CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20579
https://notcve.org/view.php?id=CVE-2018-20579
28 Dec 2018 — Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an out-of-bounds write of an '{' or '[' character. Contiki-NG, en versiones anteriores a la 4.2, tiene un desbordamiento de búfer basado en pila en la función push en os/lib/json/jsonparse.c que permite una escritura fuera de límites de un carácter "{" o "[". • https://github.com/contiki-ng/contiki-ng/issues/601 • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 6%CPEs: 1EXPL: 1CVE-2018-19417
https://notcve.org/view.php?id=CVE-2018-19417
21 Nov 2018 — An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length header uses memcpy to input data into a fixed size buffer. The allocated buffer can fit only MQTT_MAX_TOPIC_LENGTH (default 64) bytes, and a length check is missing. This could lead to Remote Code Execution via a stack-smashing attack (overwriting the function return address). Contiki-NG does not separate the MQTT server from other servers and the OS... • https://github.com/contiki-ng/contiki-ng/issues/600 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 11%CPEs: 1EXPL: 1CVE-2018-1000804
https://notcve.org/view.php?id=CVE-2018-1000804
08 Oct 2018 — contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote Code Execution on device using Contiki-NG operating system. This attack appear to be exploitable via Attacker must be able to run malicious AQL code (e.g. via SQL-like Injection attack). contiki-ng 4 contiene una vulnerabilidad de desbordamiento de búfer en el motor de la base de datos AQL (Antelope Query Language) que puede resultar en que un atacante... • https://github.com/contiki-ng/contiki-ng/issues/594 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •