The IKE daemon in strongSwan 4.3.x before 4.3.7 and 4.4.x before 4.4.1 does not properly check the return values of snprintf calls, which allows remote attackers to execute arbitrary code via crafted (1) certificate or (2) identity data that triggers buffer overflows.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade strongswan | Jul 30, 2024 | Aug 20, 2010 |
| Suse | — | Upgrade strongswan-ikev1Upgrade strongswan-docUpgrade strongswanUpgrade strongswan-libs0Upgrade strongswan-ipsecUpgrade strongswan-ikev2Upgrade strongswan-nm | Feb 17, 2015 | Aug 20, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub