ALPINE-CVE-2025-62291

In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow...

CVE-2025-62291

CVE-2025-62291 affects the eap-mschapv2 plugin in strongSwan (client-side). Vulnerable when using strongSwan before 6.0.3; a crafted EAP-MSCHAPv2 Failure message can trigger an integer underflow, potentially causing a heap-based buffer overflow. Connected advisories note patched packages: strongS...

strongSwan numerical error vulnerability

strongSwan is an open-source VPN solution based on IPsec, developed by Andreas Steffen of Switzerland. This solution includes X.509 public key certificates, secure storage of private keys, and authentication mechanisms such as smart cards. Versions of strongSwan prior to 6.0.3 contained a numeric...

CVE-2025-62291

In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow...

CVE-2025-62291

In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow...

Astra Linux – Vulnerability in StrongSwan

In the eap-mschapv2 plugin client-side in strongSwan, prior to version 6.0.3, a malicious EAP-MSCHAPv2 server could send a crafted message with a size of 6 to 8 bytes, causing an integer underflow, which could potentially lead to a heap-based buffer overflow...

CVE-2025-12543

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

CVE-2019-12587

The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266NONOSSDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key PMK after the completion of any EAP authentication method, which allows attackers in radio range to replay, decrypt, or spoof frames v...

CVE-2019-12586

The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266NONOSSDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows attackers in radio range to cause a denial of service crash via a crafted message...

Linux Distros Unpatched Vulnerability : CVE-2025-12543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly...

openSUSE 16 Security Update : strongswan (openSUSE-SU-2025-20132-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025-20132-1 advisory. - CVE-2025-62291: Fixed buffer overflow when handling EAP-MSCHAPv2 failure requests bsc1251941. Tenable has extracted the preceding description block...

RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.0.11 (RHSA-2025:22775)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22775 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

SUSE-SU-2025:21167-1 Security update for strongswan

This update for strongswan fixes the following issues: - CVE-2025-62291: Fixed buffer overflow when handling EAP-MSCHAPv2 failure requests bsc1251941...

EUVD-2025-197856

reebox v5 HD firmware = 1.7.20, Freebox v5 Crystal firmware = 1.7.20, Freebox v6 Révolution r1–r3 firmware = 4.7.x, Freebox Mini 4K firmware = 4.7.x, and Freebox One firmware = 4.7.x were discovered to expose subscribers' IMSI identifiers in plaintext during the initial phase of EAP-SIM...

PT-2025-47193

Name of the Vulnerable Software and Affected Versions Freebox v5 HD version 1.7.20 Freebox v5 Crystal version 1.7.20 Freebox v6 Révolution r1–r3 versions 4.7.x Freebox Mini 4K versions 4.7.x Freebox One versions 4.7.x Description Freebox devices expose subscribers' IMSI identifiers in plaintext...

Mageia: Security Advisory (MGASA-2025-0272)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIT-WILDFLY-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...

SUSE: Security Advisory (SUSE-SU-2025:3904-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4359-1] strongswan security update

Debian LTS Advisory DLA-4359-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 03, 2025 https://wiki.debian.org/LTS Package : strongswan Version : 5.9.1-1+deb11u5 CVE ID : CVE-2025-62291 Xu Biang discovered a buffer overflow bug in the eap-mschapv2 plugin...

Debian dla-4359 : charon-cmd - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4359 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4359-1 [email protected] https://www.debian.org/lts/security/...