libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoderencodeLength function at /asn1/berencoder.c.

Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServerhandleGetNameListRequest function to the mmsgetnamelistservice component.

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/isomms/client/mmsclientfiles.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556.

MmsValuedecodeMmsData in mms/isomms/server/mmsaccessresult.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing the MMSBITSTRING data type.

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based buffer overflow via the MMS FileDirResponse message.

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based buffer overflow via the MMS IdentifyResponse message.

An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServerhandleDeleteNamedVariableListRequest function of src/mms/isomms/server/mmsnamedvariablelistservice.c.

In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServerhandleFileCloseRequest.c function of src/mms/isomms/server/mmsfileservice.c. The vulnerability manifests as SEGV and causes the application to crash

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) uses a NULL pointer in certain situations. which could allow an attacker to crash the server.

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload.

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) is vulnerable to a stack-based buffer overflow, which could allow an attacker to crash the device or remotely execute arbitrary code.

MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.

A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.

An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multiclientserver/multiclientserver.c.

libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClientsetOrigin() at /client/clientcontrol.c.

An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/isoserver/isoserver.c, as demonstrated by examples/serverexamplegoose/serverexamplegoose.c and examples/serverexample6140025/serverexample6140025.c.

An issue has been found in libIEC61850 v1.3.1. Memorymalloc and Memorycalloc in hal/memory/libmemory.c have memory leaks when called from mms/isomms/common/mmsvalue.c, server/mmsmapping/mmsmapping.c, and server/mmsmapping/mmssv.c (via common/stringutilities.c), as demonstrated by iec6185092LEexample.c.

An issue has been found in libIEC61850 v1.3.1. Memorymalloc in hal/memory/libmemory.c has a memory leak when called from Asn1PrimitiveValuecreate in mms/asn1/asn1berprimitivevalue.c, as demonstrated by goosepublisherexample.c and iec6185092LEexample.c.

An issue was discovered in lib60870 2.1.1. LinkLayersetAddress in linklayer/linklayer.c has a NULL pointer dereference.

An issue has been found in libIEC61850 v1.3.1. EthernetsetProtocolFilter in hal/ethernet/linux/ethernetlinux.c has a SEGV, as demonstrated by svsubscriberexample.c and svsubscriber.c.

In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service.

DISPUTED An issue has been found in libIEC61850 v1.3. It is a SEGV in ControlObjectClientsetCommandTerminationHandler in client/clientcontrol.c. NOTE: the software maintainer disputes this because it requires incorrect usage of the clientexamplecontrol program.

An issue has been found in libIEC61850 v1.3. It is a SEGV in EthernetreceivePacket in ethernetbsd.c.

An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoderencodeOctetString in mms/asn1/berencoder.c. This is exploitable even after CVE-2018-18834 has been patched, with a different dataSetValue sequence than the CVE-2018-18834 attack vector.

An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in EthernetsendPacket in ethernetbsd.c.

An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSetgetValues in client/iedconnection.c.

An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoderencodeOctetString in mms/asn1/berencoder.c.

An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in goose/goosepublisher.c.

mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: serverexamplecomplexarray. The attack vector is: Send a specific MMS protocol packet.

In libIEC61850 1.4.0, MmsValuenewOctetString in mms/isomms/common/mmsvalue.c has an integer signedness error that can lead to an attempted excessive memory allocation.