Out-of-bounds

An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 destination options does not check for a valid length of the destination options header. This results in an Out-of-Bounds Read, and, depending on the memory protection mechanism, this may result in Denial-of-Service in...

Design/Logic Flaw

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in picotcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Servic...

Integer overflow

An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter than 8 bytes. If the size of the incoming ICMPv6 request packet is shorter than this, the operation that calculates the size of the ICMPv6...

Buffer overflow

An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field and deducing whether the IPv6 extension headers are valid doesn't check whether the header extension length field would overflow. Therefore, if it wraps around to zero, iterating through the extension heade...

Type confusion

An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 headers does not validate whether the IPv6 payload length field is equal to the actual size of the payload, which leads to an Out-of-Bounds read during the ICMPv6 checksum calculation, resulting in either Denial-of-Service...

Design/Logic Flaw

An issue was discovered in picoTCP 1.7.0. The code for parsing the hop-by-hop IPv6 extension headers does not validate the bounds of the extension header length value, which may result in Integer Wraparound. Therefore, a crafted extension header length value may cause Denial-of-Service because it...

Out-of-bounds

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing...

Out-of-bounds

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in picomdnshandledataasanswersgeneric in picomdns.c does not check whether the number of answers/responses specified in a DNS packet header corresponds to the response data available in the...

Code injection

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is provided in an incoming TCP packet, it is possible to cause a Denial-of-Service by achieving an infinite loop in the code that parses TCP options, aka tcpparseoptions in picotcp.c...

CVE-2020-24341

CVE-2020-24341 affects picoTCP and picoTCP-NG up to v1.7.0. The TCP input data processing in pico_tcp.c does not validate the length of incoming TCP packets, causing out-of-bounds reads and potential DoS or information leakage. Affected: picoTCP and picoTCP-NG. Mitigation: upgrade to the latest p...

CVE-2020-24341

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in picotcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Servic...

CVE-2020-24340

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in picomdnshandledataasanswersgeneric in picomdns.c does not check whether the number of answers/responses specified in a DNS packet header corresponds to the response data available in the...

CVE-2020-24340

The CVE-2020-24340 issue affects picoTCP/picoTCP-NG (through 1.7.0) in the DNS response processing code path pico_mdns_handle_data_as_answers_generic() in pico_mdns.c, where it fails to validate that the header’s number of DNS answers matches the actual packet data. This can cause an out-of-bound...

CVE-2020-24339

The CVE concerns picoTCP/picoTCP-NG up to version 1.7.0 where DNS domain name decompression (pico_dns_decompress_name in pico_dns_common.c) does not validate compression pointer offsets against the DNS packet data, causing out-of-bounds reads and Denial-of-Service. The issue affects picoTCP and p...

CVE-2020-24339

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing...

CVE-2020-24338

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds writ...

CVE-2020-24338

Summary of CVE-2020-24338 (AMNESIA:33) from provided sources : It affects picoTCP (and picoTCP-NG) up to version 1.7.0, where DNS domain name record decompression in pico_dns_decompress_name() fails to validate compression pointer offsets against DNS response data. This can cause out-of-bounds wr...

CVE-2020-24337

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is provided in an incoming TCP packet, it is possible to cause a Denial-of-Service by achieving an infinite loop in the code that parses TCP options, aka tcpparseoptions in picotcp.c...

CVE-2020-24337

CVE-2020-24337 concerns picoTCP and picoTCP-NG (up to v1.7.0). The issue arises when an incoming TCP packet contains an unsupported TCP option with zero length, which can cause an infinite loop in tcp_parse_options() in pico_tcp.c, leading to a Denial-of-Service. Public sources (NVD, SUSE) descri...

CVE-2020-17445

An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 destination options does not check for a valid length of the destination options header. This results in an Out-of-Bounds Read, and, depending on the memory protection mechanism, this may result in Denial-of-Service in...