CVE-2024-47248

Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack

CVSS 6.3 MEDIUMEPSS 0.7%CWE-120

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.3EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

26 nov 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Productos afectados

Apache Software Foundation · Apache NimBLE

Referencias

https://github.com/apache/mynewt-nimble/commit/4f75c0b3b466186beff40e8489870c6cee076aaa https://lists.apache.org/thread/z8m7jqh54xybf9kz8q2l3tz92zsj7tmz http://www.openwall.com/lists/oss-security/2024/11/26/2