Zephyrproject Zephyr 1.14.1 Release Candidate 2

CPE Details

Zephyrproject Zephyr 1.14.1 Release Candidate 2
zephyrproject
zephyr
1.14.1
2020-05-14
10h06 +00:00
2020-05-14
10h06 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:o:zephyrproject:zephyr:1.14.1:rc2:*:*:*:*:*:*

Informations

Vendor

zephyrproject

Product

zephyr

Version

1.14.1

Update

rc2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2025-1674 2025-02-25 07h18 +00:00 A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
8.2
Haute
CVE-2025-1673 2025-02-25 07h12 +00:00 A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
8.2
Haute
CVE-2024-8798 2024-12-15 23h23 +00:00 No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
7.5
Haute
CVE-2024-11263 2024-11-15 22h53 +00:00 When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
9.4
Critique
CVE-2024-6444 2024-10-04 06h14 +00:00 No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
6.5
Moyen
CVE-2024-6443 2024-10-04 05h56 +00:00 In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
6.5
Moyen
CVE-2024-6442 2024-10-04 05h36 +00:00 In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
6.5
Moyen
CVE-2024-6259 2024-09-13 20h17 +00:00 BT: HCI: adv_ext_report Improper discarding in adv_ext_report
7.6
Haute
CVE-2024-6137 2024-09-13 20h06 +00:00 BT: Classic: SDP OOB access in get_att_search_list
7.6
Haute
CVE-2024-6135 2024-09-13 19h51 +00:00 BT:Classic: Multiple missing buf length checks
7.6
Haute
CVE-2024-5931 2024-09-13 19h41 +00:00 BT: Unchecked user input in bap_broadcast_assistant
6.5
Moyen
CVE-2024-6258 2024-09-13 19h05 +00:00 BT: Missing length checks of net_buf in rfcomm_handle_data
6.8
Moyen
CVE-2024-5754 2024-09-13 18h50 +00:00 BT: Encryption procedure host vulnerability
8.2
Haute
CVE-2024-4785 2024-08-19 20h15 +00:00 BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
7.6
Haute
CVE-2024-3332 2024-07-03 16h44 +00:00 A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
6.5
Moyen
CVE-2024-3077 2024-03-29 05h06 +00:00 An malicious BLE device can crash BLE victim device by sending malformed gatt packet
6.8
Moyen
CVE-2023-7060 2024-03-15 18h12 +00:00 Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
8.6
Haute
CVE-2023-6881 2024-02-20 18h25 +00:00 Possible buffer overflow in is_mount_point
9.8
Critique
CVE-2024-1638 2024-02-19 21h19 +00:00 The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.
9.1
Critique
CVE-2023-5779 2024-02-18 07h46 +00:00 can: out of bounds in remove_rx_filter function
9.8
Critique
CVE-2023-6249 2024-02-18 07h27 +00:00 Signed to unsigned conversion esp32_ipm_send
9.8
Critique
CVE-2023-6749 2024-02-18 07h04 +00:00 Unchecked length coming from user input in settings shell
9.8
Critique
CVE-2023-5055 2023-11-21 18h05 +00:00 Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
9.8
Critique
CVE-2023-4424 2023-11-21 06h42 +00:00 An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
8.8
Haute
CVE-2023-5139 2023-10-26 04h40 +00:00 Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
7.8
Haute
CVE-2023-5753 2023-10-24 16h09 +00:00 Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
8.8
Haute
CVE-2023-4257 2023-10-13 21h09 +00:00 Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
9.8
Critique
CVE-2023-4263 2023-10-13 20h42 +00:00 Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
8.8
Haute
CVE-2023-5563 2023-10-12 23h11 +00:00 The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.
7.5
Haute
CVE-2023-3725 2023-10-06 20h10 +00:00 Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
9.8
Critique
CVE-2023-5184 2023-09-27 17h26 +00:00 Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers.
8.8
Haute
CVE-2023-4260 2023-09-26 19h23 +00:00 Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
10
Critique
CVE-2023-4264 2023-09-26 18h34 +00:00 Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem.
9.6
Critique
CVE-2023-4259 2023-09-25 23h05 +00:00 Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.
8.8
Haute
CVE-2023-4258 2023-09-25 21h46 +00:00 In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
8.6
Haute
CVE-2023-4265 2023-08-12 22h09 +00:00 Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841
6.8
Moyen
CVE-2023-1901 2023-07-10 04h37 +00:00 The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
8
Haute
CVE-2023-2234 2023-07-10 04h33 +00:00 Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.
8.8
Haute
CVE-2023-1902 2023-07-10 04h30 +00:00 The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
8
Haute
CVE-2023-0359 2023-07-10 04h21 +00:00 A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
7.5
Haute
CVE-2023-0779 2023-05-30 00h00 +00:00 At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
7.7
Haute
CVE-2022-3806 2023-01-19 00h00 +00:00 Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
9.8
Critique
CVE-2023-0396 2023-01-19 00h00 +00:00 A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
6.8
Moyen
CVE-2023-0397 2023-01-19 00h00 +00:00 A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
9.6
Critique
CVE-2021-3966 2023-01-11 00h00 +00:00 usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.
9.6
Critique
CVE-2022-0553 2023-01-11 00h00 +00:00 There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.
6.5
Moyen
CVE-2022-2993 2022-12-12 01h50 +00:00 There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
9.8
Critique
CVE-2022-2741 2022-10-31 17h45 +00:00 The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).
8.2
Haute
CVE-2022-1841 2022-08-31 19h40 +00:00 In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.
7.2
Haute
CVE-2022-1042 2022-07-26 04h25 +00:00 In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
8.8
Haute
CVE-2022-1041 2022-07-26 04h25 +00:00 In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
8.8
Haute
CVE-2021-3432 2022-06-28 19h45 +00:00 Invalid interval in CONNECT_IND leads to Division by Zero. Zephyr versions >= v1.14.0 Divide By Zero (CWE-369). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7364-p4wc-8mj4
7.5
Haute
CVE-2021-3430 2022-06-28 19h45 +00:00 Assertion reachable with repeated LL_CONNECTION_PARAM_REQ. Zephyr versions >= v1.14 contain Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr
7.5
Haute
CVE-2021-3510 2021-10-05 20h50 +00:00 Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4
7.5
Haute
CVE-2020-13603 2021-05-24 21h40 +00:00 Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94vp-8gc2-rm45
7.8
Haute
CVE-2020-13602 2021-05-24 21h40 +00:00 Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-g9mg-fj58-6fqh
5.5
Moyen
CVE-2020-13601 2021-05-24 21h40 +00:00 Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44
9.8
Critique
CVE-2020-13600 2021-05-24 21h40 +00:00 Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hx4p-j86p-2mhr
7.6
Haute
CVE-2020-13599 2021-05-24 21h40 +00:00 Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5qhg-j6wc-4f6q
3.3
Bas
CVE-2020-13598 2021-05-24 21h40 +00:00 FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat. Zephyr versions >= v1.14.2, >= v2.3.0 contain Stack-based Buffer Overflow (CWE-121). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7fhv-rgxr-x56h
7.8
Haute
CVE-2020-10072 2021-05-24 21h40 +00:00 Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges (CWE-280). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xc
5.9
Moyen
CVE-2020-10069 2021-05-24 21h40 +00:00 Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Parameters (CWE-233). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-f6vh-7v4x-8fjp
6.5
Moyen
CVE-2020-10066 2021-05-24 21h40 +00:00 Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr
5.7
Moyen
CVE-2020-10065 2021-05-24 21h40 +00:00 Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c
8.8
Haute
CVE-2020-10064 2021-05-24 21h40 +00:00 Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gvq-h42f-v3c7
9.8
Critique
CVE-2020-10071 2020-06-05 17h37 +00:00 The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
9.8
Critique
CVE-2020-10070 2020-06-05 17h37 +00:00 In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
9.8
Critique
CVE-2020-10063 2020-06-05 17h37 +00:00 A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
7.5
Haute
CVE-2020-10062 2020-06-05 17h37 +00:00 An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
9.8
Critique
CVE-2020-10067 2020-05-11 22h26 +00:00 A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the kernel. See NCC-ZEP-005 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
7.8
Haute
CVE-2020-10023 2020-05-11 22h26 +00:00 The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or possibly code execution within the Zephyr kernel. See NCC-NCC-019 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
6.9
Moyen
CVE-2020-10021 2020-05-11 22h26 +00:00 Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
8.1
Haute
CVE-2020-10019 2020-05-11 22h26 +00:00 USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
8.1
Haute
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.