CVE-2026-22992

In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from monhandleauthdone Currently any error from cephauthhandlereplydone is propagated via finishauth but isn't returned from monhandleauthdone. This results in higher layers learning that despite...

SUSE CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

SUSE CVE-2025-57156

NULL pointer dereference in the dacpreplyplayqueueeditclear function in src/httpddacp.c in owntone-server through commit 6d604a1 newer commit after version 28.12 allows remote attackers to cause a Denial of Service crash...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-57156

NULL pointer dereference in the dacpreplyplayqueueeditclear function in src/httpddacp.c in owntone-server through commit 6d604a1 newer commit after version 28.12 allows remote attackers to cause a Denial of Service crash...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

OwnTone security vulnerabilities

OwnTone is an open-source Linux/FreeBSD DAAP iTunes, MPD Music Player Daemon, and RSP Roku media server. OwnTone has a security vulnerability that stems from a null pointer dereferencing in the daapreplygroups function, which may lead to a denial-of-service attack...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-57156

NULL pointer dereference in the dacpreplyplayqueueeditclear function in src/httpddacp.c in owntone-server through commit 6d604a1 newer commit after version 28.12 allows remote attackers to cause a Denial of Service crash...

PT-2026-3653

Name of the Vulnerable Software and Affected Versions owntone-server versions prior to the commit after version 28.2 Description A flaw exists in owntone-server due to a NULL pointer dereference within the daap reply groups function, located in src/httpd daap.c. This issue, present through commit...

CVE-2025-63648

The owntone-server media server is vulnerable to a NULL pointer dereference within the dacp_reply_playqueueedit_move function located in src/httpd_dacp.c (specifically in commit b7e385f ). This flaw allows an unauthenticated attacker to trigger a Denial of Service (DoS) condition by sending a spe...

CVE-2025-57156

The owntone-server media server is vulnerable to a NULL pointer dereference in the dacp_reply_playqueueedit_clear function located in src/httpd_dacp.c. This flaw exists in versions through commit 6d604a1 (newer than version 28.12). A remote attacker can exploit this vulnerability to cause a Denia...

CVE-2025-57155

NULL pointer dereference in the daapreplygroups function in src/httpddaap.c in owntone-server through commit 5e6f19a newer commit after version 28.2 allows remote attackers to cause a Denial of Service...

CVE-2025-57155

A NULL pointer dereference vulnerability exists in the daap_reply_groups function within src/httpd_daap.c of owntone-server . This flaw is present in versions through commit 5e6f19a (newer commits after version 28.2). Remote attackers can exploit this issue to trigger a Denial of Service (DoS) . ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001201)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001201 advisory. The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service system crash via a long RPC...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000701 advisory. net/ceph/authnone.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service NULL pointer dereference and system crash or possibly have...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003316)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003316 advisory. An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aacsendrawsrb...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003085)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003085 advisory. An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aacsendrawsrb...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001787)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001787 advisory. The nfs4getacluncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy...