VulnerabilityAnalyzed
CVE-2024-47249
Improper Validation of Array Index vulnerability in Apache NimBLE.
MEDIUM 5.0EPSS 0.62%
Does this matter?
Lower severity and a low EPSS score (0.62%). Track it; it rarely justifies an emergency change on its own.
Description
Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- CVSS 3.1
- 5.0 MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS
- 0.62% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-129
- Affected
- apache/nimble
- Source
- security@apache.org
References
- https://github.com/apache/mynewt-nimble/commit/f39330866a85fa4de49246e9d21334bc8d14f0a1Patch
- https://lists.apache.org/thread/7ckxw6481dp68ons627pjcb27c75n0mqMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/11/26/3Mailing List, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.