Microsoft Warns of 25 Critical Vulnerabilities in IoT, Industrial Devices

Security researchers at Microsoft are warning the industry about 25 as-yet undocumented critical memory-allocation vulnerabilities across a number of vendors’ IoT and industrial devices that threat actors could exploit to execute malicious code across a network or cause an entire system to crash...

Microsoft Finds 'BadAlloc' Flaws Affecting Wide-Range of IoT and OT Devices

Microsoft researchers on Thursday disclosed two dozen vulnerabilities affecting a wide range of Internet of Things IoT and Operational Technology OT devices used in industrial, medical, and enterprise networks that could be abused by adversaries to execute arbitrary code and even cause critical...

EulerOS 2.0 SP3 : kernel (EulerOS-SA-2021-1808)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...

eCosCentric eCosPro Input Validation Error Vulnerability

eCosCentric eCosPro is a software application from eCosCentric, Inc. It combines the feature set, stability and quality of support required for commercial embedded application development with eCos. eCosCentric eCosPro Versions suffers from an Input Validation Error vulnerability that stems from ...

EulerOS 2.0 SP3 : soundtouch (EulerOS-SA-2021-1849)

According to the versions of the soundtouch package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - soundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock...

EulerOS 2.0 SP3 : libplist (EulerOS-SA-2021-1812)

According to the versions of the libplist package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process...

NXP MCUXpresso Software Development Kit Input Validation Error Vulnerability

The NXP MCUXpresso Software Development Kit is an application system from the Dutch company NXP. It is used to simplify and accelerate the development of applications with ARM's Cortex NXP-M based devices, including general purpose, crossover and Bluetooth microcontrollers. An input validation...

klibc 输入验证错误漏洞

klibc is an application program. Provides the ability to work with as many early starts from kernel space as possible. klibc versions prior to 2.0.9 are vulnerable to an input validation error that stems from an addition in the malloc function that could lead to an integer overflow and subsequent...

uClibc-ng Input Validation Error Vulnerability

uclibc-ng is an application. Small C library for Linux. An input validation error vulnerability exists in versions prior to uClibc-ng 1.0.37, which stems from being susceptible to integer wrapping by the malloc-simple function. This incorrect memory allocation could lead to arbitrary memory...

OPENSUSE-SU-2021:0628-1 Security update for nim

This update for nim fixes the following issues: num was updated to version 1.2.12: Fixed GC crash resulting from inlining of the memory allocation procs Fixed “incorrect raises effect for $NimNode” 17454 From version 1.2.10: Fixed “JS backend doesn’t handle float-int type conversion “ 8404 Fixed...

Buffer Overflow

podofo is vulnerable to buffer overflow. The vulnerability exists due to a an attempted excessive memory allocation in PoDoFo::podofocalloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp...

“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks

Microsoft’s Section 52, the Azure Defender for IoT security research group, recently uncovered a series of critical memory allocation vulnerabilities in IoT and OT devices that adversaries could exploit to bypass security controls in order to execute malicious code or cause a system crash. These...

“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks

Microsoft’s Section 52, the Azure Defender for IoT security research group, recently uncovered a series of critical memory allocation vulnerabilities in IoT and OT devices that adversaries could exploit to bypass security controls in order to execute malicious code or cause a system crash. These...

ARM Mbed OS 输入验证错误漏洞

ARM Mbed OS is a suite of open source embedded operating systems dedicated to the Internet of Things from ARM UK. Arm mbed 6.3.0 suffers from an input validation error vulnerability that stems from incorrect memory allocation could lead to arbitrary memory allocation, which could result in...

PT-2021-4215 · Texas Instruments · Ti-Rtos

Name of the Vulnerable Software and Affected Versions: Texas Instruments TI-RTOS affected versions not specified Description: The issue is related to an integer overflow vulnerability in the HeapMem allocUnprotected function. This vulnerability can be triggered when the malloc function returns a...

Tencent OS-tiny 输入验证错误漏洞

Tencent OS-tiny is a real-time operating system developed by Tencent for the Internet of Things IoT. It is characterized by low power consumption, low resource consumption, modularity, security and reliability, which can effectively improve the development efficiency of IoT terminal products. An...

uC-OS2 输入验证错误漏洞

uC-OS2 is an operating system. portable, ROM-able, scalable, preemptive real-time deterministic multitasking kernel for microprocessors, microcontrollers and DSPs. An input validation error vulnerability exists in the uC-OS2 version and prior versions, which stems from the fact that unvalidated...

ARM CMSIS-RTOS 输入验证错误漏洞

ARM CMSIS-RTOS is an application from ARM UK. It is used to create applications that perform multiple tasks simultaneously. An input validation error vulnerability exists in ARM CMSIS-RTOS versions prior to 2.1.3, which stems from the fact that incorrect memory allocation can lead to arbitrary...

MediaTek LinkIt SDK 输入验证错误漏洞

MediaTek LinkIt SDK is a MediaTek LinkIt open source application. An input validation error vulnerability exists in MediaTek LinkIt SDK versions prior to 4.6.1, which stems from an incorrect memory allocation can lead to arbitrary memory allocation, which can result in unexpected behavior such as...

ARM Mbed OS 输入验证错误漏洞

ARM Mbed OS is a suite of open source embedded operating systems dedicated to the Internet of Things from ARM UK. An input validation error vulnerability exists in the Arm mbed-uallaoc memory library version 1.3.0, which stems from the fact that incorrect memory allocation could lead to arbitrary...