rpm package
suse/avahi&distro=SUSE Linux Enterprise Micro 5.3
pkg:rpm/suse/avahi&distro=SUSE%20Linux%20Enterprise%20Micro%205.3
Vulnerabilities (13)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-34933 | Med | 5.5 | < 0.8-150400.7.31.2 | 0.8-150400.7.31.2 | Apr 3, 2026 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patc | |
| CVE-2026-24401 | — | < 0.8-150400.7.31.2 | 0.8-150400.7.31.2 | Jan 24, 2026 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the a | ||
| CVE-2025-68471 | — | < 0.8-150400.7.26.1 | 0.8-150400.7.26.1 | Jan 12, 2026 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | ||
| CVE-2025-68468 | — | < 0.8-150400.7.26.1 | 0.8-150400.7.26.1 | Jan 12, 2026 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. | ||
| CVE-2025-68276 | — | < 0.8-150400.7.26.1 | 0.8-150400.7.26.1 | Jan 12, 2026 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag s | ||
| CVE-2024-52616 | Med | 5.3 | < 0.8-150400.7.20.1 | 0.8-150400.7.20.1 | Nov 21, 2024 | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | |
| CVE-2024-52615 | Med | 5.3 | < 0.8-150400.7.23.1 | 0.8-150400.7.23.1 | Nov 21, 2024 | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | |
| CVE-2023-38473 | — | < 0.8-150400.7.10.1 | 0.8-150400.7.10.1 | Nov 2, 2023 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. | ||
| CVE-2023-38472 | — | < 0.8-150400.7.13.1 | 0.8-150400.7.13.1 | Nov 2, 2023 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. | ||
| CVE-2023-38471 | — | < 0.8-150400.7.16.1 | 0.8-150400.7.16.1 | Nov 2, 2023 | A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. | ||
| CVE-2023-38470 | — | < 0.8-150400.7.10.1 | 0.8-150400.7.10.1 | Nov 2, 2023 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. | ||
| CVE-2023-38469 | — | < 0.8-150400.7.16.1 | 0.8-150400.7.16.1 | Nov 2, 2023 | A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. | ||
| CVE-2023-1981 | — | < 0.8-150400.7.3.1 | 0.8-150400.7.3.1 | May 26, 2023 | A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. |
- affected < 0.8-150400.7.31.2fixed 0.8-150400.7.31.2
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patc
- CVE-2026-24401Jan 24, 2026affected < 0.8-150400.7.31.2fixed 0.8-150400.7.31.2
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the a
- CVE-2025-68471Jan 12, 2026affected < 0.8-150400.7.26.1fixed 0.8-150400.7.26.1
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.
- CVE-2025-68468Jan 12, 2026affected < 0.8-150400.7.26.1fixed 0.8-150400.7.26.1
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs.
- CVE-2025-68276Jan 12, 2026affected < 0.8-150400.7.26.1fixed 0.8-150400.7.26.1
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag s
- affected < 0.8-150400.7.20.1fixed 0.8-150400.7.20.1
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
- affected < 0.8-150400.7.23.1fixed 0.8-150400.7.23.1
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
- CVE-2023-38473Nov 2, 2023affected < 0.8-150400.7.10.1fixed 0.8-150400.7.10.1
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
- CVE-2023-38472Nov 2, 2023affected < 0.8-150400.7.13.1fixed 0.8-150400.7.13.1
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
- CVE-2023-38471Nov 2, 2023affected < 0.8-150400.7.16.1fixed 0.8-150400.7.16.1
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
- CVE-2023-38470Nov 2, 2023affected < 0.8-150400.7.10.1fixed 0.8-150400.7.10.1
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
- CVE-2023-38469Nov 2, 2023affected < 0.8-150400.7.16.1fixed 0.8-150400.7.16.1
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
- CVE-2023-1981May 26, 2023affected < 0.8-150400.7.3.1fixed 0.8-150400.7.3.1
A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.