Rezultati pretraživanja za 'Proizvođač: zephyrproject'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-2411 | 6.5 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified securi | 2026-09-01 00:16:43 | 2026-08-01 13:16:57 |
| CVE-2026-7007 | 4.6 | The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify t | 2026-09-01 00:16:43 | 2026-07-24 15:19:08 |
| CVE-2026-11368 | 7.1 | The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf des | 2026-09-01 00:16:41 | 2026-08-04 15:16:24 |
| CVE-2026-10849 | 8.2 | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes | 2026-09-01 00:16:40 | 2026-08-03 22:16:47 |
| CVE-2026-10848 | 7.0 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, toke | 2026-09-01 00:16:40 | 2026-08-02 17:16:58 |
| CVE-2026-10774 | 2.4 | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabl | 2026-09-01 00:16:40 | 2026-08-02 15:16:33 |
| CVE-2026-10773 | 5.4 | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds check. The guard used msg_type <= sizeof(name) instead of msg_type <= ARRAY_SIZE(name); siz | 2026-09-01 00:16:39 | 2026-08-01 13:16:56 |
| CVE-2026-10685 | 7.6 | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public | 2026-09-01 00:16:39 | 2026-07-31 15:16:27 |
| CVE-2026-10683 | 2.4 | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The ST | 2026-09-01 00:16:38 | 2026-07-27 19:17:14 |
| CVE-2026-10659 | 4.7 | The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the dhara_nand_ callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dhara_error_t err pointer (e.g. *err = DH | 2026-09-01 00:16:37 | 2026-07-07 13:16:29 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/18
Zapisa po stranici: