CVSS: 10.0EPSS: 1%CPEs: 10EXPL: 0CVE-2024-27099 – Azure IoT Platform Device SDK Double Free Vulnerability
https://notcve.org/view.php?id=CVE-2024-27099
27 Feb 2024 — The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987. uAMQP es una librería C para la comunicación de AMQP 1.0 con Azure Cloud Services. Al procesar un estado fallido `AMQP_VALUE` incorrecto, puede causar un problema de doble liberación. • https://github.com/Azure/azure-uamqp-c/commit/2ca42b6e4e098af2d17e487814a91d05f6ae4987 • CWE-415: Double Free •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2024-21646 – Azure IoT Platform Device SDK Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-21646
09 Jan 2024 — Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01. Azure uAMQP es una librería C de uso general para AMQP 1.0. • https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-190: Integer Overflow or Wraparound •