漏洞

Eclipse Mosquitto is an open source messaging agent software suite from the Eclipse Foundation. A security vulnerability exists in Eclipse Mosquitto versions 2.0.0 through 2.0.18, which stems from If the Mosquitto agent is set up with an outgoing bridge that remaps incoming topics, it may cause a...

Eclipse Mosquitto 安全漏洞

Eclipse Mosquitto is an open source messaging agent software suite from the Eclipse Foundation. A security vulnerability exists in Eclipse Mosquitto versions 1.3.2 through 2.0.18, which originates from an out-of-bounds memory access that may occur if a malicious agent sends a specially crafted...

PT-2024-8324

Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 2.0.0 through 2.0.18 Description: The issue is related to a double free error in Eclipse Mosquitto. When a Mosquitto broker is configured to create an outgoing bridge connection with an incoming topic that uses topi...

PT-2024-8325

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.3.2 through 2.0.18 Description The issue is related to a buffer overflow in dynamic memory. If a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of boun...

ROS-20241017-02

Vulnerability in the "CONNECT", "DISCONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" components of the message broker Eclipse Mosquitto is related to segmentation errors. Exploitation of the vulnerability could allow an attacker, acting remotely, to gain access to sensitive...

SUSE CVE-2024-8376

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets...

Fedora: Security Advisory (FEDORA-2024-e36b567b66)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-f71b7dad10)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: mosquitto-2.0.19-1.fc39

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

Fedora 39 : mosquitto (2024-f71b7dad10)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f71b7dad10 advisory. Update to 2.0.19 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 40 : mosquitto (2024-e36b567b66)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-e36b567b66 advisory. Update to 2.0.19 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2024-8376

A flaw was found in Eclipse Mosquitto. A remote attacker may be able to trigger memory leakage, segmentation fault, or a heap-use-after-free condition by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE", and "PUBLISH" packets...

CVE-2024-8376

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets...