CVE-2023-39541

A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a...

CVE-2023-39541

CVE-2023-39541 concerns Weston Embedded uC-TCP-IP v3.06.01, with a denial-of-service risk due to an out-of-bounds read in the ICMP/ICMPv6 parsing paths. The TALOS report confirms the vulnerability exists in the ICMPv4/IPv4 and ICMPv6/IPv6 parsing logic, triggering when processing crafted IPv4/IPv...

CVE-2023-39541

A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a...

CVE-2023-39540

A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a...

CVE-2023-45318

A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-45318

Weston Embedded uC-HTTP-server (CVE-2023-45318) suffers a heap-based buffer overflow in Protocol Version parsing of HTTP requests, triggered by a misupdated RxBufLenRem during HTTPsReq_ProtocolVerParse, enabling arbitrary code execution. Affected: Weston Embedded uC-HTTP git commit 80d4004 (and r...

CVE-2023-38562

A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets t...

CVE-2023-45318

A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-38562

Weston Embedded uC-TCP-IP v3.06.01 contains a double-free vulnerability in the IP header loopback parsing functionality. A specially crafted sequence of unauthenticated network packets can trigger memory corruption, potentially enabling code execution. Talos confirms CVE-2023-38562, identifies v3...

CVE-2023-45318

A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2023-38562

A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets t...

February 13, 2024—KB5034819 (Monthly Rollup)

February 13, 2024—KB5034819 Monthly Rollup Applies To Windows Server 2012 R2 ESU IMPORTANT The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows Server 2012 R2. For a successful installation, please make...

io.undertow:undertow-servlet (1.0.0.cr5), io.undertow:undertow-websockets-jsr (1.0.0.cr5) +2 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.cr5)

io.undertow:undertow-core MAVEN version 1.0.0.cr5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.cr5 - io.undertow:undertow-websockets-jsr 1.0.0.cr5 -...

io.undertow:undertow-http2-test-suite (1.3.0.beta13), io.undertow:undertow-servlet (1.3.0.beta13) +20 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.0.beta13)

io.undertow:undertow-core MAVEN version 1.3.0.beta13 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta13 - io.undertow:undertow-servlet 1.3.0.beta13 -...

CVE-2023-38562: Double Free

A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets t...

CVE-2023-39540: Buffer Over-read

A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a...

PT-2024-12738 · Unknown · Weston Embedded Uc-Tcp-Ip

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-TCP-IP version 3.06.01 Description: A double-free vulnerability exists in the IP header loopback parsing functionality. This can be triggered by a specially crafted set of network packets, leading to memory corruption and...

Weston Embedded uC-TCP-IP ICMP/ICMPv6 parsing denial of service vulnerabilities

Talos Vulnerability Report TALOS-2023-1828 Weston Embedded uC-TCP-IP ICMP/ICMPv6 parsing denial of service vulnerabilities February 20, 2024 CVE Number CVE-2023-39540,CVE-2023-39541 SUMMARY A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded...

Weston Embedded uC-HTTP HTTP Server heap-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1843 Weston Embedded uC-HTTP HTTP Server heap-based buffer overflow vulnerability February 20, 2024 CVE Number CVE-2023-45318 SUMMARY A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit...

PT-2024-2165 · Unknown · Weston Embedded Uc-Tcp-Ip

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-TCP-IP version 3.06.01 Description: A denial of service issue exists in the ICMP and ICMPv6 parsing functionality, related to an out-of-bounds read. This can be triggered by a specially crafted network packet, allowing a...