Reproducing-ConnMan-1.34

Connection Manager Copyright C 2007-2012 Intel Corporation. All rights reserved. Functionality and features The following features are built-in into Connection Manager: - Generic plugin infrastructure - Device and network abstraction with basic storage support - IPv4, IPv4-LL link-local and DHCP...

UBUNTU-CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

Linux Distros Unpatched Vulnerability : CVE-2026-115863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

DEBIAN-CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

EUVD-2026-109113

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

Versions of ConnMan through 2.0 are vulnerable to a stack-based buffer overflow in the get_domains function located in gdhcp/client.c. The flaw occurs because the software copies a fixed 1025 bytes from a DHCPv6 DOMAIN_LIST (option 24) into a 1026-byte stack buffer regardless of the actual option...

PT-2026-122190

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get domains in gdhcp/client.c. It copies a fixed NS MAXDNAME 1025 bytes from a DHCPv6 DOMAIN LIST option 24 value into a 1026-byte stack buffer dns name regardless of the actual option length, then...

ConnMan buffer error vulnerability

ConnMan versions 2.0 and earlier contain a buffer error vulnerability. This vulnerability arises because the getdomains function fails to properly limit the length of the DOMAINLIST option when processing DHCPv6 REPLY. As a result, DNS label traversal can lead to out-of-bounds reads and writes in...

Astra Linux - vulnerability in connman

GDHCP in ConnMan prior to version 1.39 can be exploited by network-adjacent attackers to leak sensitive stack information, enabling further exploitation of vulnerabilities in GDHCP...

Astra Linux - vulnerability in connman

A stack-based buffer overflow in dnsproxy within ConnMan prior to version 1.39 could be exploited by network-adjacent attackers to execute arbitrary code...

Astra Linux – Vulnerability in connman

ConnMan also known as Connection Manager versions 1.30 to 1.39 have a stack-based buffer overflow issue in the uncompress function of dnsproxy.c, occurring due to the use of NAME, RDATA, or RDLENGTH fields for the A or AAAA records...

Astra Linux - vulnerability in connman

An issue was found in the DNS proxy in Connman up to version 1.40: forwarddnsreply mishandles a strnlen call, resulting in an out-of-bounds read...

Astra Linux - vulnerability in connman

An issue was found in the DNS proxy within Connman up to version 1.40. The implementation of the TCP server’s reply handling fails to verify whether there is sufficient header data, resulting in an out-of-bounds read...

Astra Linux – Vulnerability in connman

In ConnMan through version 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or potentially execute arbitrary code, as those lookup values lead t...

Astra Linux – Vulnerability in connman

In ConnMan version 1.41, a man-in-the-middle attack against a WISPR HTTP query could cause a use-after-free error in WISPR handling, resulting in crashes or code execution...