VYPR

by Zephyrproject Rtos

Source repositories

CVEs (115)

CVESevRiskCVSSEPSSKEVPublishedDescription
CVE-2024-64440.000.00Oct 4, 2024No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
CVE-2024-64430.000.00Oct 4, 2024In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
CVE-2024-64420.000.00Oct 4, 2024In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
CVE-2024-62590.000.00Sep 13, 2024BT: HCI: adv_ext_report Improper discarding in adv_ext_report
CVE-2024-61370.000.00Sep 13, 2024BT: Classic: SDP OOB access in get_att_search_list
CVE-2024-61350.000.00Sep 13, 2024BT:Classic: Multiple missing buf length checks
CVE-2024-59310.000.00Sep 13, 2024BT: Unchecked user input in bap_broadcast_assistant
CVE-2024-62580.000.00Sep 13, 2024BT: Missing length checks of net_buf in rfcomm_handle_data
CVE-2024-57540.000.00Sep 13, 2024BT: Encryption procedure host vulnerability
CVE-2024-47850.000.00Aug 19, 2024BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
CVE-2024-33320.000.00Jul 3, 2024A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
CVE-2024-30770.000.00Mar 29, 2024An malicious BLE device can crash BLE victim device by sending malformed gatt packet
CVE-2023-70600.000.00Mar 15, 2024Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
CVE-2023-68810.000.00Feb 20, 2024Possible buffer overflow in is_mount_point
CVE-2024-16380.000.00Feb 19, 2024The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.
CVE-2023-57790.000.00Feb 18, 2024can: out of bounds in remove_rx_filter function
CVE-2023-62490.000.00Feb 18, 2024Signed to unsigned conversion esp32_ipm_send
CVE-2023-67490.000.00Feb 18, 2024Unchecked length coming from user input in settings shell
CVE-2023-50550.000.01Nov 21, 2023Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
CVE-2023-44240.000.00Nov 21, 2023An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.

Page 2 of 6