CWE-122

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CVE-2024-6031 (GCVE-0-2024-6031)

Vulnerability from cvelistv5 – Published: 2025-04-30 20:00 – Updated: 2025-04-30 20:12
VLAI
Title
Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability
Summary
Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23198.
Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
zdi
References
Impacted products
Vendor Product Version
Tesla Model S Affected: 2023.44.29
Create a notification for this product.
Date Public
2025-04-30 19:58
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T20:12:19.564646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-30T20:12:28.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Model S",
          "vendor": "Tesla",
          "versions": [
            {
              "status": "affected",
              "version": "2023.44.29"
            }
          ]
        }
      ],
      "dateAssigned": "2024-06-14T23:41:39.492Z",
      "datePublic": "2025-04-30T19:58:08.906Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.\n \nThe specific flaw exists within the parsing of responses from AT commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23198."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T20:00:29.921Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-261",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-261/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Synacktiv (@Synacktiv)"
      },
      "title": "Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-6031",
    "datePublished": "2025-04-30T20:00:29.921Z",
    "dateReserved": "2024-06-14T23:41:39.467Z",
    "dateUpdated": "2025-04-30T20:12:28.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6135 (GCVE-0-2024-6135)

Vulnerability from cvelistv5 – Published: 2024-09-13 19:51 – Updated: 2024-09-16 14:47
VLAI
Title
BT:Classic: Multiple missing buf length checks
Summary
BT:Classic: Multiple missing buf length checks
Severity
7.6 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
zephyrproject-rtos Zephyr Affected: * , ≤ 3.6 (git)
Create a notification for this product.
zephyrproject-rtos zephyr Affected: 0 , ≤ 3.6 (custom)
    cpe:2.3:o:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "zephyr",
            "vendor": "zephyrproject-rtos",
            "versions": [
              {
                "lessThanOrEqual": "3.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6135",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-16T14:46:59.029413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-16T14:47:03.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Zephyr",
          "product": "Zephyr",
          "repo": "https://github.com/zephyrproject-rtos/zephyr",
          "vendor": "zephyrproject-rtos",
          "versions": [
            {
              "lessThanOrEqual": "3.6",
              "status": "affected",
              "version": "*",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "BT:Classic: Multiple missing buf length checks"
            }
          ],
          "value": "BT:Classic: Multiple missing buf length checks"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-13T19:51:31.811Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xcr5-5g98-mchp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BT:Classic: Multiple missing buf length checks",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2024-6135",
    "datePublished": "2024-09-13T19:51:31.811Z",
    "dateReserved": "2024-06-18T18:33:19.984Z",
    "dateUpdated": "2024-09-16T14:47:03.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6154 (GCVE-0-2024-6154)

Vulnerability from cvelistv5 – Published: 2024-06-20 20:13 – Updated: 2024-08-01 21:33
VLAI
Title
Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability
Summary
Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-20450.
Severity
8.2 (High)
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
zdi
References
Impacted products
Vendor Product Version
Parallels Desktop Affected: 18.2.0 (53488)
Create a notification for this product.
parallels parallels_desktop Affected: 0 , < 18.1.0 (custom)
    cpe:2.3:a:parallels:parallels_desktop:*:*:*:*:*:*:*:*
 Create a notification for this product.
Date Public
2024-06-18 23:32
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:parallels:parallels_desktop:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "parallels_desktop",
            "vendor": "parallels",
            "versions": [
              {
                "lessThan": "18.1.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6154",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-27T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T03:55:26.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:33:05.150Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-24-804",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-804/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Desktop",
          "vendor": "Parallels",
          "versions": [
            {
              "status": "affected",
              "version": "18.2.0 (53488)"
            }
          ]
        }
      ],
      "dateAssigned": "2024-06-18T21:34:12.679Z",
      "datePublic": "2024-06-18T23:32:34.445Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-20450."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-20T20:13:01.326Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-804",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-804/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "war10ck"
      },
      "title": "Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-6154",
    "datePublished": "2024-06-20T20:13:01.326Z",
    "dateReserved": "2024-06-18T21:34:12.658Z",
    "dateUpdated": "2024-08-01T21:33:05.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6246 (GCVE-0-2024-6246)

Vulnerability from cvelistv5 – Published: 2024-11-22 20:05 – Updated: 2024-12-04 21:43
VLAI
Title
Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability
Summary
Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Realtek Wi-Fi kernel module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the kernel. Was ZDI-CAN-22310.
Severity
9.6 (Critical)
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
zdi
References
Impacted products
Vendor Product Version
Wyze Cam v3 Affected: 4.36.11.7071
Create a notification for this product.
wyze cam_v3_firmware Affected: 4.36.11.7071
    cpe:2.3:o:wyze:cam_v3_firmware:4.36.11.7071:*:*:*:*:*:*:*
 Create a notification for this product.
Date Public
2024-06-21 20:26
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:wyze:cam_v3_firmware:4.36.11.7071:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cam_v3_firmware",
            "vendor": "wyze",
            "versions": [
              {
                "status": "affected",
                "version": "4.36.11.7071"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6246",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-26T15:16:12.893116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-04T21:43:36.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cam v3",
          "vendor": "Wyze",
          "versions": [
            {
              "status": "affected",
              "version": "4.36.11.7071"
            }
          ]
        }
      ],
      "dateAssigned": "2024-06-21T14:52:16.785Z",
      "datePublic": "2024-06-21T20:26:19.788Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the Realtek Wi-Fi kernel module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the kernel. Was ZDI-CAN-22310."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-22T20:05:40.747Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-837",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-837/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Vincent DEHORS (@vdehors), Kevin DENIS (@0xmitsurugi), Romain KRAFT (@Areizen_) from Synacktiv (@Synacktiv)"
      },
      "title": "Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-6246",
    "datePublished": "2024-11-22T20:05:40.747Z",
    "dateReserved": "2024-06-21T14:52:16.771Z",
    "dateUpdated": "2024-12-04T21:43:36.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6258 (GCVE-0-2024-6258)

Vulnerability from cvelistv5 – Published: 2024-09-13 19:05 – Updated: 2025-09-17 05:19
VLAI
Title
BT: Missing length checks of net_buf in rfcomm_handle_data
Summary
BT: Missing length checks of net_buf in rfcomm_handle_data
Severity
6.8 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
  • CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
Impacted products
Vendor Product Version
zephyrproject-rtos Zephyr Affected: * , ≤ 3.6 (git)
Create a notification for this product.
zephyrproject-rtos zephyr Affected: 0 , ≤ 3.6 (custom)
    cpe:2.3:o:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "zephyr",
            "vendor": "zephyrproject-rtos",
            "versions": [
              {
                "lessThanOrEqual": "3.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6258",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-16T14:43:51.367787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-16T14:46:42.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Zephyr",
          "product": "Zephyr",
          "repo": "https://github.com/zephyrproject-rtos/zephyr",
          "vendor": "zephyrproject-rtos",
          "versions": [
            {
              "lessThanOrEqual": "3.6",
              "status": "affected",
              "version": "*",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "BT: Missing length checks of net_buf in rfcomm_handle_data"
            }
          ],
          "value": "BT: Missing length checks of net_buf in rfcomm_handle_data"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T05:19:33.852Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7833-fcpm-3ggm"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BT: Missing length checks of net_buf in rfcomm_handle_data",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2024-6258",
    "datePublished": "2024-09-13T19:05:53.783Z",
    "dateReserved": "2024-06-21T20:44:04.693Z",
    "dateUpdated": "2025-09-17T05:19:33.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6259 (GCVE-0-2024-6259)

Vulnerability from cvelistv5 – Published: 2024-09-13 20:17 – Updated: 2025-09-17 14:07
VLAI
Title
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
Summary
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
Severity
7.6 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
zephyrproject-rtos Zephyr Affected: * , ≤ 3.6 (git)
Create a notification for this product.
zephyrproject-rtos zephyr Affected: 0 , ≤ 3.6 (custom)
    cpe:2.3:o:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "zephyr",
            "vendor": "zephyrproject-rtos",
            "versions": [
              {
                "lessThanOrEqual": "3.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6259",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-16T14:35:18.530446Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-17T14:07:02.900Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Zephyr",
          "product": "Zephyr",
          "repo": "https://github.com/zephyrproject-rtos/zephyr",
          "vendor": "zephyrproject-rtos",
          "versions": [
            {
              "lessThanOrEqual": "3.6",
              "status": "affected",
              "version": "*",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "BT: HCI: adv_ext_report Improper discarding in adv_ext_report"
            }
          ],
          "value": "BT: HCI: adv_ext_report Improper discarding in adv_ext_report"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T05:24:43.622Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p5j7-v26w-wmcp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BT: HCI: adv_ext_report Improper discarding in adv_ext_report",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2024-6259",
    "datePublished": "2024-09-13T20:17:58.827Z",
    "dateReserved": "2024-06-21T20:48:52.552Z",
    "dateUpdated": "2025-09-17T14:07:02.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6383 (GCVE-0-2024-6383)

Vulnerability from cvelistv5 – Published: 2024-07-03 21:33 – Updated: 2025-11-03 19:34
VLAI
Title
MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow
Summary
The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
MongoDB Inc libbson Affected: 0 , < 1.27.1 (custom)
    cpe:2.3:a:mongodb:libbson:0.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.98.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc6:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.11.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.13.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.13.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.14.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.14.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:beta:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:*:*:*:*:*:*:*
 Create a notification for this product.
Date Public
2024-07-03 21:33
Credits
selmelc
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-05T14:05:49.024613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T14:07:34.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:34:31.467Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/CDRIVER-5628"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241004-0001/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00027.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:libbson:0.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.98.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc3:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc4:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc6:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "libbson",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "1.27.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "selmelc"
        }
      ],
      "datePublic": "2024-07-03T21:33:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-04T12:49:04.148Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-5628"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2024-6383",
    "datePublished": "2024-07-03T21:33:47.598Z",
    "dateReserved": "2024-06-27T08:43:40.268Z",
    "dateUpdated": "2025-11-03T19:34:31.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-6444 (GCVE-0-2024-6444)

Vulnerability from cvelistv5 – Published: 2024-10-04 06:14 – Updated: 2024-10-04 13:49
VLAI
Title
Bluetooth: ots: missing buffer length check
Summary
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
Severity
6.3 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
zephyrproject-rtos Zephyr Affected: * , ≤ 3.6 (git)
Create a notification for this product.
zephyrproject zephyr Affected: 0 , ≤ 3.6 (git)
    cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "zephyr",
            "vendor": "zephyrproject",
            "versions": [
              {
                "lessThanOrEqual": "3.6",
                "status": "affected",
                "version": "0",
                "versionType": "git"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6444",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-04T13:48:21.272000Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-04T13:49:14.058Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Zephyr",
          "product": "Zephyr",
          "repo": "https://github.com/zephyrproject-rtos/zephyr",
          "vendor": "zephyrproject-rtos",
          "versions": [
            {
              "lessThanOrEqual": "3.6",
              "status": "affected",
              "version": "*",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Bluetooth: ots: missing buffer length check"
            }
          ],
          "value": "No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-04T06:14:26.348Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qj4r-chj6-h7qp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bluetooth: ots: missing buffer length check",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2024-6444",
    "datePublished": "2024-10-04T06:14:26.348Z",
    "dateReserved": "2024-07-02T06:07:28.811Z",
    "dateUpdated": "2024-10-04T13:49:14.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6816 (GCVE-0-2024-6816)

Vulnerability from cvelistv5 – Published: 2024-11-22 20:05 – Updated: 2024-11-22 21:55
VLAI
Title
IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Summary
IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23214.
Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
zdi
References
Impacted products
Vendor Product Version
IrfanView IrfanView Affected: 4.66 64bit
Create a notification for this product.
irfanview irfanview Affected: 4.67 , < 4.70 (custom)
    cpe:2.3:a:irfanview:irfanview:-:*:*:*:*:*:*:*
 Create a notification for this product.
Date Public
2024-07-27 03:47
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:irfanview:irfanview:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "irfanview",
            "vendor": "irfanview",
            "versions": [
              {
                "lessThan": "4.70",
                "status": "affected",
                "version": "4.67",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T21:19:49.009168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-22T21:55:50.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "IrfanView",
          "vendor": "IrfanView",
          "versions": [
            {
              "status": "affected",
              "version": "4.66 64bit"
            }
          ]
        }
      ],
      "dateAssigned": "2024-07-16T21:38:42.536Z",
      "datePublic": "2024-07-27T03:47:55.958Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23214."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-22T20:05:49.310Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-968",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-968/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-6816",
    "datePublished": "2024-11-22T20:05:49.310Z",
    "dateReserved": "2024-07-16T21:38:42.438Z",
    "dateUpdated": "2024-11-22T21:55:50.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6873 (GCVE-0-2024-6873)

Vulnerability from cvelistv5 – Published: 2024-08-01 15:57 – Updated: 2024-08-02 15:18
VLAI
Title
Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.
Summary
It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.  Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit  https://github.com/ClickHouse/ClickHouse/pull/64024 .
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
References
Impacted products
Vendor Product Version
ClickHouse ClickHouse Affected: v23.8.0 , < v23.8.15.35-lts (custom)
Affected: v24.3.0 , < v24.3.4.147-lts (custom)
Affected: v24.4.0 , < v24.4.2.141-stable (custom)
Affected: v24.5.0 , < v24.5.1.1763 (custom)
Affected: v24.6.0 , < v24.6.1.4423-stable (custom)
Create a notification for this product.
Credits
malacupa (Independent researcher)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6873",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T15:18:14.184641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:18:28.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageName": "clickhouse",
          "product": "ClickHouse",
          "repo": "https://github.com/ClickHouse/clickhouse",
          "vendor": "ClickHouse",
          "versions": [
            {
              "lessThan": "v23.8.15.35-lts",
              "status": "affected",
              "version": "v23.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "v24.3.4.147-lts",
              "status": "affected",
              "version": "v24.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "v24.4.2.141-stable",
              "status": "affected",
              "version": "v24.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "v24.5.1.1763",
              "status": "affected",
              "version": "v24.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "v24.6.1.4423-stable",
              "status": "affected",
              "version": "v24.6.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "malacupa (Independent researcher)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIt is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e\u0026nbsp;Fixes have been merged to all currently supported version of ClickHouse.\u0026nbsp;If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/ClickHouse/ClickHouse/pull/64024\"\u003ehttps://github.com/ClickHouse/ClickHouse/pull/64024\u003c/a\u003e."
            }
          ],
          "value": "It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.\n\n\u00a0Fixes have been merged to all currently supported version of ClickHouse.\u00a0If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit\u00a0 https://github.com/ClickHouse/ClickHouse/pull/64024 ."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-01T15:57:41.585Z",
        "orgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
        "shortName": "ClickHouse"
      },
      "references": [
        {
          "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-432f-r822-j66f"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eClickHouse recommends locking down native interface to trusted IP addresses only until the system is patched.\u003c/p\u003e"
            }
          ],
          "value": "ClickHouse recommends locking down native interface to trusted IP addresses only until the system is patched."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
    "assignerShortName": "ClickHouse",
    "cveId": "CVE-2024-6873",
    "datePublished": "2024-08-01T15:57:25.304Z",
    "dateReserved": "2024-07-18T03:24:47.800Z",
    "dateUpdated": "2024-08-02T15:18:28.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}
Mitigation

Phases:

Description:

  • Pre-design: Use a language or compiler that performs automatic bounds checking.
Mitigation

Phase: Architecture and Design

Description:

  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation ID: MIT-10

Phases: Operation, Build and Compilation

Strategy: Environment Hardening

Description:

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
  • D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation ID: MIT-11

Phases: Operation, Build and Compilation

Strategy: Environment Hardening

Description:

  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
  • Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
  • For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation

Phase: Implementation

Description:

  • Implement and perform bounds checking on input.
Mitigation

Phase: Implementation

Strategy: Libraries or Frameworks

Description:

  • Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
Mitigation

Phase: Operation

Description:

  • Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
CAPEC-92: Forced Integer Overflow

This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Back to CWE stats page