PT-2019-7965 · Zephyr · Zephyr

Published 2019-08-29 · Updated 2020-05-13 · CVE-2017-14202

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr shell versions prior to 1.14.0

Description The issue is related to an Improper Restriction of Operations within the Bounds of a Memory Buffer in the shell component of Zephyr. This allows a user connected via serial or telnet to potentially cause a crash and possibly execute arbitrary code.

Recommendations For Zephyr shell versions prior to 1.14.0, update to version 1.14.0 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-14202

Affected Products

Zephyr

References · 5

• https://github.com/zephyrproject-rtos/zephyr/pull/13048 · Patch
• https://osv.dev/vulnerability/CVE-2017-14202 · Vendor Advisory
• https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14202 · Security Note
• https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18 · Note