Filtered by vendor Zephyrproject-rtos Subscriptions

Search

Switch to Advanced Search (Beta)
Total 14 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-7403 1 Zephyrproject-rtos 1 Zephyr 2025-09-22 7.6 High
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
CVE-2025-10458 1 Zephyrproject-rtos 1 Zephyr 2025-09-22 7.6 High
Parameters are not validated or sanitized, and are later used in various internal operations.
CVE-2025-10456 1 Zephyrproject-rtos 1 Zephyr 2025-09-22 7.1 High
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.
CVE-2025-10457 1 Zephyrproject-rtos 1 Zephyr 2025-09-22 4.3 Medium
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
CVE-2024-6137 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2025-09-17 7.6 High
BT: Classic: SDP OOB access in get_att_search_list
CVE-2024-6259 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2025-09-17 7.6 High
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
CVE-2024-6258 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2025-09-17 6.8 Medium
BT: Missing length checks of net_buf in rfcomm_handle_data
CVE-2024-5931 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2025-09-17 6.3 Medium
BT: Unchecked user input in bap_broadcast_assistant
CVE-2024-10395 1 Zephyrproject-rtos 1 Zephyr 2025-07-13 8.6 High
No proper validation of the length of user input in http_server_get_content_type_from_extension.
CVE-2025-1675 1 Zephyrproject-rtos 1 Zephyr 2025-07-12 8.2 High
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
CVE-2025-2962 1 Zephyrproject-rtos 1 Zephyr 2025-07-06 8.2 High
A denial-of-service issue in the dns implemenation could cause an infinite loop.
CVE-2024-1638 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2025-04-24 8.2 High
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.
CVE-2024-11263 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2025-02-03 9.4 Critical
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
CVE-2024-6135 2 Zephyrproject, Zephyrproject-rtos 2 Zephyr, Zephyr 2024-09-19 7.6 High
BT:Classic: Multiple missing buf length checks