Lwip Project Lwip vulnerabilities

4 known vulnerabilities affecting lwip_project/lwip.

Total CVEs

4

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1HIGH2MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2020-22284HIGHCVSS 7.5v2.1.22021-07-22

CVE-2020-22284 [HIGH] CWE-120 CVE-2020-22284: A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allows attackers to access sensitive information via a crafted 6LoWPAN packet.

CVE-2020-22283HIGHCVSS 7.5≥ 0, < 2.1.2+dfsg1-8+deb11u1≥ 0, < 2.1.3+dfsg1-12021-07-22

CVE-2020-22283 [HIGH] CVE-2020-22283: A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows at A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows attackers to access sensitive information via a crafted ICMPv6 packet.

CVE-2020-8597CRITICALCVSS 9.8≥ 0, < 2.1.2+dfsg1-52020-02-03

CVE-2020-8597 [CRITICAL] CVE-2020-8597: eap eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

CVE-2014-4883MEDIUMCVSS 4.3≤ 1.4.12014-11-28

CVE-2014-4883 [MEDIUM] CWE-345 CVE-2014-4883: resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does n resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.