Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-6443

Summary
Assigner-zephyr
Assigner Org ID-e2e69745-5e70-4e92-8431-deb5529a81ad
Published At-04 Oct, 2024 | 05:56
Updated At-04 Oct, 2024 | 13:50
Rejected At-
Credits

zephyr: out-of-bound read in utf8_trunc

In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:zephyr
Assigner Org ID:e2e69745-5e70-4e92-8431-deb5529a81ad
Published At:04 Oct, 2024 | 05:56
Updated At:04 Oct, 2024 | 13:50
Rejected At:
▼CVE Numbering Authority (CNA)
zephyr: out-of-bound read in utf8_trunc

In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.

Affected Products
Vendor
Zephyr Projectzephyrproject-rtos
Product
Zephyr
Package Name
Zephyr
Repo
https://github.com/zephyrproject-rtos/zephyr
Default Status
unaffected
Versions
Affected
  • From * through 3.6 (git)
Problem Types
TypeCWE IDDescription
CWECWE-125Out-of-bounds Read
CWECWE-787Out-of-bounds Write
Type: CWE
CWE ID: CWE-125
Description: Out-of-bounds Read
Type: CWE
CWE ID: CWE-787
Description: Out-of-bounds Write
Metrics
VersionBase scoreBase severityVector
3.16.3MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Version: 3.1
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gg46-3rh2-v765
N/A
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gg46-3rh2-v765
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
Zephyr Projectzephyrproject
Product
zephyr
CPEs
  • cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*
Default Status
unaffected
Versions
Affected
  • From 0 through 3.6 (git)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:vulnerabilities@zephyrproject.org
Published At:04 Oct, 2024 | 06:15
Updated At:12 Nov, 2024 | 19:29

In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.16.5MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Secondary3.16.3MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Type: Primary
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Type: Secondary
Version: 3.1
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CPE Matches

Zephyr Project
zephyrproject
>>zephyr>>Versions up to 3.6.0(inclusive)
cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-125Primarynvd@nist.gov
CWE-787Primarynvd@nist.gov
CWE-125Secondaryvulnerabilities@zephyrproject.org
CWE-787Secondaryvulnerabilities@zephyrproject.org
CWE ID: CWE-125
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-787
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-125
Type: Secondary
Source: vulnerabilities@zephyrproject.org
CWE ID: CWE-787
Type: Secondary
Source: vulnerabilities@zephyrproject.org
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gg46-3rh2-v765vulnerabilities@zephyrproject.org
Exploit
Vendor Advisory
Hyperlink: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gg46-3rh2-v765
Source: vulnerabilities@zephyrproject.org
Resource:
Exploit
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

107Records found

CVE-2022-48354
Matching Score-4
Assigner-Huawei Technologies
ShareView Details
Matching Score-4
Assigner-Huawei Technologies
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 9.46%
||
7 Day CHG~0.00%
Published-27 Mar, 2023 | 00:00
Updated-20 Feb, 2025 | 15:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Bluetooth module has a heap out-of-bounds write vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.

Action-Not Available
Vendor-Huawei Technologies Co., Ltd.
Product-emuiharmonyosEMUIHarmonyOS
CWE ID-CWE-787
Out-of-bounds Write
CVE-2021-36134
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.4||HIGH
EPSS-0.13% / 33.72%
||
7 Day CHG~0.00%
Published-27 Sep, 2021 | 16:15
Updated-04 Aug, 2024 | 00:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Out of bounds write in Netop Vision Pro

Out of bounds write vulnerability in the JPEG parsing code of Netop Vision Pro up to and including 9.7.2 allows an adjacent unauthenticated attacker to write to arbitrary memory potentially leading to a Denial of Service (DoS).

Action-Not Available
Vendor-netopn/aMicrosoft Corporation
Product-vision_prowindowsn/a
CWE ID-CWE-787
Out-of-bounds Write
CVE-2024-46047
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.5||MEDIUM
EPSS-0.07% / 20.82%
||
7 Day CHG~0.00%
Published-13 Sep, 2024 | 00:00
Updated-20 Sep, 2024 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function.

Action-Not Available
Vendor-n/aTenda Technology Co., Ltd.
Product-fh451_firmwarefh451n/afh451_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2024-7137
Matching Score-4
Assigner-Silicon Labs
ShareView Details
Matching Score-4
Assigner-Silicon Labs
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 12.02%
||
7 Day CHG~0.00%
Published-19 Dec, 2024 | 19:23
Updated-28 May, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Denial of Service in Silicon Labs RS9116 Bluetooth SDK

The L2CAP receive data buffer for L2CAP packets is restricted to packet sizes smaller than the maximum supported packet size. Receiving a packet that exceeds the restricted buffer length may cause a crash. A hard reset is required to recover the crashed device.

Action-Not Available
Vendor-silabs.com
Product-RS9116 Bluetooth SDK
CWE ID-CWE-787
Out-of-bounds Write
CVE-2021-0113
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-6.5||MEDIUM
EPSS-0.12% / 31.76%
||
7 Day CHG~0.00%
Published-09 Jun, 2021 | 19:00
Updated-03 Aug, 2024 | 15:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Out of bounds write in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable a denial of service via adjacent access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-efi_bios_7215server_board_m10jnp2sbIntel(R) Server Board M10JNP2SB
CWE ID-CWE-787
Out-of-bounds Write
CVE-2020-9101
Matching Score-4
Assigner-Huawei Technologies
ShareView Details
Matching Score-4
Assigner-Huawei Technologies
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 9.50%
||
7 Day CHG~0.00%
Published-17 Jul, 2020 | 23:05
Updated-04 Aug, 2024 | 10:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Affected product versions include: IPS Module versions V500R005C00, V500R005C10; NGFW Module versions V500R005C00, V500R005C10; Secospace USG6300 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; Secospace USG6500 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; Secospace USG6600 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; USG9500 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10

Action-Not Available
Vendor-Huawei Technologies Co., Ltd.
Product-secospace_usg6500_firmwaresecospace_usg6500ips_moduleusg9500_firmwarengfw_moduleips_module_firmwaresecospace_usg6600_firmwaresecospace_usg6300usg9500ngfw_module_firmwaresecospace_usg6600secospace_usg6300_firmwareNGFW ModuleSecospace USG6300Secospace USG6600USG9500IPS ModuleSecospace USG6500
CWE ID-CWE-787
Out-of-bounds Write
CVE-2021-0009
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-6.5||MEDIUM
EPSS-0.43% / 61.95%
||
7 Day CHG~0.00%
Published-11 Aug, 2021 | 12:47
Updated-03 Aug, 2024 | 15:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Out-of-bounds read in the firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-ethernet_controller_e810ethernet_controller_e810_firmwareIntel(R) Ethernet Adapters 800 Series Controllers and associated adapters
CWE ID-CWE-125
Out-of-bounds Read
  • Previous
  • 1
  • 2
  • 3
  • Next
Details not found