rpm package
suse/strongswan&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
pkg:rpm/suse/strongswan&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-25075 | Hig | 7.5 | < 5.1.3-26.32.1 | 5.1.3-26.32.1 | Mar 23, 2026 | strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers c | |
| CVE-2025-62291 | Hig | 8.1 | < 5.1.3-26.29.1 | 5.1.3-26.29.1 | Jan 16, 2026 | In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow. | |
| CVE-2026-47895 | — | < 5.1.3-26.38.1 | 5.1.3-26.38.1 | — | strongSwan could be made to crash or run programs if it received specially crafted network traffic. |
- affected < 5.1.3-26.32.1fixed 5.1.3-26.32.1
strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers c
- affected < 5.1.3-26.29.1fixed 5.1.3-26.29.1
In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.
- affected < 5.1.3-26.38.1fixed 5.1.3-26.38.1
strongSwan could be made to crash or run programs if it received specially crafted network traffic.