Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
Weakness
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cyclonedds | Eclipse | * | 0.8.0 (excluding) |
| Cyclonedds | Ubuntu | impish | * |
| Cyclonedds | Ubuntu | kinetic | * |
| Cyclonedds | Ubuntu | lunar | * |
| Cyclonedds | Ubuntu | mantic | * |
| Cyclonedds | Ubuntu | oracular | * |
| Cyclonedds | Ubuntu | plucky | * |