Filtered by vendor Contiki-ng Subscriptions
Filtered by product Contiki-ng Subscriptions

Search

Switch to Advanced Search (Beta)
Total 44 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-9183 2 Contiki-ng, Contiki-os 2 Contiki-ng, Contiki 2024-11-21 7.5 High
An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment processing in the face of truncated fragments in os/net/ipv6/sicslowpan.c. This results in accesses of unmapped memory, crashing the application. An attacker can cause a denial-of-service via a crafted 6LoWPAN frame.
CVE-2019-8359 2 Contiki-ng, Contiki-os 2 Contiki-ng, Contiki 2024-11-21 9.8 Critical
An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. An out of bounds write is present in the data section during 6LoWPAN fragment re-assembly in the face of forged fragment offsets in os/net/ipv6/sicslowpan.c.
CVE-2018-19417 1 Contiki-ng 1 Contiki-ng 2024-11-21 N/A
An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length header uses memcpy to input data into a fixed size buffer. The allocated buffer can fit only MQTT_MAX_TOPIC_LENGTH (default 64) bytes, and a length check is missing. This could lead to Remote Code Execution via a stack-smashing attack (overwriting the function return address). Contiki-NG does not separate the MQTT server from other servers and the OS modules, so access to all memory regions is possible.
CVE-2018-1000804 1 Contiki-ng 1 Contiki-ng 2024-11-21 9.8 Critical
contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote Code Execution on device using Contiki-NG operating system. This attack appear to be exploitable via Attacker must be able to run malicious AQL code (e.g. via SQL-like Injection attack).