Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised devi…
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, a…
Parameters are not validated or sanitized, and are later used in various internal operations.
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabl…
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiat…
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exp…
A denial-of-service issue in the dns implemenation could cause an infinite loop.
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is lar…
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect compu…
No proper validation of the length of user input in http_server_get_content_type_from_extension.
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata sectio…
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
BT: Unchecked user input in bap_broadcast_assistant
BT:Classic: Multiple missing buf length checks
BT: Classic: SDP OOB access in get_att_search_list
BT: Encryption procedure host vulnerability
BT: Missing length checks of net_buf in rfcomm_handle_data
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the desti…
Possible buffer overflow in is_mount_point
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write …
Signed to unsigned conversion esp32_ipm_send
can: out of bounds in remove_rx_filter function