PT-2021-15135
CVE-2021-22547
·
تاريخ النشر
2021-05-04
·
تاريخ التحديث
2021-05-07
الوصف من
CVSS 3.1
7.8
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Google Cloud IoT Device SDK for Embedded C versions prior to 1.0.3
Description
The issue is related to an implementation of
calloc() that lacks a length check. This allows an attacker to pass in memory objects larger than the buffer, potentially wrapping around to access smaller buffers than required, and gain access to other parts of the heap.Recommendations
For versions prior to 1.0.3, upgrade the Google Cloud IoT Device SDK for Embedded C to version 1.0.3 or greater.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾