PatchTheCVEpicotcp vulnerabilities and fixes
Recent CVEs affecting picotcp, with upgrade or downgrade steps. 7 tracked.
picotcp has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2023-10-10. Highest priority: CVE-2021-33304 (score 54/100).
- CVE-2023-35849 HIGH 7.5 UPGRADE VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result i
- CVE-2023-35848 HIGH 7.5 UPGRADE VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a
- CVE-2023-35847 HIGH 7.5 UPGRADE VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).
- CVE-2023-35846 HIGH 7.5 UPGRADE VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before
- CVE-2023-30463 HIGH 7.5 UPGRADE Altran picoTCP through 1.7.0 allows memory corruption (and subsequent denial of service) because of an integer
- CVE-2021-33304 CRITICAL 9.8 DOWNGRADE DOWNGRADE Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in f
- CVE-2020-27635 CRITICAL 9.1 DOWNGRADE In PicoTCP 1.7.0, TCP ISNs are improperly random.
FAQ
How do I fix picotcp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is picotcp being exploited right now?
None of the tracked picotcp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which picotcp CVE should I patch first?
CVE-2021-33304 currently ranks highest (54/100): Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in f.