Zephyrproject Zephyr vulnerabilities, page 5
299 vulnerabilities
Known vulnerabilities in Zephyrproject Zephyr, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-10061zephyrproject-rtoszephyr+1
EPSS score0.60%
Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.CVE-2020-10071zephyrproject-rtoszephyr+1EPSS score3.40%
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.CVE-2020-10058zephyrproject-rtoszephyr+1EPSS score0.40%
Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges. See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.CVE-2022-2993zephyrproject-rtoszephyr+1EPSS score0.59%
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.CVE-2022-2741zephyrproject-rtoszephyr+1EPSS score0.64%
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).CVE-2022-1041zephyrproject-rtoszephyr+1EPSS score0.85%
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.CVE-2022-1042zephyrproject-rtoszephyr+1EPSS score0.80%
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.CVE-2022-1841zephyrproject-rtoszephyr+1EPSS score0.57%
In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.CVE-2022-0553zephyrproject-rtoszephyr+1EPSS score0.28%
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.CVE-2022-3806zephyrproject-rtoszephyr+1EPSS score1.01%
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.CVE-2017-14201zephyrshell+1EPSS score1.10%
Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.CVE-2017-14202zephyrshell+1EPSS score0.57%
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.CVE-2017-14199zephyrgetaddrinfo+1EPSS score1.73%
A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.CVE-2024-1638zephyrproject-rtoszephyr+1EPSS score0.35%
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.CVE-2024-11263zephyrproject-rtoszephyr+1EPSS score0.17%
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.CVE-2024-4785zephyrproject-rtoszephyr+1EPSS score0.46%
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by ZeroCVE-2024-5931zephyrproject-rtoszephyr+1EPSS score0.45%
BT: Unchecked user input in bap_broadcast_assistantCVE-2024-5754zephyrproject-rtoszephyr+1EPSS score0.31%
BT: Encryption procedure host vulnerabilityCVE-2024-10395zephyrproject-rtoszephyr+1EPSS score0.31%
No proper validation of the length of user input in http_server_get_content_type_from_extension.CVE-2024-6135zephyrproject-rtoszephyr+1EPSS score0.44%
BT:Classic: Multiple missing buf length checks