deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13831
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 7570 chipsets) software. The Trustonic Kinibi component allows arbitrary memory mapping. The Samsung ID is SVE-2019-16665 (June 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-13832
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code execution because of memory disclosure, The Samsung IDs are SVE-2020-17117, SVE-2020-17118, SVE-2020-17119, and SVE-2020-17161 (June 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-13833
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The system area allows arbitrary file overwrites via a symlink attack. The Samsung ID is SVE-2020-17183 (June 2020).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-59
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-13834
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software. Secure Folder does not properly restrict use of Android Debug Bridge (adb) for arbitrary installations. The Samsung ID is SVE-2020-17369 (June 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-13835
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials. The Samsung ID is SVE-2020-16908 (June 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-307
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-13836
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. HWRResProvider allows path traversal for data exposure. The Samsung ID is SVE-2020-16954 (June 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-13837
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. The Lockscreen feature does not block Quick Panel access to Music Share. The Samsung ID is SVE-2020-17145 (June 2020).
CVSS Score: 3.5 (LOW)
CWE: CWE-306
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-13838
Published: 2020-06-04
Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The DeX Lockscreen feature does not block access to Quick Panel and notifications. The Samsung ID is SVE-2020-17187 (June 2020).
CVSS Score: 3.5 (LOW)
CWE: CWE-306
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-7661
Published: 2020-06-04
Description: all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/kevva/url-regex/issues/70; https://snyk.io/vuln/SNYK-JS-URLREGEX-569472; https://github.com/kevva/url-regex/issues/70
CVE: CVE-2020-11679
Published: 2020-06-04
Description: Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fails to check that the request was submitted by an Administrator. This allows a normal user to escalate their privileges by adding additional roles to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html; http://seclists.org/fulldisclosure/2020/Jun/8; https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass
CVE: CVE-2020-11680
Published: 2020-06-04
Description: Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html; http://seclists.org/fulldisclosure/2020/Jun/8; https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass
CVE: CVE-2020-11681
Published: 2020-06-04
Description: Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html; http://seclists.org/fulldisclosure/2020/Jun/8; https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass
CVE: CVE-2020-11682
Published: 2020-06-04
Description: Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request will succeed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html; http://seclists.org/fulldisclosure/2020/Jun/8; https://www.securitymetrics.com/blog/where-did-request-come-from-cross-site-request-forgery-csrf
CVE: CVE-2020-12847
Published: 2020-06-04
Description: Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is possible to configure a few engines to be used by the mailer application to send emails. If the user selects the “sendmail” option as the default one, the web application offers to edit the full path where the sendmail binary is hosted. Since there is no restriction in place while editing this value, an attacker authenticated as an administrator user could force the web application into executing any arbitrary binary.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html; https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities
CVE: CVE-2020-12851
Published: 2020-06-04
Description: Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in the targeted user folders.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html; https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities
CVE: CVE-2020-12852
Published: 2020-06-04
Description: The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating its checksum and signature with the provided public key and finally replacing the current application binary. To complete the update process, the application’s service or appliance needs to be restarted. An attacker with administrator access can leverage the software update feature to force the application to download a custom binary that will replace current Pydio Cells binary. When the server or service is eventually restarted the attacker will be able to execute code under the privileges of the user running the application. In the Pydio Cells enterprise appliance this is with the privileges of the user named “pydio”.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html; https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities
CVE: CVE-2020-12853
Published: 2020-06-04
Description: Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal folders or accessible cells.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html; https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities; http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html
CVE: CVE-2020-13848
Published: 2020-06-04
Description: Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00030.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00033.html; https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0
CVE: CVE-2020-13768
Published: 2020-06-04
Description: In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601. NOTE: this product is discontinued.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/sartlabs/OSCE-Prep/blob/9a9d2471a9de09457f970be4ea1b57a74d26705a/My%20CVEs/Minishare_BOF_PUT.py; https://github.com/sartlabs/OSCE-Prep/blob/9a9d2471a9de09457f970be4ea1b57a74d26705a/My%20CVEs/Minishare_BOF_PUT.py
CVE: CVE-2020-13849
Published: 2020-06-04
Description: The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://doi.org/10.3390/s20102932; https://www.mdpi.com/1424-8220/20/10/2932; https://doi.org/10.3390/s20102932
CVE: CVE-2020-13839
Published: 2020-06-05
Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler buffer overflow. The LG ID is LVE-SMP-200007 (June 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-13840
Published: 2020-06-05
Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler buffer overflow. The LG ID is LVE-SMP-200008 (June 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-13841
Published: 2020-06-05
Description: An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrictions. The LG ID is LVE-SMP-200009 (June 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-13842
Published: 2020-06-05
Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it is unused. The LG ID is LVE-SMP-200010 (June 2020).
CVSS Score: 7.8 (HIGH)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-13843
Published: 2020-06-05
Description: An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020).
CVSS Score: 5.5 (MEDIUM)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-12848
Published: 2020-06-05
Description: In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and proceed to login to the web application. Once logged into the web application with the hidden user account, some actions that were not available with the public share link can now be performed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html; https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities
CVE: CVE-2020-12849
Published: 2020-06-05
Description: Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html; https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities
CVE: CVE-2020-10543
Published: 2020-06-05
Description: Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
CVSS Score: 8.2 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html; https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod; https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
CVE: CVE-2020-10878
Published: 2020-06-05
Description: Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html; https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod; https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
CVE: CVE-2020-11492
Published: 2020-06-05
Description: An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://docs.docker.com/docker-for-windows/release-notes/; https://www.pentestpartners.com/security-blog/docker-desktop-for-windows-privesc-cve-2020-11492/; https://docs.docker.com/docker-for-windows/release-notes/
CVE: CVE-2020-11975
Published: 2020-06-05
Description: Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
CVSS Score: 9.8 (CRITICAL)
References: http://unomi.apache.org/security/cve-2020-11975.txt; https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3E; https://lists.apache.org/thread.html/r79672c25e0ef9bb4b[PII_REDACTED]200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E
CVE: CVE-2020-12723
Published: 2020-06-05
Description: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html; https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod; https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
CVE: CVE-2020-1883
Published: 2020-06-05
Description: Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuously performing specific operations. Successful exploitation of this vulnerability can cause service abnormal.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-401
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200603-01-memory-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200603-01-memory-en
CVE: CVE-2020-9074
Published: 2020-06-05
Description: Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability. A component cannot deal with an exception correctly. Attackers can exploit this vulnerability by sending malformed message. This could compromise normal service of affected phones.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200603-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200603-01-smartphone-en
CVE: CVE-2020-9859
Published: 2020-06-05
Description: A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://support.apple.com/HT211214; https://support.apple.com/HT211214; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9859
CVE: CVE-2020-13816
Published: 2020-06-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-13817. Reason: This candidate is a reservation duplicate of CVE-2020-13817. Notes: All CVE users should reference CVE-2020-13817 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-4229
Published: 2020-06-05
Description: IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain unauthorized access to a user's session. IBM X-Force ID: 175211.
CVSS Score: 7.3 (HIGH)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175211; https://www.ibm.com/support/pages/node/6220230; https://exchange.xforce.ibmcloud.com/vulnerabilities/175211
CVE: CVE-2020-4448
Published: 2020-06-05
Description: IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181228; https://www.ibm.com/support/pages/node/6220336; https://www.zerodayinitiative.com/advisories/ZDI-20-688/
CVE: CVE-2020-4449
Published: 2020-06-05
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181230; https://www.ibm.com/support/pages/node/6220296; https://www.zerodayinitiative.com/advisories/ZDI-20-690/
CVE: CVE-2020-4450
Published: 2020-06-05
Description: IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181231.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181231; https://www.ibm.com/support/pages/node/6220294; https://www.zerodayinitiative.com/advisories/ZDI-20-689/
CVE: CVE-2020-8103
Published: 2020-06-05
Description: A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to 1.0.17.178.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59, CWE-59
References: https://www.bitdefender.com/support/security-advisories/link-resolution-privilege-escalation-vulnerability-bitdefender-antivirus-free-va-8604/; https://www.bitdefender.com/support/security-advisories/link-resolution-privilege-escalation-vulnerability-bitdefender-antivirus-free-va-8604/
CVE: CVE-2020-8555
Published: 2020-06-05
Description: The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://www.openwall.com/lists/oss-security/2020/06/01/4; http://www.openwall.com/lists/oss-security/2021/05/04/8; https://github.com/kubernetes/kubernetes/issues/91542
CVE: CVE-2020-10061
Published: 2020-06-05
Description: Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119, CWE-787
References: https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10061; https://github.com/zephyrproject-rtos/zephyr/pull/23091; https://github.com/zephyrproject-rtos/zephyr/pull/23516
CVE: CVE-2020-10062
Published: 2020-06-05
Description: An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-193, CWE-193
References: https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10062; https://github.com/zephyrproject-rtos/zephyr/pull/23821/commits/11b7a37d9a0b438270421b224221d91929843de4; https://research.nccgroup.com/2020/05/26/research-report-zephyr-and-mcuboot-security-assessment