CVE-2013-2687

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-07-12 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868.

Affected products

BlackBerry Qnx Momentics Tool Suite: through 6.5.0; 4.5, 4.6, 4.7, 6.5.0
BlackBerry Qnx Neutrino Rtos: through 6.5.0; 6.4.1, 6.5.0
BlackBerry QNX Software Development Platform (SDP): all versions

References

http://aluigi.altervista.org/adv/qnxph_1-adv.txt
http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01
http://www.qnx.com/download/feature.html?programid=24850
http://aluigi.altervista.org/adv/qnxph_1-adv.txt
http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01
http://www.qnx.com/download/feature.html?programid=24850

Get alerted when CVE-2013-2687 or the next vulnerability affects your stack