CVE-2024-47249

Description

Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Reserved 2024-09-23 | Published 2024-11-26 | Updated 2024-12-06 | Assigner apache

Problem types

CWE-129 Improper Validation of Array Index

Product status

Default status
unaffected

Any version
affected

Credits

Eunkyu Lee reporter

References

lists.apache.org/thread/7ckxw6481dp68ons627pjcb27c75n0mq vendor-advisory

github.com/...ommit/f39330866a85fa4de49246e9d21334bc8d14f0a1 patch

cve.org (CVE-2024-47249)

nvd.nist.gov (CVE-2024-47249)

Download JSON