{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "summary", "text": "SICK has identified a Denial of Service vulnerability (CVE-2025-32472) in picoScan and multiScan, which can cause the web page to become unresponsive. Due to their architectural design, these products are not affected by the other vulnerabilities listed in this advisory. Currently SICK is not aware of any public exploits specifically targeting the vulnerability. SICK recommends applying the mitigation for CVE-2025-32472.", "title": "summary" }, { "category": "general", "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.", "title": "General Security Measures" }, { "category": "general", "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.", "title": "Vulnerability Classification" } ], "publisher": { "category": "vendor", "contact_details": "psirt@sick.de", "issuing_authority": "SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).", "name": "SICK PSIRT", "namespace": "https://www.sick.com/psirt" }, "references": [ { "summary": "SICK PSIRT Security Advisories", "url": "https://sick.com/psirt" }, { "summary": "SICK Operating Guidelines", "url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf" }, { "summary": "ICS-CERT recommended practices on Industrial Security", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "summary": "CVSS v3.1 Calculator", "url": "https://www.first.org/cvss/calculator/3.1" }, { "category": "self", "summary": "The canonical URL.", "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0006.json" } ], "title": "Vulnerability affecting picoScan and multiScan", "tracking": { "current_release_date": "2025-04-28T13:00:00.000Z", "generator": { "date": "2025-04-28T06:38:33.857Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "SCA-2025-0006", "initial_release_date": "2025-04-28T13:00:00.000Z", "revision_history": [ { "date": "2025-04-28T13:00:00.000Z", "number": "1", "summary": "Initial version" }, { "number": "2", "date": "2025-07-30T07:30:49.000Z", "summary": "Updated Advisory: URL for SICK Operating Guidelines has been updated" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "SICK AG", "branches": [ { "category": "product_family", "name": "picoScan100", "branches": [ { "category": "product_name", "name": "picoScan1XX", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "product_id": "CSAFPID-0001", "name": "SICK picoScan1XX all versions", "product_identification_helper": { "skus": [ "1134607", "1134608", "1134609", "1134610", "1141395", "1141396", "1141397", "1141751", "1142269", "1142270", "1142272", "1142273" ] } } } ] } ] }, { "category": "product_family", "name": "multiScan100", "branches": [ { "category": "product_name", "name": "multiScan1XX", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "product_id": "CSAFPID-0002", "name": "SICK multiScan1XX all versions", "product_identification_helper": { "skus": [ "1131164", "1137723", "1140110", "1140133", "1140134", "1141496", "1143873" ] } } } ] } ] }, { "category": "product_name", "name": "picoScan1XX Firmware", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "product_id": "CSAFPID-0003", "name": "SICK picoScan1XX Firmware all versions" } } ] }, { "category": "product_name", "name": "multiScan1XX Firmware", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "product_id": "CSAFPID-0004", "name": "SICK multiScan1XX Firmware all versions" } } ] } ] } ], "relationships": [ { "full_product_name": { "name": "SICK picoScan1XX all Firmware versions", "product_id": "CSAFPID-0005" }, "product_reference": "CSAFPID-0003", "category": "installed_on", "relates_to_product_reference": "CSAFPID-0001" }, { "full_product_name": { "name": "SICK multiScan1XX all Firmware versions", "product_id": "CSAFPID-0006" }, "product_reference": "CSAFPID-0004", "category": "installed_on", "relates_to_product_reference": "CSAFPID-0002" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-32472", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "audience": "all", "category": "summary", "text": "The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack. A remote attacker can exploit this vulnerability by conducting a Slowloris-type attack, causing the web page to become unresponsive.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "remediations": [ { "category": "workaround", "details": "Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources ”SICK Operating Guidelines” and ”ICS-CERT recommended practices on Industrial Security” could help to implement the general security practices. Additionally, the web server can be disabled via the CyberSecurity page in the UI.", "product_ids": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "Denial-of-Service Vulnerability in multiScan and picoScan via Slowloris Attack" }, { "cve": "CVE-2024-38517", "title": "Tencent RapidJSON Vulnerable to Privilege Escalation via Integer Underflow in GenericReader::ParseNumber() Function", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "temporalScore": 7.8, "temporalSeverity": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege." } ] }, { "cve": "CVE-2024-39684", "title": "Tencent RapidJSON Vulnerable to Privilege Escalation via Integer Overflow in GenericReader::ParseNumber() Function", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "temporalScore": 7.8, "temporalSeverity": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege." } ] }, { "cve": "CVE-2022-46908", "title": "SQLite Vulnerable to Protection Mechanism Bypass via Improper Implementation of 'azProhibitedFunctions'", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "temporalScore": 7.3, "temporalSeverity": "HIGH", "environmentalScore": 7.3, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE." } ] }, { "cve": "CVE-2021-36690", "title": "SQLite Vulnerable to Denial-of-Service (DoS) via Segmentation Fault in 'idxGetTableInfo' Function", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library." } ] }, { "cve": "CVE-2022-35737", "title": "SQLite Vulnerable to Memory Corruption via Stack-Based Buffer Overflow in 'sqlite3_str_vappendf()' Function Used by 'printf' Family API Implementations", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API." } ] }, { "cve": "CVE-2021-45346", "title": "SQLite Vulnerable to Information Disclosure via Maliciously Crafted Queries", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "temporalScore": 4.3, "temporalSeverity": "MEDIUM", "environmentalScore": 4.3, "environmentalSeverity": "MEDIUM" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect" } ] }, { "cve": "CVE-2023-7104", "title": "SQLite Vulnerable to Out-of-Bounds Memory Access via Insufficient Input Validation in 'sessionReadRecord' Function of 'Sessions' Extension", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "temporalScore": 7.3, "temporalSeverity": "HIGH", "environmentalScore": 7.3, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999." } ] }, { "cve": "CVE-2022-28805", "title": "Lua Vulnerable to Denial-of-Service (DoS) and Information Disclosure via Heap-Based Buffer Over-Read in 'luaH_getshortstr' Function", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code." } ] }, { "cve": "CVE-2020-24370", "title": "Lua Vulnerable to Denial-of-Service (DoS) via Integer Overflow in 'ldebug.c' File", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31)." } ] }, { "cve": "CVE-2021-43519", "title": "Lua Vulnerable to Denial-of-Service (DoS) via Stack-Based Buffer Overflow in 'ldo.c'", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file." } ] }, { "cve": "CVE-2020-24369", "title": "Lua Vulnerable to Denial-of-Service (DoS) via Stack-Based Buffer Overflow in 'ldo.c'", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference." } ] }, { "cve": "CVE-2020-24371", "title": "Lua Vulnerable to Information Disclosure via Mishandled Interaction Between Barriers and Sweep Phase", "cwe": { "id": "CWE-763", "name": "Release of Invalid Pointer or Reference" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage." } ] }, { "cve": "CVE-2022-33099", "title": "Lua Vulnerable to Denial-of-Service (DoS) via Stack Overflow in 'luaG_runerror' Function", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs." } ] }, { "cve": "CVE-2020-15945", "title": "Lua Vulnerable to Denial-of-Service via 'changedline' Function", "cwe": { "id": "CWE-229", "name": "Improper Handling of Values" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function." } ] }, { "cve": "CVE-2020-15888", "title": "Lua Vulnerable to Denial-of-Service (DoS) via Multiple Heap Related Memory Errors via Garbage Collection 'Stack Resizing'", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "temporalScore": 8.8, "temporalSeverity": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free." } ] }, { "cve": "CVE-2020-24342", "title": "Lua Vulnerable to Denial-of-Service (DoS) via Stack Overflow in 'luaD_callnoyield' Function", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "temporalScore": 7.8, "temporalSeverity": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row." } ] }, { "cve": "CVE-2024-10525", "title": "Eclipse Mosquitto Vulnerable to Memory Corruption via Heap-Based-Buffer Overflow in Crafted SUBACK Packet in libmosquitto Component", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients." } ] }, { "cve": "CVE-2024-8376", "title": "Eclipse Mosquitto Vulnerable to Memory Corruption via Specific Sequences in Packet Handling Component", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of \"CONNECT\", \"DISCONNECT\", \"SUBSCRIBE\", \"UNSUBSCRIBE\" and \"PUBLISH\" packets." } ] }, { "cve": "CVE-2023-28366", "title": "Mosquitto Vulnerable to Denial-of-Service (DoS) via Memory Leak Triggered by Duplicate QoS 2 Messages", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function." } ] }, { "cve": "CVE-2023-3592", "title": "Mosquitto Vulnerable to Denial-of-Service (DoS) via Memory Leak in 'v5 CONNECT' Packets", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types." } ] }, { "cve": "CVE-2024-3935", "title": "Eclipse Mosquitto Vulnerable to Memory Corruption via Double Free in Crafted PUBLISH Packet in Outgoing Bridge Connection", "cwe": { "id": "CWE-415", "name": "Double Free" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker." } ] }, { "cve": "CVE-2023-0809", "title": "Mosquitto Vulnerable to Denial-of-Service (DoS) via Excessive Memory Allocation", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "scores": [ { "cvss_v3": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM" }, "products": [ "CSAFPID-0005", "CSAFPID-0006" ] } ], "product_status": { "known_not_affected": [ "CSAFPID-0005", "CSAFPID-0006" ] }, "notes": [ { "audience": "all", "category": "summary", "title": "Summary", "text": "In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets." } ] } ] }