CVE-2017-2891

An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request...

CVE-2017-2891

Cesanta Mongoose 6.8 is affected by a use-after-free vulnerability in its HTTP server CGI handling. In this CVE, an ordinary HTTP POST targeting a CGI script can cause a previously freed mg_connection structure to be dereferenced later in mg_cgi_ev_handler, potentially enabling remote code execut...

CVE-2017-2909

An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over the network to trigger this vulnerability...

CVE-2017-2921

An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause an integer overflow, leading to a heap buffer overflow and resulting in denial of service and potential remote code execution. An...

CVE-2017-2891

An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request...

CVE-2017-2892

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code...

CVE-2017-2894

An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet ove...

CVE-2017-2895

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker...

CVE-2017-2922

An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to...

CVE-2017-2893

An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can cause a NULL pointer dereference leading to server crash and denial of service. An attacker needs to send a specially crafted MQTT packet ove...

CVE-2017-2922: Use After Free

An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to...

CVE-2017-2894: Out-of-bounds Write

An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet ove...

PT-2017-15599

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8 Description A use-after-free issue exists in the HTTP server implementation, potentially allowing remote code execution. This can be triggered by an ordinary HTTP POST request with a CGI target, causing a reuse of ...

PT-2017-15618

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8 Description A memory corruption issue exists in the Websocket protocol implementation. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers, leading to a use-after-fr...

PT-2017-15600

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8 Description An arbitrary memory read issue exists in the MQTT packet parsing functionality. A specially crafted MQTT packet can cause an out-of-bounds memory read and write, potentially resulting in information...

PT-2017-15603

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8 Description An arbitrary memory read issue exists in the MQTT packet parsing functionality. A specially crafted MQTT SUBSCRIBE packet can cause an out-of-bounds memory read, potentially resulting in information...

CVE-2017-2895: Out-of-bounds Read

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker...

PT-2017-15607

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8 Description A programming error in the DNS server functionality can cause an infinite loop when a specially crafted DNS request is received, resulting in high CPU usage and Denial Of Service. An attacker can trigge...

PT-2017-15601

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8 Description A NULL pointer dereference issue exists in the MQTT packet parsing functionality. This can be triggered by an MQTT SUBSCRIBE packet, causing a server crash and denial of service. An attacker can exploit...

PT-2017-15617

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 6.8 Description A memory corruption issue exists in the Websocket protocol implementation. A specially crafted websocket packet can cause an integer overflow, leading to a heap buffer overflow, which may result in deni...