In Partnership

An integer underflow in the `iscsiuio` component occurs during the parsing of the IPv4 Dynamic Host Configuration Protocol (DHCP), which is a network management protocol used to automatically assign IP addresses. A remote attacker on the same local network segment can trigger an out-of-bounds read by sending a specially crafted IPv4/UDP DHCP reply, resulting in a denial of service as the `iscsiuio` process crashes.

A flaw in the iscsiuio daemon allows a remote attacker on the same local network segment to cause a Denial of Service (DoS). By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement containing a zero-length option, an attacker can trigger an infinite loop. This results in sustained CPU usage, making the daemon unresponsive and impacting system availability. Additionally, a risk of out-of-bounds reads exists when processing a short IPv6 payload, although no memory corruption or data exposure has been confirmed.

A flaw in the `iscsiuio` component involves an integer underflow and out-of-bounds read during the parsing of Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packets. An unauthenticated attacker on an adjacent network segment can send crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length, causing the DHCPv6 payload length to underflow. This can be exploited while the client is in an active DHCPv6 exchange, resulting in a denial of service through a process crash or service disruption.

A heap out-of-bounds read occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the `auth-indicators` array. In specific configurations involving GSSAPI authentication and a Kerberos environment, a remote attacker could exploit this to cause the SSH authentication path to crash or abort, resulting in a denial of service (DoS) that impacts the availability of the SSH service.

A double free flaw exists in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. A malicious SSH server can exploit this to cause client-side process termination, leading to a Denial of Service (DoS).

A flaw in OpenSSH allows a local unprivileged attacker on a Linux client host to hijack client-side X11 forwarding connections. This occurs when X11 forwarding is enabled and a local UNIX-domain X socket is used, allowing the attacker to pre-bind the preferred abstract X socket name. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may enable manipulation of the forwarded session.