2203 matches found
PT-2020-11896
Name of the Vulnerable Software and Affected Versions zephyr version 2.2.0 and later versions Description The issue is related to improper bounds checking in the Zephyr Project MQTT code, which can lead to memory corruption and possibly remote code execution. Recommendations For zephyr version...
PT-2020-11897
Name of the Vulnerable Software and Affected Versions zephyr version 2.2.0 and later versions Description The issue is related to insufficient checking of the length field on publish messages in the Zephyr MQTT parsing code, which can lead to a buffer overflow and potentially allow remote code...
PT-2020-11892
Name of the Vulnerable Software and Affected Versions zephyr version 2.2.0 and later versions Description An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. Recommendations For zephyr version 2.2.0 and later...
Zephyr USB Mass Storage Buffer Overflow Vulnerability
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation in the U.S. USB Mass Storage is one of the USB mass storage components. A buffer overflow vulnerability exists in USB Mass Storage in Zephyr versions 1.14.1 and later and 2.1.0 and later. An attacker...
Zephyr Buffer Overflow Vulnerability (CNVD-2020-35000)
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A buffer overflow vulnerability exists in the USB DFU in Zephyr version 1.14.1 and later and version 2.1.0 and later. A remote attacker could exploit this vulnerability to execute code...
Zephyr Input Validation Error Vulnerability (CNVD-2020-29631)
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. Zephyr suffers from an input validation error vulnerability that stems from the program not performing parameter validation when making multiple system calls. No details of the vulnerability are...
Unspecified Vulnerability in Zephyr
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. An unspecified vulnerability exists in Zephyr. An attacker could exploit this vulnerability to elevate privileges...
Zephyr Input Validation Error Vulnerability (CNVD-2020-35003)
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. An input validation error vulnerability exists in the Kscan subsystem in Zephyr 2.1.0 and later fixed in version 2.2.0, which stems from the program failing to perform sufficient parameter validation...
Zephyr Input Validation Error Vulnerability
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. Zephyr suffers from an input validation error vulnerability. An attacker could use this vulnerability to bypass security checks performed by the system call handler, potentially causing a denial of...
Zephyr Trust Management Issues Vulnerabilities
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A trust management issue vulnerability exists in the UpdateHub module in Zephyr 2.1.0 and later fixed in version 2.2.0, which stems from the program disabling DTLS peer checking. An attacker could use...
Zephyr Buffer Overflow Vulnerability
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. Zephyr suffers from a buffer overflow vulnerability. An attacker could exploit this vulnerability to cause a denial of service or code execution memory corruption...
Zephyr Code Execution Vulnerability
Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A security vulnerability exists in Zephyr versions 2.1.0 and later and 2.2.0 and later. An attacker can exploit this vulnerability by sending a malformed JSON file to the UpdateHub server to cause a...
CVE-2020-10060
In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...
CVE-2020-10067
A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the...
CVE-2020-10060
In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...
CVE-2020-10021
Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions...
CVE-2020-10058
Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges. See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions...
CVE-2020-10027
An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions...
CVE-2020-10022
A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later...