libcoap vulnerabilities

A stack-based buffer overflow exists in libcoap versions up to 4.3.5 (before commit 30db3ea) during address resolution. A remote attacker can trigger a crash or potentially achieve remote code execution if proxy logic is enabled in the application.

A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to read memory beyond string boundaries in the .rodata section.

Version 4.3.1 of the libcoap library contains a buffer over-read vulnerability in the coap_parse_oscore_conf_mem function in coap_oscore.c.