libreswan 3.5

CPE Details

libreswan 3.5
libreswan
libreswan
3.5
2013-10-11
12h56 +00:00
2013-10-11
13h10 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:libreswan:libreswan:3.5:*:*:*:*:*:*:*

Informations

Vendor

libreswan

Product

libreswan

Version

3.5

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2023-38712 2023-08-24 22h00 +00:00 An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.
6.5
Moyen
CVE-2020-1763 2020-05-12 11h41 +00:00 An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
7.5
Haute
CVE-2019-10155 2019-06-12 11h51 +00:00 The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.
3.1
Bas
CVE-2019-12312 2019-05-24 11h06 +00:00 In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
7.5
Haute
CVE-2016-5391 2017-06-13 15h00 +00:00 libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart).
7.5
Haute
CVE-2016-5361 2016-06-16 12h00 +00:00 programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.
7.5
Haute
CVE-2013-6467 2014-01-26 19h00 +00:00 Libreswan 3.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.
5
CVE-2013-7294 2014-01-16 01h00 +00:00 The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.
5