The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsUpgrade Ubuntu:22.04
u-boot-nezha
to version 2022.04+git20220405.7446a472-0ubuntu0.4 or higher.
Note: Versions mentioned in the description apply only to the upstream u-boot-nezha
package and not the u-boot-nezha
package as distributed by Ubuntu
.
See How to fix?
for Ubuntu:22.04
relevant fixed versions and status.
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength
greater than 4096 bytes, they can write beyond the heap-allocated request buffer.