CVE-2019-11779

In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...

CVE-2019-11779

CVE-2019-11779 affects Eclipse Mosquitto versions 1.5.0–1.6.5 (inclusive). A crafted MQTT SUBSCRIBE packet with a topic containing about 65,400 or more '/' characters can trigger a stack overflow in the broker, causing a denial of service. Public references show that the root cause is handling of...

Eclipse Mosquitto Resource Management Error Vulnerability

Eclipse Mosquitto is the Eclipse Foundation's set of open source messaging agent software . A resource management error vulnerability exists in Eclipse Mosquitto versions 1.6.0 through 1.6.4. The vulnerability arises from a networked system or product that mismanages system resources e.g., memory...

CVE-2019-11779

In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...

The vulnerability of the Eclipse OpenJ9 virtual machine, related to synchronization errors when using a shared resource, allows a perpetrator to cause memory corruption.

The vulnerability of the Eclipse OpenJ9 virtual machine is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability can allow an attacker operating remotely to cause memory corruption...

The vulnerability of the String.getBytes(int, int, byte[], int) method in the Eclipse OpenJ9 virtual machine allows a attacker to execute arbitrary code.

The vulnerability of the String.getBytesint, int, byte, int method in the Eclipse OpenJ9 virtual machine is related to writing data beyond the buffer boundaries. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

PT-2019-4894 · Eclipse +3 · Eclipse Mosquitto +3

Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 1.5.0 through 1.6.5 Description: The issue is related to insufficient exception state checking, which can be exploited by a remote attacker to cause a denial of service. This can happen when a malicious MQTT client...

CVE-2019-11778

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...

DEBIAN-CVE-2019-11778

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...

CVE-2019-11778

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...

CVE-2019-11778

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...

Design/Logic Flaw

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...

CVE-2019-11778

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...

CVE-2019-11778

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which h...

CVE-2019-11778

CVE-2019-11778 affects Eclipse Mosquitto 1.6.0–1.6.4. When an MQTT v5 client connects, and the will delay interval is longer than the session expiry interval, a use-after-free error may occur, potentially causing a crash in some situations. The connected Red Hat/SUSE and OSV entries reiterate the...

PT-2019-12495 · Eclipse +1 · Eclipse Mosquitto +1

Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 1.6.0 through 1.6.4 Description: A use after free error occurs when an MQTT v5 client connects to the affected Eclipse Mosquitto versions, sets a last will and testament, a will delay interval, and a session expiry...

at.ac.ait.lablink.clients:csvclient (=0.0.1), at.ac.ait.lablink.clients:dpbridge (=0.0.1) +344 more potentially affected by CVE-2019-11777 via org.eclipse.paho:org.eclipse.paho.client.mqttv3 (>=1.0.2 <=1.2.0)

org.eclipse.paho:org.eclipse.paho.client.mqttv3 MAVEN version =1.0.2, =0.0.1, =0.0.2, =0.1.0, =1.0-RELEASE, =3.0.0.RELEASE, =2.2.0, =0.0.14, =0.0.15 and more Source cves: CVE-2019-11777 Source advisory: OSV:GHSA-63QC-P2X4-9FGF...

GHSA-63QC-P2X4-9FGF Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information...

Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information...

Security Bulletin: Vulnerability in Eclipse Jetty affecting Rational Functional Tester

Summary There is a vulnerability in Eclipse Jetty used by Rational Functional Tester RFT versions 9.1.1.1, 9.2.1.1 and 9.5.0.0. RFT has addressed the applicable CVE. Vulnerability Details Rational Functional Tester has addressed the following vulnerability: CVEID: CVE-2018-12545 DESCRIPTION:...