Zephyrproject
zephyrproject
189 CVEs • 1 product
Products (1)
Click to collapseToggle
Products (1)
Click to collapse
CVEs (189)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack)...Show more |
5Google LinuxfoundationOpenwrt+2 more5Android OpenwrtRdk B+2 moreJun 17, 2026 Aug 4, 2025 N/A· v4 6.8 MEDIUM· v3 N/A· v2 In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges ne...Show more |
A denial-of-service issue in the dns implemenation could cause an infinite loop. |
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data. |
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. |
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. |
No proper validation of the length of user input in http_server_get_content_type_from_extension. |
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols. |
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty. |
In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow. |
BT: HCI: adv_ext_report Improper discarding in adv_ext_report |
BT: Classic: SDP OOB access in get_att_search_list |
BT:Classic: Multiple missing buf length checks |
BT: Unchecked user input in bap_broadcast_assistant |
BT: Missing length checks of net_buf in rfcomm_handle_data |
BT: Encryption procedure host vulnerability |
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero |
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device |