Repository navigation

Fix two old CVE reports + various fixes from static analysis - #82

Merged

danielinux merged 21 commits into

masterfrom

cve-2020-24340-mdns

Sep 11, 2026

Merged

Fix two old CVE reports + various fixes from static analysis#82
danielinux merged 21 commits into
masterfrom
cve-2020-24340-mdns

Commits on Sep 9, 2026
- Fix OOB read in mDNS response handling (CVE-2020-24340)
  danielinux
  committed
  9b0db90
- Bound DNS name decompression to packet length (CVE-2020-24338/24339)
  danielinux
  committed
  0008a7c
- Fix Skoll scan findings in DNS, DHCP and SNTP modules
  danielinux
  committed
  b48544e
- Bound IPv6 ND option copy to destination size and option area
  danielinux
  committed
  304667e
- Bound 6LoWPAN reassembly fragment copy to datagram size
  danielinux
  committed
  e2d9845
- Cap PPP CHAP challenge copy to the allocated buffer
  danielinux
  committed
  b4dd932
- Bound IPv6 extension header walk to the datagram length
  danielinux
  committed
  bb33f7a
- Cap TCP SACK option read to the remaining options length
  danielinux
  committed
  170713f
- Reject IPHC reassembly when compressed length exceeds the frame
  danielinux
  committed
  15841ab
- Reject 802.15.4 frames shorter than their own header
  danielinux
  committed
  fe27cf6
- Cap 6LoWPAN fragment copy to the datagram size
  danielinux
  committed
  6940e82
- Validate OLSR per-message size before parsing
  danielinux
  committed
  ebf3766
- Cap concurrent 6LoWPAN reassembly entries
  danielinux
  committed
  1582ea6
- Bound ICMPv6 PTB and echo-reply header reads
  danielinux
  committed
  83ffe86
- Bound IGMP checksum length to the received frame
  danielinux
  committed
  e807c0a
- Guard NAT outbound tuple against NULL
  danielinux
  committed
  9367584
- Bound radiotest receive buffer and frame length
  danielinux
  committed
  3b300af
- Fix uncrustify continuation indent in mdns unit test
  danielinux
  committed
  db5528d
- Address Copilot review: bound parsing, scope DHCP teardown
  danielinux
  committed
  baf8ddf
- Document CVE-2020-24338/24339/24340 as fixed in 2.2
  danielinux
  committed
  4e1fbfd
- Document Forescout FSCT-2026-0017/0018/0019/0020/0022 fixes in 2.2
  danielinux
  committed
  5b5114e

Commits

Commits on Sep 9, 2026