54 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-79980
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier iface-config.dhcpv4.xid as a counter rather than as a per-transaction...
UBUNTU-CVE-2026-79980
The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier iface-config.dhcpv4.xid as a counter rather than as a per-transaction random value. It was seeded once with sysrand32get in dhcpv4startinternal, incremented by one in dhcpv4senddiscover and dhcpv4senddecline...
CVE-2026-79980
The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier iface-config.dhcpv4.xid as a counter rather than as a per-transaction random value. It was seeded once with sysrand32get in dhcpv4startinternal, incremented by one in dhcpv4senddiscover and dhcpv4senddecline...
CVE-2026-79980 Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS
The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier iface-config.dhcpv4.xid as a counter rather than as a per-transaction random value. It was seeded once with sysrand32get in dhcpv4startinternal, incremented by one in dhcpv4senddiscover and dhcpv4senddecline...
Rocky Linux 9 [CIQ] Security Update: avahi / avahi-autoipd / avahi-autoipd-debuginfo / avahi-compat-howl / etc (crlsa-2025_7437)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257437 advisory. avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52616 Tenable has extracted the preceding description block directly from the CIQ security advisory...
netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs
A flaw was found in Netty's DNS resolver component. This vulnerability arises from the use of a predictable pseudo-random number generator PRNG for DNS transaction IDs and a static User Datagram Protocol UDP source port. This combination significantly reduces the randomness of DNS queries, making...
GHSA-XMV7-R254-6Q78 Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port
Summary Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning Kaminsky attack. Details Two factors contribute to this vulnerability in...
PT-2026-47609
Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final Description The DNS resolver in the io.netty.resolver.dns module uses a predictable Pseudo-Random Number Generator PRNG for generating DNS transaction IDs and defaults ...
CVE-2026-32694
In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the...
EulerOS 2.0 SP10 : avahi (EulerOS-SA-2026-1301)
According to the versions of the avahi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after...
EulerOS Virtualization 2.10.1 : avahi (EulerOS-SA-2026-1529)
According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them...
EulerOS Virtualization 2.10.0 : avahi (EulerOS-SA-2026-1549)
According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them...
EulerOS 2.0 SP11 : avahi (EulerOS-SA-2025-2454)
According to the versions of the avahi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS...
RLSA-2025:7437 Moderate: avahi security update
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other...
CVE-2010-1689
The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange Server 2007 SP2 and...
ALSA-2025:7437 Moderate: avahi security update
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other...
Moderate: avahi security update
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other...
SUSE-SU-2025:20308-1 Security update for avahi
This update for avahi fixes the following issues: - CVE-2024-52616: Fixed predictable transaction IDs for Wide-Area DNS bsc1233420 - Drop rcFOO symlinks jscPED-266...
