ByteOS Network

Vulnerability Details :

CVE-2023-34494

Summary

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-12 Jun, 2023 | 00:00

Updated At-03 Jan, 2025 | 23:32

NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:12 Jun, 2023 | 00:00

Updated At:03 Jan, 2025 | 23:32

▼CVE Numbering Authority (CNA)

NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://github.com/emqx/nanomq/issues/1180	N/A

Hyperlink: https://github.com/emqx/nanomq/issues/1180

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://github.com/emqx/nanomq/issues/1180	x_transferred

Hyperlink: https://github.com/emqx/nanomq/issues/1180

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:12 Jun, 2023 | 14:15

Updated At:16 Jun, 2023 | 16:33

NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CPE Matches

emqx>>nanomq>>0.16.5

cpe:2.3:a:emqx:nanomq:0.16.5:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-416	Primary	nvd@nist.gov

CWE ID: CWE-416

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/emqx/nanomq/issues/1180	cve@mitre.org	Issue Tracking Patch Vendor Advisory

Hyperlink: https://github.com/emqx/nanomq/issues/1180

Source: cve@mitre.org

Resource:

Issue Tracking

Patch

Vendor Advisory

Similar CVEs

155Records found

CVE-2021-36145

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.39% / 59.44%

7 Day CHG~0.00%

Published-02 Jul, 2021 | 21:24

Updated-04 Aug, 2024 | 00:47

The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry.

Vendor-n/a Linux Kernel Organization, Inc

Product-acrn n/a

CWE ID-CWE-416

Use After Free

CVE-2021-33796

Matching Score-4

Assigner-Fedora Project

View Details

Matching Score-4

Assigner-Fedora Project

CVSS Score-10||CRITICAL

EPSS-0.08% / 24.24%

7 Day CHG~0.00%

Published-07 Jul, 2023 | 17:55

Updated-12 Nov, 2024 | 19:49

In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.

Vendor-MuJS Artifex Software Inc.

Product-mujs MuJS

CWE ID-CWE-416

Use After Free

CVE-2020-4031

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-3.5||LOW

EPSS-0.42% / 61.26%

7 Day CHG~0.00%

Published-22 Jun, 2020 | 00:00

Updated-04 Aug, 2024 | 07:52

Use-After-Free in gdi_SelectObject in FreeRDP

In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.

Vendor-Canonical Ltd.FreeRDP openSUSE Fedora Project Debian GNU/Linux

Product-ubuntu_linux debian_linux freerdp fedora leap FreeRDP

CWE ID-CWE-416

Use After Free

CVE-2020-36464

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.28% / 50.98%

7 Day CHG~0.00%

Published-08 Aug, 2021 | 05:12

Updated-04 Aug, 2024 | 17:30

An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.

Vendor-heapless_project n/a

Product-heapless n/a

CWE ID-CWE-416

Use After Free

CVE-2024-25062

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.15% / 36.20%

7 Day CHG~0.00%

Published-04 Feb, 2024 | 00:00

Updated-09 May, 2025 | 18:16

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Vendor-n/a libxml2 (XMLSoft)

Product-libxml2 n/a

CWE ID-CWE-416

Use After Free

CVE-2023-34494

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs