PT-2021-9659

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14.2 and later, 2.3.0 and later Description The issue is related to incorrect default permissions, which can lead to security problems with settings and littlefs. Recommendations For Zephyr versions 1.14.2 and later, 2.3.0 an...

CVE-2020-13598: Stack-based Buffer Overflow

FS: Buffer Overflow when enabling Long File Names in FATFS and calling fsstat. Zephyr versions = v1.14.2, = v2.3.0 contain Stack-based Buffer Overflow CWE-121. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7fhv-rgxr-x56h...

CVE-2020-10065: Improper Handling of Length Parameter Inconsistency

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

PT-2021-9660

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14.2 and later Zephyr versions 2.3.0 and later Description The issue is related to a malformed SPI in response for eswifi, which can corrupt kernel memory. It is described as a Heap-based Buffer Overflow. Recommendations For...

CVE-2020-10072: Improper Handling of Insufficient Permissions or Privileges

Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges CWE-280. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xc...

CVE-2020-13601: Out-of-bounds Read

Possible read out of bounds in dns read. Zephyr versions = 1.14.2, = 2.3.0 contain Out-of-bounds Read CWE-125. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44...

PT-2021-9658

Name of the Vulnerable Software and Affected Versions Zephyr versions = v1.14.2, = v2.3.0 Description A buffer overflow issue occurs when Long File Names are enabled in FAT FS and the fs stat function is called, resulting in a stack-based buffer overflow. Recommendations For Zephyr versions =...

PT-2021-9137

Name of the Vulnerable Software and Affected Versions Zephyr versions = v1.14.2, = v2.2.0 Description The issue is related to improper input frame validation in ieee802154 processing, which can lead to stack-based and heap-based buffer overflows. Recommendations For Zephyr versions = v1.14.2, =...

PT-2021-9139

Name of the Vulnerable Software and Affected Versions Zephyr versions = v1.14.2, = v2.2.0 Description The issue is related to incorrect error handling in the Bluetooth HCI core, which contains a NULL Pointer Dereference. Recommendations For Zephyr versions = v1.14.2, = v2.2.0, at the moment, ther...

CVE-2020-10064: Stack-based Buffer Overflow

Improper Input Frame Validation in ieee802154 Processing. Zephyr versions = v1.14.2, = v2.2.0 contain Stack-based Buffer Overflow CWE-121, Heap-based Buffer Overflow CWE-122. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gvq-h42f-v3c7...

PT-2021-9140

Name of the Vulnerable Software and Affected Versions Zephyr versions = v1.14.2, = v2.2.0 Description The issue results in a denial of service due to unchecked packet data in Zephyr Bluetooth. This is caused by improper handling of parameters. Recommendations For Zephyr versions = v1.14.2, =...

CVE-2020-10069: Improper Handling of Parameters

Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Parameters CWE-233. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-f6vh-7v4x-8fjp...

PT-2021-4200

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14.2 and later, 2.4.0 and later Description The issue is related to an integer overflow in memory allocating functions, which may allow an attacker to impact the confidentiality, integrity, and availability of protected...

CVE-2021-3322

Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions = =2.4.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3...

CVE-2021-3330

RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr. Zephyr versions = =2.4.0 contain Out-of-bounds Write CWE-787. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456...

CVE-2021-3320

Type Confusion in 802154 ACK Frames Handling. Zephyr versions = v2.4.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-27r3-rxch-2hm7...

CVE-2021-3323

Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions = =2.4.0 contain Integer Underflow Wrap or Wraparound CWE-191. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc...

CVE-2021-3321

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions = =2.4.0 contain Integer Overflow to Buffer Overflow CWE-680. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99...

CloudBees Jenkins Zephyr Enterprise Test Management Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Zephyr Enterprise Test Management Plugin is used in one of...

Unspecified Vulnerability in CloudBees Jenkins Zephyr for JIRA Test Management Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Zephyr for JIRA Test Management Plugin is used...