mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 00:20:38 -09:00
d3ebc63ce7
For more info on the release, see:
- https://github.com/obgm/libcoap/compare/v4.3.5...v4.3.5a
- https://github.com/obgm/libcoap/blob/release-4.3.5-patches/ChangeLog
Fixes the following vulnerabilities:
- CVE-2025-59391:
A memory disclosure vulnerability exists in libcoap's OSCORE
configuration parser in libcoap before release-4.3.5-patches. An out-
of-bounds read may occur when parsing certain configuration values,
allowing an attacker to infer or read memory beyond string boundaries
in the .rodata section. This could potentially lead to information
disclosure or denial of service.
https://www.cve.org/CVERecord?id=CVE-2025-59391
- CVE-2025-65493:
NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5
allows remote attackers to cause a denial of service via a crafted
DTLS/TLS connection that triggers BIO_get_data() to return NULL.
https://www.cve.org/CVERecord?id=CVE-2025-65493
- CVE-2025-65494:
NULL pointer dereference in get_san_or_cn_from_cert() in
src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to
cause a denial of service via a crafted X.509 certificate that causes
sk_GENERAL_NAME_value() to return NULL.
https://www.cve.org/CVERecord?id=CVE-2025-65494
- CVE-2025-65495:
Integer signedness error in tls_verify_call_back() in
src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to
cause a denial of service via a crafted TLS certificate that causes
i2d_X509() to return -1 and be misused as a malloc() size parameter.
https://www.cve.org/CVERecord?id=CVE-2025-65495
- CVE-2025-65496:
NULL pointer dereference in coap_dtls_generate_cookie() in
src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to
cause a denial of service via a crafted DTLS handshake that triggers
SSL_get_SSL_CTX() to return NULL.
https://www.cve.org/CVERecord?id=CVE-2025-65496
- CVE-2025-65497:
NULL pointer dereference in coap_dtls_generate_cookie() in
src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to
cause a denial of service via a crafted DTLS handshake that triggers
SSL_get_SSL_CTX() to return NULL.
https://www.cve.org/CVERecord?id=CVE-2025-65497
- CVE-2025-65498:
NULL pointer dereference in coap_dtls_generate_cookie() in
src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to
cause a denial of service via a crafted DTLS handshake that triggers
SSL_get_SSL_CTX() to return NULL.
https://www.cve.org/CVERecord?id=CVE-2025-65498
- CVE-2025-65499:
Array index error in tls_verify_call_back() in src/coap_openssl.c in
OISM libcoap 4.3.5 allows remote attackers to cause a denial of
service via a crafted DTLS handshake that triggers
SSL_get_ex_data_X509_STORE_CTX_idx() to return -1.
https://www.cve.org/CVERecord?id=CVE-2025-65499
- CVE-2025-65500:
NULL pointer dereference in coap_dtls_generate_cookie() in
src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to
cause a denial of service via a crafted DTLS handshake that triggers
SSL_get_SSL_CTX() to return NULL.
https://www.cve.org/CVERecord?id=CVE-2025-65500
- CVE-2025-65501:
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap
4.3.5 allows remote attackers to cause a denial of service via a DTLS
handshake where SSL_get_app_data() returns NULL.
https://www.cve.org/CVERecord?id=CVE-2025-65501
LICENSE Year updated see [1].
[1] c9135b6b26
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>