CVE-2024-47248

Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack

CVSS 6.3 MEDIUMEPSS 0.7%CWE-120

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.3EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

26 nov 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Produtos afetados

Apache Software Foundation · Apache NimBLE

Referências

https://github.com/apache/mynewt-nimble/commit/4f75c0b3b466186beff40e8489870c6cee076aaa https://lists.apache.org/thread/z8m7jqh54xybf9kz8q2l3tz92zsj7tmz http://www.openwall.com/lists/oss-security/2024/11/26/2