[<prev] [next>] [day] [month] [year] [list]
Message-ID: <06e3d634-5f7f-13a2-fc5f-5cb12f7c287f@apache.org>
Date: Sat, 14 Jun 2025 22:47:31 +0000
From: Tomasz Cedro <cederom@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-47868: Apache NuttX RTOS: tools/bdf-converter.:
tools/bdf-converter: Fix loop termination condition.
Severity: low
Affected versions:
- Apache NuttX RTOS: tools/bdf-converter. 6.9 before 12.9.0
Description:
Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active bdf-converter users may be affected when this tool is exposed to external provided user data data (i.e. publicly available automation).
This issue affects Apache NuttX: from 6.9 before 12.9.0.
Users are recommended to upgrade to version 12.9.0, which fixes the issue.
Credit:
Chánh Phạm <chanhphamviet@...il.com> (finder)
Nathan Hartman <hartman.nathan@...il.com> (remediation developer)
Tomek CEDRO <tomek@...ro.info> (coordinator)
Alan Carvalho de Assis <acassis@...il.com> (remediation reviewer)
Alin Jerpelea <jerpelea@...il.com> (remediation reviewer)
Lee, Lup Yuen <luppy@...kaki.com> (remediation reviewer)
Arnout Engelen <engelen@...che.org> (coordinator)
References:
https://github.com/apache/nuttx/pull/16000
https://nuttx.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-47868
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
