Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2019-11360

iptables: buffer overflow in iptables-restore

A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c.

CVSS 3.1 · 4.2 Medium EPSS 2.2% KEV · Not listed
Vendors
Netfilter
Products
Iptables
CVE-2001-1387

security flaw

iptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "--reject-with tcp-reset," which causes iptables to generate different responses than specified by the administrator, possibly leading to an information leak.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Netfilter Redhat
Products
Iptables Linux
CVE-2001-1388

security flaw

iptables before 1.2.4 does not accurately convert rate limits that are specified on the command line, which could allow attackers or users to generate more or less traffic than intended by the administrator.

CVSS 2.0 · 5.0 Medium EPSS 1.1% KEV · Not listed
Vendors
Netfilter Redhat
Products
Iptables Linux
CVE-2024-6284

Improper IPv4 and IPv6 byte order storage in github.com/google/nftables

In https://github.com/google/nftables  IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses). This issue affects:  https://pkg.go.dev/github.com/google/nftables@v0.1.0 The bug was fixed in the next released version:  https://pkg.go.dev/github.com/google/nftables@v0.2.0

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Netfilter
Products
Nftables Nftables
CVE-2015-6496

conntrackd crash on unexpected network traffic

conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed
Vendors
Debian Netfilter
Products
Debian Linux Conntrack-tools
CVE-2012-2663

iptables: --syn flag bypass

extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.

CVSS 2.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Netfilter
Products
Iptables