Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while processing a FTMR frame.

Buffer over-read in WLAN Firmware

Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.

Buffer Over-read in Core

Transient DOS in Core when DDR memory check is called while DDR is not initialized.

Buffer Copy Without Checking Size of Input in Modem

Information disclosure in Modem while processing SIB5.

NULL Pointer dereference in WLAN Firmware

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.

Buffer over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing t2lm buffers.

Buffer Copy Without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

Reachable assertion in WLAN Firmware

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.

Integer Overflow or Wraparound in Radio Interface Layer

Memory corruption while receiving a message in Bus Socket Transport Server.

NULL Pointer Dereference in Hypervisor

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

Use After Free in Graphics

Memory corruption in Graphics while processing user packets for command submission.

Improper Authorization in WLAN Host

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.

Improper Authorization in WLAN Host

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN firmware while parsing MLO (multi-link operation).

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled.

Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: through 1.2.20.

Container Station

An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Container Station 2.6.7.44 and later