CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13120
https://notcve.org/view.php?id=CVE-2019-13120
07 Oct 2019 — Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT Thing, which interacts with an associated vulnerable MQTT message in the application, specific circumstances could trigger this vulnerability. Amazon FreeRTOS hasta la versión v1.4.8, incluido, carece de verificación de longitud en ... • https://aws.amazon.com/cn/freertos/security-updates • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2018-16602
https://notcve.org/view.php?id=CVE-2018-16602
06 Dec 2018 — An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of DHCP responses in prvProcessDHCPReplies can be used for information disclosure. Se ha descubierto un problema en Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect. El acceso fue... • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2018-16599
https://notcve.org/view.php?id=CVE-2018-16599
06 Dec 2018 — An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of NBNS packets in prvTreatNBNS can be used for information disclosure. Se ha descubierto un problema en Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect. El acceso fuera de límit... • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 2%CPEs: 2EXPL: 1CVE-2018-16525
https://notcve.org/view.php?id=CVE-2018-16525
06 Dec 2018 — Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to execute arbitrary code or leak information because of a Buffer Overflow during parsing of DNS\LLMNR packets in prvParseDNSReply. Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect permiten que atacantes remotos ejecuten código... • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2018-16527
https://notcve.org/view.php?id=CVE-2018-16527
06 Dec 2018 — Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow information disclosure during parsing of ICMP packets in prvProcessICMPPacket. Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect permiten la divulgación de información durante el análisis de los paquetes ICMP en prvProcessICMPPacket. • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 2%CPEs: 2EXPL: 1CVE-2018-16526
https://notcve.org/view.php?id=CVE-2018-16526
06 Dec 2018 — Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow remote attackers to leak information or execute arbitrary code because of a Buffer Overflow during generation of a protocol checksum in usGenerateProtocolChecksum and prvProcessIPPacket. Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect permiten... • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details •
CVSS: 8.1EPSS: 2%CPEs: 2EXPL: 1CVE-2018-16601
https://notcve.org/view.php?id=CVE-2018-16601
06 Dec 2018 — An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. A crafted IP header triggers a full memory space copy in prvProcessIPPacket, leading to denial of service and possibly remote code execution. Se ha descubierto un problema en Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connec... • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 1CVE-2018-16523
https://notcve.org/view.php?id=CVE-2018-16523
06 Dec 2018 — Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow division by zero in prvCheckOptions. Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect permiten la división entre cero en prvCheckOptions. • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details • CWE-369: Divide By Zero •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2018-16598
https://notcve.org/view.php?id=CVE-2018-16598
06 Dec 2018 — An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a sent DNS request. Se ha descubierto un problema en Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1, FreeRTOS hasta V10.0.1 (con FreeRTOS+TCP) y el componente middleware TCP/IP WITTENSTEIN WHIS Connect.... • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details • CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16522
https://notcve.org/view.php?id=CVE-2018-16522
06 Dec 2018 — Amazon Web Services (AWS) FreeRTOS through 1.3.1 has an uninitialized pointer free in SOCKETS_SetSockOpt. Amazon Web Services (AWS) FreeRTOS hasta la versión 1.3.1 tiene un puntero liberado sin inicializar en SOCKETS_SetSockOpt. • https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details • CWE-824: Access of Uninitialized Pointer •