CVE search · CVE-2016-20009
CVE-2016-20009
critical 9.8
A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Details
- Status
- Modified unsupported-when-assigned
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-787
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | high 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- windriver · vxworks
- siemens · sgt-100_firmware
- siemens · sgt-200_firmware
- siemens · sgt-300_firmware
- siemens · sgt-400_firmware
- siemens · sgt-a20_firmware
- siemens · sgt-a35_firmware
- siemens · sgt-a65_firmware
References
- https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/ExploitThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-553445.pdfThird Party Advisory
- https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/ExploitThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-553445.pdfThird Party Advisory