# zephyr.

Every CVE that names zephyr among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Zephyr JSON decoder incorrectly decodes array of array](https://agentprime.io/advisories/CVE-2021-3510.md)
  `CVE-2021-3510` · CVE record: zephyrproject-rtos zephyr · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2021 · Tags: CWE-588
- [BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known](https://agentprime.io/advisories/CVE-2021-3436.md)
  `CVE-2021-3436` · CVE record: zephyrproject-rtos zephyr · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2021 · Tags: CWE-694
- [DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses](https://agentprime.io/advisories/CVE-2021-3319.md)
  `CVE-2021-3319` · CVE record: zephyrproject-rtos zephyr · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2021 · Tags: Memory corruption, CWE-588
- [Type Confusion in 802154 ACK Frames Handling](https://agentprime.io/advisories/CVE-2021-3320.md)
  `CVE-2021-3320` · CVE record: zephyrproject-rtos zephyr · CVSS 5.9 Medium · Not analysed yet · Published 24 May 2021 · Tags: Memory corruption
- [Integer Overflow in memory allocating functions](https://agentprime.io/advisories/CVE-2020-13603.md)
  `CVE-2020-13603` · CVE record: zephyrproject-rtos zephyr · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2021 · Tags: Memory corruption
- [Remote Denial of Service in LwM2M do_write_op_tlv](https://agentprime.io/advisories/CVE-2020-13602.md)
  `CVE-2020-13602` · CVE record: zephyrproject-rtos zephyr · CVSS 4.0 Medium · Not analysed yet · Published 24 May 2021 · Tags: Denial of service, CWE-20
- [Possible read out of bounds in dns read](https://agentprime.io/advisories/CVE-2020-13601.md)
  `CVE-2020-13601` · CVE record: zephyrproject-rtos zephyr · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2021 · Tags: Memory corruption
- [Malformed SPI in response for eswifi can corrupt kernel memory](https://agentprime.io/advisories/CVE-2020-13600.md)
  `CVE-2020-13600` · CVE record: zephyrproject-rtos zephyr · CVSS 7.0 High · Not analysed yet · Published 24 May 2021 · Tags: Memory corruption
- [Security problem with settings and littlefs](https://agentprime.io/advisories/CVE-2020-13599.md)
  `CVE-2020-13599` · CVE record: zephyrproject-rtos zephyr · CVSS 3.3 Low · Not analysed yet · Published 24 May 2021 · Tags: Broken access control
- [FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat](https://agentprime.io/advisories/CVE-2020-13598.md)
  `CVE-2020-13598` · CVE record: zephyrproject-rtos zephyr · CVSS 6.3 Medium · Not analysed yet · Published 24 May 2021 · Tags: Memory corruption
- [Improper Handling of Insufficient Permissions or Privileges in zephyr](https://agentprime.io/advisories/CVE-2020-10072.md)
  `CVE-2020-10072` · CVE record: zephyrproject-rtos zephyr · CVSS 5.9 Medium · Not analysed yet · Published 24 May 2021 · Tags: CWE-280
- [Zephyr Bluetooth unchecked packet data results in denial of service](https://agentprime.io/advisories/CVE-2020-10069.md)
  `CVE-2020-10069` · CVE record: zephyrproject-rtos zephyr · CVSS 4.3 Medium · Not analysed yet · Published 24 May 2021 · Tags: CWE-233
- [Incorrect Error Handling in Bluetooth HCI core](https://agentprime.io/advisories/CVE-2020-10066.md)
  `CVE-2020-10066` · CVE record: zephyrproject-rtos zephyr · CVSS 2.5 Low · Not analysed yet · Published 24 May 2021 · Tags: Memory corruption
- [Missing Size Checks in Bluetooth HCI over SPI](https://agentprime.io/advisories/CVE-2020-10065.md)
  `CVE-2020-10065` · CVE record: zephyrproject-rtos zephyr · CVSS 3.8 Low · Not analysed yet · Published 24 May 2021 · Tags: CWE-130
- [Improper Input Frame Validation in ieee802154 Processing](https://agentprime.io/advisories/CVE-2020-10064.md)
  `CVE-2020-10064` · CVE record: zephyrproject-rtos zephyr · CVSS 8.3 High · Not analysed yet · Published 24 May 2021 · Tags: Memory corruption
- [Insufficient publish message length validation in MQTT](https://agentprime.io/advisories/CVE-2020-10071.md)
  `CVE-2020-10071` · CVE record: zephyrproject-rtos zephyr · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2020 · Tags: Memory corruption, CWE-129
- [MQTT buffer overflow on receive buffer](https://agentprime.io/advisories/CVE-2020-10070.md)
  `CVE-2020-10070` · CVE record: zephyrproject-rtos zephyr · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2020 · Tags: Memory corruption
- [Zephyr Bluetooth DLE duplicate requests vulnerability](https://agentprime.io/advisories/CVE-2020-10068.md)
  `CVE-2020-10068` · CVE record: zephyrproject-rtos zephyr · CVSS 5.1 Medium · Not analysed yet · Published 5 Jun 2020 · Tags: CWE-20
- [Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow](https://agentprime.io/advisories/CVE-2020-10063.md)
  `CVE-2020-10063` · CVE record: zephyrproject-rtos zephyr · CVSS 6.8 Medium · Not analysed yet · Published 5 Jun 2020 · Tags: Memory corruption
- [Packet length decoding error in MQTT](https://agentprime.io/advisories/CVE-2020-10062.md)
  `CVE-2020-10062` · CVE record: zephyrproject-rtos zephyr · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2020 · Tags: CWE-193
- [Error handling invalid packet sequence](https://agentprime.io/advisories/CVE-2020-10061.md)
  `CVE-2020-10061` · CVE record: zephyrproject-rtos zephyr · CVSS 8.1 High · Not analysed yet · Published 5 Jun 2020 · Tags: Memory corruption
- [Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory](https://agentprime.io/advisories/CVE-2020-10067.md)
  `CVE-2020-10067` · CVE record: zephyrproject-rtos zephyr · CVSS 7.5 High · Not analysed yet · Published 11 May 2020 · Tags: Memory corruption
- [UpdateHub Might Dereference An Uninitialized Pointer](https://agentprime.io/advisories/CVE-2020-10060.md)
  `CVE-2020-10060` · CVE record: zephyrproject-rtos zephyr · CVSS 8.0 High · Not analysed yet · Published 11 May 2020 · Tags: Memory corruption
- [UpdateHub Module Explicitly Disables TLS Verification](https://agentprime.io/advisories/CVE-2020-10059.md)
  `CVE-2020-10059` · CVE record: zephyrproject-rtos zephyr · CVSS 4.8 Medium · Not analysed yet · Published 11 May 2020 · Tags: Weak cryptography or TLS
- [Multiple Syscalls In kscan Subsystem Performs No Argument Validation](https://agentprime.io/advisories/CVE-2020-10058.md)
  `CVE-2020-10058` · CVE record: zephyrproject-rtos zephyr · CVSS 7.8 High · Not analysed yet · Published 11 May 2020 · Tags: CWE-20
- [Multiple Syscalls In GPIO Subsystem Performs No Argument Validation](https://agentprime.io/advisories/CVE-2020-10028.md)
  `CVE-2020-10028` · CVE record: zephyrproject-rtos zephyr · CVSS 7.8 High · Not analysed yet · Published 11 May 2020 · Tags: CWE-20
- [ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers](https://agentprime.io/advisories/CVE-2020-10027.md)
  `CVE-2020-10027` · CVE record: zephyrproject-rtos zephyr · CVSS 7.8 High · Not analysed yet · Published 11 May 2020 · Tags: CWE-697
- [ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers](https://agentprime.io/advisories/CVE-2020-10024.md)
  `CVE-2020-10024` · CVE record: zephyrproject-rtos zephyr · CVSS 7.8 High · Not analysed yet · Published 11 May 2020 · Tags: CWE-697
- [Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim](https://agentprime.io/advisories/CVE-2020-10023.md)
  `CVE-2020-10023` · CVE record: zephyrproject-rtos zephyr · CVSS 6.9 Medium · Not analysed yet · Published 11 May 2020 · Tags: Memory corruption
- [UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array](https://agentprime.io/advisories/CVE-2020-10022.md)
  `CVE-2020-10022` · CVE record: zephyrproject-rtos zephyr · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2020 · Tags: Memory corruption
- [Out-of-bounds write in USB Mass Storage with unaligned sizes](https://agentprime.io/advisories/CVE-2020-10021.md)
  `CVE-2020-10021` · CVE record: zephyrproject-rtos zephyr · CVSS 8.1 High · Not analysed yet · Published 11 May 2020 · Tags: Memory corruption
- [Buffer Overflow in USB DFU requested length](https://agentprime.io/advisories/CVE-2020-10019.md)
  `CVE-2020-10019` · CVE record: zephyrproject-rtos zephyr · CVSS 8.1 High · Not analysed yet · Published 11 May 2020 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/zephyr.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zephyr&cursor=WyIyMDIxLTEwLTA1VDIwOjUwOjE4LjgyNjAwMFoiLCJDVkUtMjAyMS0zNTgxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zephyr/?cursor=WyIyMDIxLTEwLTA1VDIwOjUwOjE4LjgyNjAwMFoiLCJDVkUtMjAyMS0zNTgxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.