Goesm

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 ROS2 navigation2 version humble **Description** A segmentation violation was discovered in the component `theta star::ThetaStar::isUnsafeToPlan()`. This issue affects the navigation2 package in ROS2. **Recommendations** For version humble, consider disabling the `theta star::ThetaStar::isUnsafeToPlan()` function until a patch is available. Restrict access to the `theta star` component to minimize the risk of exploitation. Avoid using the `isUnsafeToPlan()` function in the affected navigation2 package until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 ROS2 navigation2 version v.humble **Description** The issue allows an attacker to execute arbitrary code via a crafted script to the `executor thread `. This is due to an Insecure Permissions vulnerability. **Recommendations** For version v.humble, consider restricting access to the `executor thread ` to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 ROS2 navigation2 version v.humble **Description** A NULL pointer dereference issue was discovered in the nav2 navfn planner() component. This issue affects the navigation2 package in ROS2. **Recommendations** For version v.humble, consider disabling the nav2 navfn planner() function as a temporary workaround until a patch is available. Restrict access to the navigation2 package to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version **Description** A heap overflow was discovered in the nav2 amcl process. This issue is triggered via sending a crafted message to the component /initialpose. **Recommendations** For Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version, consider disabling the nav2 amcl process until a patch is available. Restrict access to the /initialpose component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble **Description** A Buffer Overflow issue allows a local attacker to execute arbitrary code via a crafted script. This issue exists in the navigation2 component of ROS2, specifically in the humble version. **Recommendations** For Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble, consider disabling the navigation2 component until a patch is available to prevent exploitation. Restrict access to the navigation2 module to minimize the risk of arbitrary code execution. Avoid using crafted scripts that could trigger the Buffer Overflow issue until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 (ROS2) navigation2 versions ROS2-humble **Description** The issue allows a local attacker to execute arbitrary code via the error-thrown mechanism in `nav2 bt navigator`. This is due to an Insecure Permissions vulnerability in the navigation2 component of ROS2. **Recommendations** For Open Robotics Robotic Operating System 2 (ROS2) navigation2 version ROS2-humble, consider disabling the `nav2 bt navigator` function until a patch is available to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble **Description** A buffer overflow vulnerability exists in Open Robotics Robotic Operating System 2 (ROS2), specifically in navigation2- ROS2-humble and navigation 2-humble, allowing a local attacker to execute arbitrary code via the nav2 amcl process. **Recommendations** For Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble, consider disabling the nav2 amcl process as a temporary workaround until a patch is available. Restrict access to the vulnerable navigation2 component to minimize the risk of exploitation. Avoid using the vulnerable process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble **Description** The issue allows a local attacker to execute arbitrary code via the initial pose sub thread created by nav2 bt navigator. This is due to an Insecure Permissions vulnerability in the Open Robotics Robotic Operating System 2 (ROS2) navigation2. **Recommendations** For Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble, consider restricting access to the nav2 bt navigator function to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions **Description** A buffer overflow issue was discovered in the nav2 controller process, which can be triggered by sending a crafted .yaml file. **Recommendations** For Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions, consider disabling the nav2 controller process until a patch is available to prevent exploitation of the buffer overflow vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions **Description** The issue is related to an inappropriate pointer order of `map sub ` and `map free(map )` in the `amcl node.cpp` file, leading to a use-after-free. **Recommendations** For Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions **Description** A NULL pointer dereference issue was discovered via the `isCurrent()` function at `/src/layered costmap.cpp`. This issue affects the navigation capabilities of the system. **Recommendations** For Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions, as a temporary workaround, consider disabling the `isCurrent()` function until a patch is available. Restrict access to the `/src/layered costmap.cpp` module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.