6 results · Clear filters · Feed
-
High 7.5
F´: FileUplink Unknown Packet Type Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to …
-
High 7.5
F´: GenericHub Malformed Buffer Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for …
-
High 8.1
F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus…
-
High 7.2
F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size bef…
-
High 7.1
F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled dest…
-
High 7.5
F´: SpacePacketDeframer Small Packet Assertion DoS
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length cond…