CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2020-10022 – UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array
https://notcve.org/view.php?id=CVE-2020-10022
11 May 2020 — A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions. Una carga útil JSON malformada que es recibida desde un servidor UpdateHub puede desencadenar una corrupción de la memoria en el Sistema Operativo Zephyr. Esto podría resu... • https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10022 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10021 – Out-of-bounds write in USB Mass Storage with unaligned sizes
https://notcve.org/view.php?id=CVE-2020-10021
11 May 2020 — Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions. Una Escritura fuera de límites en el Almacenamiento Masivo USB en el manejador memoryWrite con Tamaños no alineados. Consulte NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026. Este problema afecta a: zephyrproject-rtos zephyr versión 1.14.1 y versiones posteriores. Versión 2.1.0 y... • https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10021 • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10019 – Buffer Overflow in USB DFU requested length
https://notcve.org/view.php?id=CVE-2020-10019
11 May 2020 — USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions. USB DFU presenta un potencial desbordamiento del búfer donde la longitud requerida (wLength) no es comparada con el tamaño del búfer. Esto podría ser usado por un host USB malicioso para ex... • https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10019 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14201 – The shell DNS command can cause unpredictable results due to misuse of stack variables.
https://notcve.org/view.php?id=CVE-2017-14201
29 Aug 2019 — Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all. Usar la vulnerabilidad Después de la liberación en el shell de Zephyr permite que un usuario conectado en serie o telnet cause la denegación de servicio, y posiblemente la ejecución remota de código. Este problema afecta a: las versiones del proyectil Zephyr anteriores a 1.14.0 en todas. • https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14202 – The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.
https://notcve.org/view.php?id=CVE-2017-14202
29 Aug 2019 — Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all. Una Restricción Inapropiada de Operaciones dentro de los Límites de una vulnerabilidad del Búfer de la Memoria en el componente shell de Zephyr, permite a un usuario conectado serial o telnet causar un bloqueo, posiblemente con ... • https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-14199
https://notcve.org/view.php?id=CVE-2017-14199
12 Apr 2019 — A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0. Una vulnerabilidad de tipo buffer overflow ha sido encontrada en la implementación de getaddrinfo() de Zephyr Project, versiones 1.9.0 y 1.10.0. • https://github.com/zephyrproject-rtos/zephyr/pull/6158 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000800
https://notcve.org/view.php?id=CVE-2018-1000800
06 Sep 2018 — zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs (system sys_ring_buf_get() and sys_ring_buf_put). zephyr-rtos 1.12.0 contiene una vulnerabilidad de desreferencia de puntero NULL en sys_ring_buf_put() y sys_ring_buf_get() que puede resultar en un fallo de página de CPU (código de er... • https://github.com/zephyrproject-rtos/zephyr/issues/7638 • CWE-476: NULL Pointer Dereference •