bartoszek/zephyr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

doc: security: Disclose CVE-2025-1675

Browse Source 
Disclose information about published CVE.

Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com>
This commit is contained in:
Flavio Ceolin 2025-02-24 22:50:48 -08:00 committed by Benjamin Cabé
parent b777714e2a
commit bc189229ac
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
doc/security/vulnerabilities.rst
View File

@ -1881,3 +1881,26 @@ This has been fixed in main for v4.1.0
- `PR 82288 fix for 3.7
<https://github.com/zephyrproject-rtos/zephyr/pull/82288>`_
:cve:`2025-1675`
----------------
Out of bounds read in dns_copy_qname
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation
with an untrusted field and does not check if the source buffer is large enough
to contain the copied data.
- `Zephyr project bug tracker GHSA-2m84-5hfw-m8v4
<https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2m84-5hfw-m8v4>`_
This has been fixed in main for v4.1.0
- `PR 82072 fix for main
<https://github.com/zephyrproject-rtos/zephyr/pull/82072>`_
- `PR 82289 fix for 4.0
<https://github.com/zephyrproject-rtos/zephyr/pull/82289>`_
- `PR 82288 fix for 3.7
<https://github.com/zephyrproject-rtos/zephyr/pull/82288>`_