Most recent entries from all

ALSA-2025:7201 — Moderate: corosync security update

Affected: AlmaLinux:9: corosync-vqsim, AlmaLinux:9: corosynclib

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.

Security Fix(es):

* corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

bdu:2025-03217

certfr-2025-avi-0651 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0651

EUVD-2026-257528

fkie_cve-2025-30472

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

GHSA-4q2r-xgxr-vvqm

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

OESA-2025-1365 — corosync security update

Affected: openEuler:22.03-LTS-SP4: corosync, openEuler:24.03-LTS: corosync, openEuler:24.03-LTS-SP1: corosync, openEuler:20.03-LTS-SP4: corosync, openEuler:22.03-LTS-SP3: corosync

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script. Security Fix(es):

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.(CVE-2025-30472)

openSUSE-SU-2025:14933-1 — corosync-3.1.9-2.1 on GA media

corosync-3.1.9-2.1 on GA media

RHSA-2025:7478 — Red Hat Security Advisory: corosync security update

corosync: Stack buffer overflow from 'orf_token_endian_convert'

SUSE-SU-2025:1084-1 — Security update for corosync

Security update for corosync

UBUNTU-CVE-2025-30472

Affected: Ubuntu:16.04:LTS: corosync, Ubuntu:18.04:LTS: corosync, Ubuntu:20.04:LTS: corosync, Ubuntu:22.04:LTS: corosync, Ubuntu:24.04:LTS: corosync, Ubuntu:25.10: corosync

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

WID-SEC-W-2025-1041 — Red Hat Enterprise Linux (corosync): Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in Corosync ausnutzen, um beliebigen Programmcode auszuführen.