CVE-2020-13601

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-136025.5Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with CVE-2020-136037.8Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For m CVE-2020-13615.5An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker wo CVE-2020-136145.9An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.CVE-2020-136155.9lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.CVE-2020-136165.9The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.CVE-2020-136177.5The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker CVE-2020-136199.8php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.CVE-2020-13627.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi CVE-2020-136208.8Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's abi CVE-2020-136227.5JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns CVE-2020-136237.5JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.