Product:

Zephyr

(Zephyrproject)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 105
Date Id Summary Products Score Patch Annotated
2023-07-10 CVE-2023-2234 Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. Zephyr 8.8
2023-08-12 CVE-2023-4265 Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841 Zephyr 6.8
2023-09-25 CVE-2023-4258 In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee. Zephyr 6.5
2023-09-26 CVE-2023-4259 Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. Zephyr 8.8
2023-10-06 CVE-2023-3725 Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem Zephyr 9.8
2023-10-13 CVE-2023-5563 The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception. Zephyr 7.5
2023-10-13 CVE-2023-4263 Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver Zephyr 8.8
2023-10-13 CVE-2023-4257 Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Zephyr 9.8
2023-10-26 CVE-2023-5139 Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver Zephyr 7.8
2023-11-21 CVE-2023-4424 An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device. Zephyr 8.8