Rezultati pretraživanja za 'Proizvođač: zephyrproject'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-9263 | 6.5 | The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment (sc=0) always carries a 3-byte time | 2026-07-06 19:43:06 | 2026-06-30 17:16:26 |
| CVE-2026-10655 | 6.5 | The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file descriptor directly from the calling thread immediately after detaching it from the network socket service, without synchronizing with th | 2026-07-06 19:42:27 | 2026-06-30 17:16:20 |
| CVE-2026-10654 | 3.1 | A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISC | 2026-07-06 19:41:51 | 2026-06-30 17:16:20 |
| CVE-2026-10658 | 7.1 | A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv() (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the code pulls a TS SDU header (8 bytes, | 2026-07-06 19:40:19 | 2026-06-23 01:16:26 |
| CVE-2026-10645 | 4.9 | Zephyr's ext2 directory-entry parser does not fully validate on-disk directory entry structure before copying the entry name and advancing traversal state. In ext2_fetch_direntry() (subsys/fs/ext2/ext2_diskops.c), the code only checks de_name_len <= | 2026-07-06 19:39:29 | 2026-06-23 01:16:26 |
| CVE-2026-10642 | 6.5 | The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-driven application callback while the TX interrupt mask bit (PL011_IMSC_TXIM) is set, to wor | 2026-07-02 14:23:20 | 2026-06-24 22:16:46 |
| CVE-2026-10636 | 3.7 | In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the packet had been handed to net_send_data(). On the successful-send path the packet's last refe | 2026-07-01 14:34:49 | 2026-06-16 15:16:33 |
| CVE-2026-10637 | 5.9 | subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/ | 2026-07-01 14:21:41 | 2026-06-16 15:16:33 |
| CVE-2026-10648 | 6.2 | mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet po | 2026-07-01 13:59:27 | 2026-06-29 23:16:42 |
| CVE-2026-10640 | 4.2 | Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) had already returned | 2026-06-26 20:50:24 | 2026-06-16 15:16:34 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/18
Zapisa po stranici: