彙總 ccn-lite 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 緩衝區溢位與記憶體損壞 等問題，部分漏洞可能導致 應用程式崩潰，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2018-12889 | An issue was discovered in CCN-lite 2.0.1. There is a heap-based buffer overflow in mkAddToRelayCacheRequest and in ccnl_populate_cache for an array lacking '\0' termination when reading a binary CCNx or NDN file. This can result in Heap Corruption. This was addressed by fixing the memory management in mkAddToRelayCacheRequest in ccn-lite-ctrl.c. | [email protected] | 9.8 | 1.69% | 2018-06-26 | 2026-06-16 |
| CVE-2018-7039 | CCN-lite 2.0.0 Beta allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because the ccnl_ndntlv_prependBlob function in ccnl-pkt-ndntlv.c can be called with wrong arguments. Specifically, there is an incorrect integer data type causing a negative third argument in some cases of crafted TLV data with inconsistent length information. | [email protected] | 9.8 | 1.47% | 2018-02-14 | 2026-06-16 |
| CVE-2018-6953 | In CCN-lite 2, the Parser of NDNTLV does not verify whether a certain component's length field matches the actual component length, which has a resultant buffer overflow and out-of-bounds memory accesses. | [email protected] | 9.8 | 1.59% | 2018-02-13 | 2026-06-16 |
| CVE-2018-6948 | In CCN-lite 2, the function ccnl_prefix_to_str_detailed can cause a buffer overflow, when writing a prefix to the buffer buf. The maximal size of the prefix is CCNL_MAX_PREFIX_SIZE; the buffer has the size CCNL_MAX_PREFIX_SIZE. However, when NFN is enabled, additional characters are written to the buffer (e.g., the "NFN" and "R2C" tags). Therefore, sending an NFN-R2C packet with a prefix of size CCNL_MAX_PREFIX_SIZE can cause an overflow of buf inside ccnl_prefix_to_str_detailed. | [email protected] | 9.8 | 1.59% | 2018-02-13 | 2026-06-16 |
| CVE-2017-12473 | ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) via vectors involving packets with "wrong L values." | [email protected] | 7.5 | 1.35% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12472 | ccnl-ext-mgmt.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging missing NULL pointer checks after ccnl_malloc. | [email protected] | 9.8 | 1.85% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12471 | The cnb_parse_lev function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging failure to check for out-of-bounds conditions, which triggers an invalid read in the hexdump function. | [email protected] | 9.8 | 1.85% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12470 | Integer overflow in the ndn_parse_sequence function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors involving the typ and vallen variables. | [email protected] | 9.8 | 1.60% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12469 | Buffer overflow in util/ccnl-common.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging incorrect memory allocation. | [email protected] | 9.8 | 1.92% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12468 | Buffer overflow in ccn-lite-ccnb2xml.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors involving the vallen and len variables. | [email protected] | 9.8 | 1.92% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12467 | Memory leak in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumption) by leveraging failure to allocate memory for the comp or complen structure member. | [email protected] | 7.5 | 1.58% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12466 | CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors related to ssl_halen when running ccn-lite-sim, which trigger an out-of-bounds access. | [email protected] | 9.8 | 1.85% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12465 | Multiple integer overflows in CCN-lite before 2.00 allow context-dependent attackers to have unspecified impact via vectors involving the (1) vallen variable in the iottlv_parse_sequence function or (2) typ, vallen and i variables in the localrpc_parse function. | [email protected] | 9.8 | 1.85% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12464 | ccn-lite-valid.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via vectors involving the keyfile variable. | [email protected] | 7.5 | 1.58% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12463 | Memory leak in the ccnl_app_RX function in ccnl-uapi.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumption) via vectors involving an envelope_s structure pointer when the packet format is unknown. | [email protected] | 7.5 | 1.40% | 2018-02-07 | 2026-06-16 |
| CVE-2017-12412 | ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers infinite recursion and a stack overflow. | [email protected] | 7.8 | 1.34% | 2018-02-07 | 2026-06-16 |
| CVE-2018-6480 | A type confusion issue was discovered in CCN-lite 2, leading to a memory access violation and a failure of the nonce feature (which, for example, helped with loop prevention). ccnl_fwd_handleInterest assumes that the union member s is of type ccnl_pktdetail_ndntlv_s. However, if the type is in fact struct ccnl_pktdetail_ccntlv_s or struct ccnl_pktdetail_iottlv_s, the memory at that point is either uninitialised or points to data that is not a nonce, which renders the code using the local variabl | [email protected] | 8.8 | 1.32% | 2018-01-31 | 2026-06-16 |