Most recent entries from all

ALSA-2024:7260 — Moderate: net-snmp security update

Affected: AlmaLinux:9: net-snmp, AlmaLinux:9: net-snmp-agent-libs, AlmaLinux:9: net-snmp-devel, AlmaLinux:9: net-snmp-libs, AlmaLinux:9: net-snmp-perl, AlmaLinux:9: net-snmp-utils, AlmaLinux:9: python3-net-snmp

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

Security Fix(es):

* net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (CVE-2022-24805) * : net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously (CVE-2022-24806) * net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access (CVE-2022-24807) * net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24809) * net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (CVE-2022-24808) * net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24810)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-06509

Withdrawn: BELL-CVE-2022-24805 — CVE-2022-24805 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2023-avi-0318 — De multiples vulnérabilités ont été découvertes dans VMware. Elles permettent à un attaquan…

certfr-2023-avi-0318

EUVD-2026-14277

fkie_cve-2022-24805

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

gsd-2022-24805

OESA-2022-1888 — net-snmp security update

Affected: openEuler:20.03-LTS-SP1: net-snmp, openEuler:20.03-LTS-SP3: net-snmp, openEuler:22.03-LTS: net-snmp

Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6. The suite includes:

+ - An extensible agent for responding to SNMP queries including built-in + support for a wide range of MIB information modules + - Command-line applications to retrieve and manipulate information from + SNMP-capable devices + - A daemon application for receiving SNMP notifications + - A library for developing new SNMP applications, with C and Perl APIs + - A graphical MIB browser. Security Fix(es): https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.(CVE-2022-24809) CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES(CVE-2022-24807) https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference(CVE-2022-24808) +*5.9.2*: + security: + - These two CVEs can be exploited by a user with read-only credentials: + - CVE-2022-24805 A buffer overflow in the handling of the INDEX of + NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. + - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable + can cause…

openSUSE-SU-2024:12174-1 — libsnmp40-32bit-5.9.2-1.1 on GA media

libsnmp40-32bit-5.9.2-1.1 on GA media

RHSA-2024:7875 — Red Hat Security Advisory: net-snmp security update

net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

SUSE-RU-2024:0029-1 — Recommended update for net-snmp

Recommended update for net-snmp

UBUNTU-CVE-2022-24805

Affected: Ubuntu:Pro:14.04:LTS: net-snmp, Ubuntu:Pro:16.04:LTS: net-snmp, Ubuntu:18.04:LTS: net-snmp, Ubuntu:20.04:LTS: net-snmp, Ubuntu:22.04:LTS: net-snmp

WID-SEC-W-2026-1022 — Juniper Patchday April 2026: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Juniper Apstra, Junos OS, Junos OS Evolved und Junos Space ausnutzen, um erweiterte Berechtigungen – sogar Root-Rechte – zu erlangen, beliebigen Code auszuführen – auch mit erweiterten Berechtigungen –, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder Daten zu manipulieren.