Zj3To

**Name of the Vulnerable Software and Affected Versions** Connected Vehicle Systems Alliance (COVESA) versions up to 2.18.8 **Description** The issue is related to a buffer overflow in the Connected Vehicle Systems Alliance (COVESA) software. This buffer overflow occurs via the component /shared/dlt common.c. **Recommendations** For versions up to 2.18.8, as a temporary workaround, consider restricting access to the /shared/dlt common.c component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** dlt-daemon versions through 2.18.8 **Description** An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon. Dynamic memory is not released after it is allocated in dlt-control-common.c. **Recommendations** For versions through 2.18.8, consider restricting access to the dlt-control-common.c module to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.