Product:

Zephyr

(Zephyrproject)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 83
Date Id Summary Products Score Patch Annotated
2023-09-27 CVE-2023-5184  Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers. Zephyr 8.8
2023-11-21 CVE-2023-5055 Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Zephyr 9.8
2023-11-21 CVE-2023-4424 An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device. Zephyr 8.8
2023-10-13 CVE-2023-5563 The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception. Zephyr 7.5
2023-09-25 CVE-2023-4258 In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee. Zephyr 6.5
2023-07-10 CVE-2023-2234 Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. Zephyr 8.8
2023-01-11 CVE-2022-0553 There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily. Zephyr 4.6
2023-07-10 CVE-2023-1902 The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer. Zephyr 8.0
2023-07-10 CVE-2023-0359 A missing nullptr-check in handle_ra_input can cause a nullptr-deref. Zephyr 7.5
2023-07-10 CVE-2023-1901 The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer. Zephyr 8.0