CVE-2020-9395: Out-of-bounds Write (CWE-787)
value: An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8
Published: 2020-07-06T22:15Z
Repository: https://github.com/ambiot/amb1_arduino
Language: JSON
Files changed: Arduino_package/package_realtek.com_ameba1_index.json
Commit date: 2020-02-25 20:06:21 +0800
Commit message: Title: Update wlan library

Diff: diff --git a/Arduino_package/hardware/variants/rtl8195a/lib_wlan.a b/Arduino_package/hardware/variants/rtl8195a/lib_wlan.a
index d7bba11..872a92a 100644
Binary files a/Arduino_package/hardware/variants/rtl8195a/lib_wlan.a and b/Arduino_package/hardware/variants/rtl8195a/lib_wlan.a differ
diff --git a/Arduino_package/hardware/variants/rtl8710/lib_wlan.a b/Arduino_package/hardware/variants/rtl8710/lib_wlan.a
index a5066aa..872a92a 100644
Binary files a/Arduino_package/hardware/variants/rtl8710/lib_wlan.a and b/Arduino_package/hardware/variants/rtl8710/lib_wlan.a differ
diff --git a/Arduino_package/package_realtek.com_ameba1_index.json b/Arduino_package/package_realtek.com_ameba1_index.json
index d761904..a876b3d 100644
--- a/Arduino_package/package_realtek.com_ameba1_index.json
+++ b/Arduino_package/package_realtek.com_ameba1_index.json
@@ -11,10 +11,40 @@
 
       "platforms": [
 		{
           "name": "Realtek Ameba Boards (32-bits ARM Cortex-M3)",
           "architecture": "Ameba1",
+          "version": "2.0.6-v2",
+          "category": "Contributed",
+          "help": {
+            "online": "http://www.amebaiot.com/"
+          },
+          "url": "https://github.com/ambiot/amb1_arduino/raw/master/Arduino_package/release/ameba_1-2.0.6-v2.tar.gz",
+          "archiveFileName": "ameba_1-2.0.6-v2.tar.gz",
+          "checksum": "SHA-256:ae23b8a56008edafe70f8db3f304176fab014b7be8a5564ebeedaf0a5b02e3d1",
+          "size": "28100307",
+          "boards": [
+            {"name": "Ameba RTL8195A"},
+            {"name": "Ameba RTL8710"},
+            {"name": "Ameba RTL8711AM"}
+          ],
+          "toolsDependencies": [
+            {
+              "packager": "realtek",
+              "name": "ameba_1_arm-none-eabi-gcc",
+              "version": "4.8.3-2014q1"
+            },
+            {
+              "packager": "realtek",
+              "name": "ameba_1_tools",
+              "version": "1.1.1"
+            }
+          ]
+        },
+		{
+          "name": "Realtek Ameba Boards (32-bits ARM Cortex-M3)",
+          "architecture": "Ameba1",
           "version": "2.0.6",
           "category": "Contributed",
           "help": {
             "online": "http://www.amebaiot.com/"
           },
diff --git a/Arduino_package/release/ameba_1-2.0.6-v2.tar.gz b/Arduino_package/release/ameba_1-2.0.6-v2.tar.gz
new file mode 100644
index 0000000..85f2f72
Binary files /dev/null and b/Arduino_package/release/ameba_1-2.0.6-v2.tar.gz differ

Fixed code:           "version": "2.0.6-v2",
          "category": "Contributed",
          "help": {
            "online": "http://www.amebaiot.com/"
          },
          "url": "https://github.com/ambiot/amb1_arduino/raw/master/Arduino_package/release/ameba_1-2.0.6-v2.tar.gz",
          "archiveFileName": "ameba_1-2.0.6-v2.tar.gz",
          "checksum": "SHA-256:ae23b8a56008edafe70f8db3f304176fab014b7be8a5564ebeedaf0a5b02e3d1",
          "size": "28100307",
          "boards": [
            {"name": "Ameba RTL8195A"},
            {"name": "Ameba RTL8710"},
            {"name": "Ameba RTL8711AM"}
          ],
          "toolsDependencies": [
            {
              "packager": "realtek",
              "name": "ameba_1_arm-none-eabi-gcc",
              "version": "4.8.3-2014q1"
            },
            {
              "packager": "realtek",
              "name": "ameba_1_tools",
              "version": "1.1.1"
            }
          ]
        },
		{
          "name": "Realtek Ameba Boards (32-bits ARM Cortex-M3)",
          "architecture": "Ameba1",