Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21014-1

Опубликовано: 22 июн. 2026
Источник: suse-cvrf

Описание

Security update for avahi

This update for avahi fixes the following issues:

  • CVE-2026-34933: reachable assertion in transport_flags_from_domain can crash the avahi-daemon (bsc#1261546).
  • CVE-2026-24401: unsolicited mDNS responses containing a recursive CNAME record can crash the avahi-daemon (bsc#1257235).

Список пакетов

openSUSE Leap 16.0
avahi-0.8-160000.5.1
avahi-autoipd-0.8-160000.5.1
avahi-compat-howl-devel-0.8-160000.5.1
avahi-compat-mDNSResponder-devel-0.8-160000.5.1
avahi-lang-0.8-160000.5.1
avahi-utils-0.8-160000.5.1
avahi-utils-gtk-0.8-160000.5.1
libavahi-client3-0.8-160000.5.1
libavahi-common3-0.8-160000.5.1
libavahi-core7-0.8-160000.5.1
libavahi-devel-0.8-160000.5.1
libavahi-glib-devel-0.8-160000.5.1
libavahi-glib1-0.8-160000.5.1
libavahi-gobject-devel-0.8-160000.5.1
libavahi-gobject0-0.8-160000.5.1
libavahi-libevent1-0.8-160000.5.1
libavahi-qt6-1-0.8-160000.5.1
libavahi-qt6-devel-0.8-160000.5.1
libavahi-ui-gtk3-0-0.8-160000.5.1
libdns_sd-0.8-160000.5.1
libhowl0-0.8-160000.5.1
python3-avahi-gtk-0.8-160000.5.1
python313-avahi-0.8-160000.5.1
typelib-1_0-Avahi-0_6-0.8-160000.5.1

Ссылки

Описание

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.

Затронутые продукты
openSUSE Leap 16.0:avahi-0.8-160000.5.1
openSUSE Leap 16.0:avahi-autoipd-0.8-160000.5.1
openSUSE Leap 16.0:avahi-compat-howl-devel-0.8-160000.5.1
openSUSE Leap 16.0:avahi-compat-mDNSResponder-devel-0.8-160000.5.1
Ссылки

Описание

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

Затронутые продукты
openSUSE Leap 16.0:avahi-0.8-160000.5.1
openSUSE Leap 16.0:avahi-autoipd-0.8-160000.5.1
openSUSE Leap 16.0:avahi-compat-howl-devel-0.8-160000.5.1
openSUSE Leap 16.0:avahi-compat-mDNSResponder-devel-0.8-160000.5.1
Ссылки
Уязвимость openSUSE-SU-2026:21014-1