zephyr vulnerabilities (Ubuntu)
22 vulnerabilities.
-
zephyrUbuntu Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver 3.7 Low -
zephyrUbuntu Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference 6.5 Medium -
zephyrUbuntu Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host 5.3 Medium -
zephyrUbuntu IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key 3.7 Low -
zephyrUbuntu Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses 7.1 High -
zephyrUbuntu Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity 4.3 Medium -
zephyrUbuntu Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size 8.8 High -
zephyrUbuntu DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing 6.5 Medium -
zephyrUbuntu Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS 5.6 Medium -
zephyrUbuntu Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames 7.8 High -
zephyrUbuntu Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path 3.6 Low -
zephyrUbuntu WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr 8.2 High -
zephyrUbuntu OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) 7.5 High -
zephyrUbuntu Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation 7.1 High -
zephyrUbuntu Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`) 7.1 High -
zephyrUbuntu Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image 4.9 Medium -
zephyrUbuntu Bluetooth: ots: missing buffer length check 6.3 Medium -
zephyrUbuntu zephyr: out-of-bound read in utf8_trunc 6.3 Medium -
zephyrUbuntu Bluetooth: ASCS Unchecked tailroom of the response buffer 6.3 Medium -
zephyrUbuntu Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS 5.4 Medium -
zephyrUbuntu The RNDIS USB device class includes a buffer overflow vulnerability 8.2 High -
zephyrUbuntu Buffer overflow in usb device class 8.2 High