Design/Logic Flaw

Inappropriate pointer order of mapsub and mapfreemap amclnode.cpp in Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions leads to a use-after-free...

CVE-2024-25196

Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions were discovered to contain a buffer overflow via the nav2controller process. This vulnerability is triggerd via sending a crafted .yaml file...

CVE-2024-25199

Inappropriate pointer order of mapsub and mapfreemap amclnode.cpp in Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions leads to a use-after-free...

CVE-2024-25197

Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions were discovered to contain a NULL pointer dereference via the isCurrent function at /src/layeredcostmap.cpp...

CVE-2024-25198

Inappropriate pointer order of laserscanfilter.reset and tflistener.reset amclnode.cpp in Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions leads to a use-after-free...

CVE-2024-25198

CVE-2024-25198 affects Open Robotics ROS 2 and Nav2 humble. The issue is an incorrect pointer order in amcl_node.cpp: laser_scan_filter_.reset() is called before tf_listener_.reset(), causing a use-after-free. Connected documents point to the Nav2/amcl changes and related GitHub PRs (e.g., naviga...

CVE-2024-25199

CVE-2024-25199 affects Open Robotics ROS 2 (2) and Nav2 humble, caused by an inappropriate pointer order between map_sub_ and map_free in amcl_node.cpp, leading to a use-after-free. The entry is supported by multiple sources (NVD, Red Hat, OSV, CVE lists) and notes a high-severity impact (I/H; A/...

CVE-2024-25197

CVE-2024-25197 affects Open Robotics ROS2 and Nav2 Humble; it is a NULL pointer dereference in isCurrent() within /src/layered_costmap.cpp. Affected components and exact root cause are described across multiple sources (ROS2/Nav2 humble). The CVSS metric indicates a network-exposed, low-privilege...

CVE-2024-25196

Open Robotics ROS 2 and Nav2 humble contain a buffer overflow in the nav2_controller process, triggerable by a crafted YAML file. Affected components: ROS 2, Nav2 (humble); root cause: uncontrolled memory handling in nav2_controller. Impact per sources: potential crash/denial by exploitation of Y...

CVE-2024-25199

Inappropriate pointer order of mapsub and mapfreemap amclnode.cpp in Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions leads to a use-after-free...

CVE-2024-25199

Inappropriate pointer order of mapsub and mapfreemap amclnode.cpp in Open Robotics Robotic Operating Sytstem 2 ROS2 and Nav2 humble versions leads to a use-after-free...

Design/Logic Flaw

An issue in the permission and access control components within ROS2 Foxy Fitzroy ROSVERSION=2 and ROSPYTHONVERSION=3 allows attackers to gain escalate privileges...

Command injection

An issue discovered in shell command execution in ROS2 Robot Operating System 2 Foxy Fitzroy, with ROSVERSION=2 and ROSPYTHONVERSION=3 allows an attacker to run arbitrary commands and cause other impacts...

Deserialization of untrusted data

Insecure deserialization in ROS2 Foxy Fitzroy ROSVERSION=2 and ROSPYTHONVERSION=3 allows attackers to execute arbitrary code via a crafted input...

Command injection

OS command injection vulnerability in command processing or system call componentsROS2 Robot Operating System 2 Foxy Fitzroy, with ROSVERSION=2 and ROSPYTHONVERSION=3 allows attackers to run arbitrary commands...

CVE-2023-51197

An issue in ROS2 Foxy Fitzroy allows command injection through shell command execution when ROS_VERSION=2 and ROS_PYTHON_VERSION=3. Root cause: vulnerable shell command pathway in ROS2. Impact: arbitrary commands and potential further effects as described. No exploit details provided in the docum...

CVE-2023-51202

CVE-2023-51202 is associated with an OS command injection in ROS 2, specifically in ROS2 Foxy Fitzroy. The vulnerability affects command processing/system call components with ROS_VERSION=2 and ROS_PYTHON_VERSION=3, potentially allowing an attacker to run arbitrary commands. Documents from PRION ...

Number withdrawn

ROS2 Foxy Fitzroy is an application of the ROS2 organization. This CVE number has been withdrawn...

CVE-2023-51204

CVE-2023-51204 was withdrawn (CNA) and is not an active vulnerability entry. Connected sources describe a separate vulnerability in ROS2 Foxy Fitzroy: insecure deserialization in ROS2 Foxy Fitzroy (ROS 2, ROS_VERSION=2; ROS_PYTHON_VERSION=3) that could allow arbitrary code execution via crafted i...

CVE-2023-51198

CVE-2023-51198 is described in the connected PRION document as a design/logic flaw in ROS2 Foxy Fitzroy (ROS2, Python 3) where a permission and access-control component weakness enables privilege escalation. The root cause is stated as an access-control issue that could allow attackers to gain hi...