Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
On the Silicon Labs Secure Element port, wolfSSL sized an ECC import from the encoded point and selected the curve separately by identifier. A 133-byte point on a P-256 session wrote past the 96-byte key_raw field during certificate processing, before the handshake was authenticated.
The lwIP MQTT client does not enforce the MQTT limit on fixed-header length, so a malicious or man-in-the-middle broker can send a run of remaining-length continuation bytes and drive an unbounded write past a 128-byte heap buffer in the client. No MQTT authentication is required, and the primitive is a plausible path to remote code execution.
// No embargoed advisories.