Most recent entries from all

bdu:2024-06537

certfr-2024-avi-0968 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta…

certfr-2024-avi-0968

EUVD-2026-199036

fkie_cve-2024-28882

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

GHSA-v34q-j8xh-hjgx

OpenVPN 2.6.10 and earlier in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

gsd-2024-28882

ICSA-24-319-06 — Siemens SCALANCE M-800 Family

An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query. Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The F…

OESA-2024-1840 — openvpn security update

Affected: openEuler:22.03-LTS-SP4: openvpn, openEuler:22.03-LTS-SP1: openvpn, openEuler:22.03-LTS-SP3: openvpn, openEuler:20.03-LTS-SP4: openvpn, openEuler:24.03-LTS: openvpn

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session(CVE-2024-28882)

openSUSE-SU-2024:14436-1 — openvpn-2.6.10-2.1 on GA media

openvpn-2.6.10-2.1 on GA media

SUSE-SU-2024:3502-1 — Security update for openvpn

Security update for openvpn

UBUNTU-CVE-2024-28882

Affected: Ubuntu:24.04:LTS: openvpn

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

VDE-2025-053 — Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools

WID-SEC-W-2024-1433 — OpenVPN: Mehrere Schwachstellen ermöglichen Denial of Service und Privilegieneskalation

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenVPN ausnutzen, um einen Denial of Service Angriff durchzuführen und erhöhte Privilegien zu erlangen.