Priority LOW 33
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.
Vulnerabilities
6 records
TI-2025-23798 CVE-2025-32743 · GHSA-r8hx-vf7j-v5q3
In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an…
Priority HIGH 74
In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response.
TI-2025-23446 CVE-2025-32366 · GHSA-9j63-jqr8-fh2v
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR…
Priority LOW 22
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whether the sum of *end…
TI-2012-02060 CVE-2012-2322 · GHSA-r9hm-xqmv-vp84
Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before…
Priority LOW 29
Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service (infinite loop and crash) via an invalid length value in a DHCP packet.
TI-2012-02059 CVE-2012-2321 · GHSA-frmw-wwv7-8q6q
The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary…
Priority MEDIUM 51
The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host name or (2) domain name in a DHCP reply.
TI-2012-02058 CVE-2012-2320 · GHSA-hrhq-658c-r72w
ConnMan before 0.85 does not ensure that netlink messages originate from the kernel…
Priority LOW 39
ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message.