Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Zephyr
(Zephyrproject)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 91 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-09-13 | CVE-2024-6258 | BT: Missing length checks of net_buf in rfcomm_handle_data | Zephyr | 6.5 | ||
| 2024-09-13 | CVE-2024-5931 | BT: Unchecked user input in bap_broadcast_assistant | Zephyr | 6.5 | ||
| 2024-09-13 | CVE-2024-6135 | BT:Classic: Multiple missing buf length checks | Zephyr | 6.5 | ||
| 2024-09-13 | CVE-2024-6137 | BT: Classic: SDP OOB access in get_att_search_list | Zephyr | 6.5 | ||
| 2024-09-13 | CVE-2024-6259 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report | Zephyr | 6.5 | ||
| 2021-05-25 | CVE-2020-10065 | Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c | Zephyr | 8.8 | ||
| 2020-05-11 | CVE-2020-10060 | In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later... | Zephyr | 6.5 | ||
| 2020-06-05 | CVE-2020-10061 | Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions. | Zephyr | 8.8 | ||
| 2021-05-25 | CVE-2020-10064 | Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gvq-h42f-v3c7 | Zephyr | 9.8 | ||
| 2021-05-25 | CVE-2020-10066 | Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr | Zephyr | 5.7 |