Information disclosure

An issue was discovered in Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of ARP packets in eARPProcessPacket can be used for information disclosure...

Remote code execution

An issue was discovered in Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component. A crafted IP header triggers a full memory space copy in prvProcessIPPacket, leading to denial of service and possibly...

CVE-2018-16600

An issue was discovered in Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of ARP packets in eARPProcessPacket can be used for information disclosure...

CVE-2018-16527

Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of ICMP packets in prvProcessICMPPacket...

CVE-2018-16524

CVE-2018-16524 affects AWS FreeRTOS up to v1.3.1, FreeRTOS up to v10.0.1 (with FreeRTOS+TCP), and the WITTENSTEIN WHIS Connect TCP/IP component. It enables information disclosure during parsing of TCP options in prvCheckOptions. Impact is information exposure; remediation is to update to AWS Free...

CVE-2018-16603

CVE-2018-16603 affects AWS FreeRTOS up to v1.3.1 and FreeRTOS up to v10.0.1 (with FreeRTOS+TCP), plus the WHIS Connect TCP/IP component. The issue is an out-of-bounds access in the TCP stack: processing received TCP packets can leak data by corrupting access to TCP source/destination port fields ...

CVE-2018-16599

An issue was discovered in Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of NBNS packets in prvTreatNBNS can be used for information disclosure...

CVE-2018-16601

CVE-2018-16601 affects AWS FreeRTOS up to 1.3.1, FreeRTOS up to v10.0.1 with FreeRTOS+TCP, and the WHIS Connect TCP/IP component. A crafted IP header can trigger a full memory space copy in prvProcessIPPacket, leading to denial of service and possibly remote code execution. Public details in the ...

CVE-2018-16603

An issue was discovered in Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds access to TCP source and destination port fields in xProcessReceivedTCPPacket can leak data back to an...

CVE-2018-16599

Technical details for CVE-2018-16599 are not publicly available in the provided connected documents; monitor for updates.

CVE-2018-16602

The CVE-2018-16602 entry concerns AWS FreeRTOS (and related FreeRTOS+TCP/OpenWHIS) through 1.3.1 and FreeRTOS up to 10.0.1 with FreeRTOS+TCP, plus WITTENSTEIN WHIS Connect middleware. The issue is an Out-of-bounds memory access during parsing of DHCP responses in prvProcessDHCPReplies, which can ...

CVE-2018-16526

CVE-2018-16526 affects AWS FreeRTOS up to v1.3.1, FreeRTOS up to v10.0.1 (with FreeRTOS+TCP), and the WHIS Connect TCP/IP component. The root cause is a buffer overflow during generation of a protocol checksum in two functions: usGenerateProtocolChecksum and prvProcessIPPacket , enabling remote a...

CVE-2018-16526

Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to leak information or execute arbitrary code because of a Buffer Overflow during generation of a protocol checksum in...

CVE-2018-16523

The CVE-2018-16523 issue affects AWS FreeRTOS up to v1.3.1 and FreeRTOS up to v10.0.1 (with FreeRTOS+TCP) and the WHIS Connect TCP/IP module, caused by a division by zero in prvCheckOptions within the TCP/IP stack. ThreatPost and related sources confirm the vulnerability exists in the FreeRTOS TC...

CVE-2018-16598

An issue was discovered in Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a...

CVE-2018-16598

The CVE-2018-16598 issue affects AWS FreeRTOS up to 1.3.1 (and FreeRTOS up to v10.0.1 with FreeRTOS+TCP) and the WHIS Connect TCP/IP component. The vulnerability is that in xProcessReceivedUDPPacket and prvParseDNSReply, any DNS response is accepted without confirming it matches a sent DNS reques...

CVE-2018-16523

Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component allow division by zero in prvCheckOptions...

CVE-2018-16600

An issue was discovered in Amazon Web Services AWS FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 with FreeRTOS+TCP, and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of ARP packets in eARPProcessPacket can be used for information disclosure...

[SECURITY] Fedora 28 Update: glusterfs-4.1.6-1.fc28

GlusterFS is a distributed file-system capable of scaling to several petabytes. It aggregates various storage bricks over Infiniband RDMA or TCP/IP interconnect into one large parallel network file system. GlusterFS is one of the most sophisticated file systems in terms of features and...

Synaccess netBooter NP-02x/NP-08x 6.8 - Authentication Bypass

Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass Vendor: Synaccess Networks Inc. Product web page: https://www.synaccess-net.com Affected version: NP-0201D ver 6.8C NP-02 ver 6.5C NP-02 ver 6.4BC NP-0801D ver 6.4A NP-08 ver 6.10 NP-02 ver 5.53BC Summary: netBooter NP-02B and NP-02BH...