CoreCVE
Back

CRITICAL

Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages

Published Dec 6, 2019

Description

Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (4)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 6, 2019
Updated Aug 5, 2024
Reserved Nov 2, 2019
Link CVE-2019-18671
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-18671
Red Hat
Severity n/a
Public date n/a
Links CVE-2019-18671