{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"
      },
      {
        "category": "self",
        "summary": "SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-577017.json"
      }
    ],
    "title": "SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1",
    "tracking": {
      "current_release_date": "2026-05-12T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-577017",
      "initial_release_date": "2026-05-12T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-12T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX MX5000",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX MX5000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX MX5000RE",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX MX5000RE"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1400",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1400"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1500",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1500"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1501",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1501"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1510",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1510"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1511",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1511"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1512",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1512"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1524",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1524"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX1536",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX1536"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2.17.1",
                "product": {
                  "name": "RUGGEDCOM ROX RX5000",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX RX5000"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-13103",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-13103"
    },
    {
      "cve": "CVE-2019-13104",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) while reading a crafted ext4 filesystem.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-13104"
    },
    {
      "cve": "CVE-2019-13106",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-13106"
    },
    {
      "cve": "CVE-2019-14192",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14192"
    },
    {
      "cve": "CVE-2019-14193",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the \"if\" block after calculating the new path length.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14193"
    },
    {
      "cve": "CVE-2019-14194",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14194"
    },
    {
      "cve": "CVE-2019-14195",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the \"else\" block after calculating the new path length.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14195"
    },
    {
      "cve": "CVE-2019-14196",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14196"
    },
    {
      "cve": "CVE-2019-14197",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14197"
    },
    {
      "cve": "CVE-2019-14198",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14198"
    },
    {
      "cve": "CVE-2019-14199",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14199"
    },
    {
      "cve": "CVE-2019-14200",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14200"
    },
    {
      "cve": "CVE-2019-14201",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14201"
    },
    {
      "cve": "CVE-2019-14202",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14202"
    },
    {
      "cve": "CVE-2019-14203",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14203"
    },
    {
      "cve": "CVE-2019-14204",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2019-14204"
    },
    {
      "cve": "CVE-2020-10648",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2020-10648"
    },
    {
      "cve": "CVE-2022-2347",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2022-2347"
    },
    {
      "cve": "CVE-2022-30552",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Das U-Boot 2022.01 has a Buffer Overflow.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2022-30552"
    },
    {
      "cve": "CVE-2022-30790",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2022-30790"
    },
    {
      "cve": "CVE-2022-34835",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the \"i2c md\" command enables the corruption of the return address pointer of the do_i2c_md function.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2022-34835"
    },
    {
      "cve": "CVE-2023-3019",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2023-3019"
    },
    {
      "cve": "CVE-2023-27043",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2023-27043"
    },
    {
      "cve": "CVE-2024-3447",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2024-3447"
    },
    {
      "cve": "CVE-2024-22365",
      "cwe": {
        "id": "CWE-664",
        "name": "Improper Control of a Resource Through its Lifetime"
      },
      "notes": [
        {
          "category": "summary",
          "text": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2024-22365"
    },
    {
      "cve": "CVE-2024-57256",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2024-57256"
    },
    {
      "cve": "CVE-2024-57258",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2024-57258"
    },
    {
      "cve": "CVE-2025-0395",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-0395"
    },
    {
      "cve": "CVE-2025-3576",
      "cwe": {
        "id": "CWE-328",
        "name": "Use of Weak Hash"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-3576"
    },
    {
      "cve": "CVE-2025-6020",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-6020"
    },
    {
      "cve": "CVE-2025-7425",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-7425"
    },
    {
      "cve": "CVE-2025-9714",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Uncontrolled recursion in\u00a0XPath evaluation\u00a0in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-9714"
    },
    {
      "cve": "CVE-2025-46836",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-46836"
    },
    {
      "cve": "CVE-2025-49794",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u003csch:name path=\"...\"/\u003e schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0027s crash using libxml or other possible undefined behaviors.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-49794"
    },
    {
      "cve": "CVE-2025-49796",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.17.1 or later version",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110002017/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11"
          ]
        }
      ],
      "title": "CVE-2025-49796"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\n- CVE-2025-46836: Fixed absence of bound check that might lead to a stack buffer overflow (bsc#1243581)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-2974,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-2974",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_02974-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:02974-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202502974-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:02974-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-August/041346.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246608",
        "url": "https://bugzilla.suse.com/1246608"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2025-08-25T09:23:53Z",
      "generator": {
        "date": "2025-08-25T09:23:53Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:02974-1",
      "initial_release_date": "2025-08-25T09:23:53Z",
      "revision_history": [
        {
          "date": "2025-08-25T09:23:53Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.12.1.aarch64",
                "product": {
                  "name": "net-tools-1.60-765.12.1.aarch64",
                  "product_id": "net-tools-1.60-765.12.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.12.1.i586",
                "product": {
                  "name": "net-tools-1.60-765.12.1.i586",
                  "product_id": "net-tools-1.60-765.12.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.12.1.ppc64le",
                "product": {
                  "name": "net-tools-1.60-765.12.1.ppc64le",
                  "product_id": "net-tools-1.60-765.12.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.12.1.s390",
                "product": {
                  "name": "net-tools-1.60-765.12.1.s390",
                  "product_id": "net-tools-1.60-765.12.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.12.1.s390x",
                "product": {
                  "name": "net-tools-1.60-765.12.1.s390x",
                  "product_id": "net-tools-1.60-765.12.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.12.1.x86_64",
                "product": {
                  "name": "net-tools-1.60-765.12.1.x86_64",
                  "product_id": "net-tools-1.60-765.12.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-1.60-765.12.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.12.1.x86_64"
        },
        "product_reference": "net-tools-1.60-765.12.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.12.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.12.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.12.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-25T09:23:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\nSecurity issues fixed:\n\n- Avoid unsafe use of `memcpy` in `ifconfig` (bsc#1248687).    \n- Prevent overflow in `ax25` and `netrom` (bsc#1248687).   \n- Fix stack buffer overflow in `parse_hex` (bsc#1248687).\n- Fix stack buffer overflow in `proc_gen_fmt` (bsc#1248687).\n\nOther issues fixed:\n\n- Allow use of long interface names after CVE-2025-46836 fix, even if they are not accepted by the kernel (bsc#1248410).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-3245,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-3245",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03245-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:03245-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202503245-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:03245-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-September/041723.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248410",
        "url": "https://bugzilla.suse.com/1248410"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248687",
        "url": "https://bugzilla.suse.com/1248687"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2025-09-17T10:55:16Z",
      "generator": {
        "date": "2025-09-17T10:55:16Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:03245-1",
      "initial_release_date": "2025-09-17T10:55:16Z",
      "revision_history": [
        {
          "date": "2025-09-17T10:55:16Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.15.1.aarch64",
                "product": {
                  "name": "net-tools-1.60-765.15.1.aarch64",
                  "product_id": "net-tools-1.60-765.15.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.15.1.i586",
                "product": {
                  "name": "net-tools-1.60-765.15.1.i586",
                  "product_id": "net-tools-1.60-765.15.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.15.1.ppc64le",
                "product": {
                  "name": "net-tools-1.60-765.15.1.ppc64le",
                  "product_id": "net-tools-1.60-765.15.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.15.1.s390",
                "product": {
                  "name": "net-tools-1.60-765.15.1.s390",
                  "product_id": "net-tools-1.60-765.15.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.15.1.s390x",
                "product": {
                  "name": "net-tools-1.60-765.15.1.s390x",
                  "product_id": "net-tools-1.60-765.15.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-1.60-765.15.1.x86_64",
                "product": {
                  "name": "net-tools-1.60-765.15.1.x86_64",
                  "product_id": "net-tools-1.60-765.15.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-1.60-765.15.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.15.1.x86_64"
        },
        "product_reference": "net-tools-1.60-765.15.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:net-tools-1.60-765.15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-17T10:55:16Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-46836: missing bounds check in `get_name` may lead to a stack buffer overflow (bsc#1243581).\n- Avoid unsafe use of `memcpy` in `ifconfig` (bsc#1248687).    \n- Prevent overflow in `ax25` and `netrom` (bsc#1248687).   \n- Fix stack buffer overflow in `parse_hex` (bsc#1248687).\n- Fix stack buffer overflow in `proc_gen_fmt` (bsc#1248687).\n    \nOther issues fixed:\n\n- Allow use of long interface names after CVE-2025-46836 fix, even if they are not accepted by the kernel (bsc#1248410).\n- Fix netrom support.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-3260,SUSE-SLE-Micro-5.3-2025-3260,SUSE-SLE-Micro-5.4-2025-3260,SUSE-SLE-Micro-5.5-2025-3260,SUSE-SLE-Module-Basesystem-15-SP6-2025-3260,SUSE-SLE-Module-Basesystem-15-SP7-2025-3260,SUSE-SLE-Module-Legacy-15-SP6-2025-3260,SUSE-SLE-Module-Legacy-15-SP7-2025-3260,SUSE-SUSE-MicroOS-5.1-2025-3260,SUSE-SUSE-MicroOS-5.2-2025-3260,openSUSE-SLE-15.6-2025-3260",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03260-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:03260-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202503260-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:03260-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-September/041766.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246608",
        "url": "https://bugzilla.suse.com/1246608"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248410",
        "url": "https://bugzilla.suse.com/1248410"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248687",
        "url": "https://bugzilla.suse.com/1248687"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 142461",
        "url": "https://bugzilla.suse.com/142461"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2025-09-18T00:09:50Z",
      "generator": {
        "date": "2025-09-18T00:09:50Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:03260-1",
      "initial_release_date": "2025-09-18T00:09:50Z",
      "revision_history": [
        {
          "date": "2025-09-18T00:09:50Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
                "product": {
                  "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
                  "product_id": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
                "product": {
                  "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
                  "product_id": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.i586",
                "product": {
                  "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.i586",
                  "product_id": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.i586",
                "product": {
                  "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.i586",
                  "product_id": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
                "product": {
                  "name": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
                  "product_id": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
                "product": {
                  "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
                  "product_id": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
                "product": {
                  "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
                  "product_id": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
                "product": {
                  "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
                  "product_id": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
                "product": {
                  "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
                  "product_id": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
                "product": {
                  "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
                  "product_id": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
                "product": {
                  "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
                  "product_id": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.3",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.3",
                  "product_id": "SUSE Linux Enterprise Micro 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.4",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.4",
                  "product_id": "SUSE Linux Enterprise Micro 5.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.5",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.5",
                  "product_id": "SUSE Linux Enterprise Micro 5.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Legacy 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Legacy 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-legacy:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Legacy 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Legacy 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-legacy:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.1",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.1",
                  "product_id": "SUSE Linux Enterprise Micro 5.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-microos:5.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.2",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.2",
                  "product_id": "SUSE Linux Enterprise Micro 5.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-microos:5.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
          "product_id": "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch"
        },
        "product_reference": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch"
        },
        "product_reference": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Module for Legacy 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le as component of SUSE Linux Enterprise Module for Legacy 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Module for Legacy 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Module for Legacy 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Module for Legacy 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le as component of SUSE Linux Enterprise Module for Legacy 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Module for Legacy 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Module for Legacy 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.1",
          "product_id": "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Micro 5.1",
          "product_id": "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.1",
          "product_id": "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64"
        },
        "product_reference": "net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch"
        },
        "product_reference": "net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
          "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
          "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
          "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
          "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
          "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
          "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
          "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
          "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
          "openSUSE Leap 15.6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "openSUSE Leap 15.6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.1:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Micro 5.5:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Legacy 15 SP6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "SUSE Linux Enterprise Module for Legacy 15 SP7:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "openSUSE Leap 15.6:net-tools-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.aarch64",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.ppc64le",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.s390x",
            "openSUSE Leap 15.6:net-tools-deprecated-2.0+git20170221.479bb4a-150000.5.13.1.x86_64",
            "openSUSE Leap 15.6:net-tools-lang-2.0+git20170221.479bb4a-150000.5.13.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-18T00:09:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\n- Provide more readable error for interface name size checking (bsc#1243581)\n\n- Perform bound checks when parsing interface labels in\n  /proc/net/dev (bsc#1243581, bsc#1246608. CVE-2025-46836)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-431",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20566-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20566-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520566-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20566-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-August/022315.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246608",
        "url": "https://bugzilla.suse.com/1246608"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2025-08-21T08:01:27Z",
      "generator": {
        "date": "2025-08-21T08:01:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20566-1",
      "initial_release_date": "2025-08-21T08:01:27Z",
      "revision_history": [
        {
          "date": "2025-08-21T08:01:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-3.1.aarch64",
                "product": {
                  "name": "net-tools-2.10-3.1.aarch64",
                  "product_id": "net-tools-2.10-3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-3.1.s390x",
                "product": {
                  "name": "net-tools-2.10-3.1.s390x",
                  "product_id": "net-tools-2.10-3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-3.1.x86_64",
                "product": {
                  "name": "net-tools-2.10-3.1.x86_64",
                  "product_id": "net-tools-2.10-3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-3.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:net-tools-2.10-3.1.aarch64"
        },
        "product_reference": "net-tools-2.10-3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-3.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:net-tools-2.10-3.1.s390x"
        },
        "product_reference": "net-tools-2.10-3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-3.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:net-tools-2.10-3.1.x86_64"
        },
        "product_reference": "net-tools-2.10-3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:net-tools-2.10-3.1.aarch64",
          "SUSE Linux Micro 6.0:net-tools-2.10-3.1.s390x",
          "SUSE Linux Micro 6.0:net-tools-2.10-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:net-tools-2.10-3.1.aarch64",
            "SUSE Linux Micro 6.0:net-tools-2.10-3.1.s390x",
            "SUSE Linux Micro 6.0:net-tools-2.10-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:net-tools-2.10-3.1.aarch64",
            "SUSE Linux Micro 6.0:net-tools-2.10-3.1.s390x",
            "SUSE Linux Micro 6.0:net-tools-2.10-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-21T08:01:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\n- Fixed stack buffer overflow in parse_hex, proc_gen_fmt, ax25 and netrom (bsc#1248687)\n- CVE-2025-46836: Fixed stack buffer overflow caused by the absence of bound checks (bsc#1243581)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-265",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20747-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20747-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520747-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20747-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-September/041894.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246608",
        "url": "https://bugzilla.suse.com/1246608"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248410",
        "url": "https://bugzilla.suse.com/1248410"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248687",
        "url": "https://bugzilla.suse.com/1248687"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 142461",
        "url": "https://bugzilla.suse.com/142461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 430864",
        "url": "https://bugzilla.suse.com/430864"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 544339",
        "url": "https://bugzilla.suse.com/544339"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2025-09-16T06:28:45Z",
      "generator": {
        "date": "2025-09-16T06:28:45Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20747-1",
      "initial_release_date": "2025-09-16T06:28:45Z",
      "revision_history": [
        {
          "date": "2025-09-16T06:28:45Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-slfo.1.1_2.1.aarch64",
                "product": {
                  "name": "net-tools-2.10-slfo.1.1_2.1.aarch64",
                  "product_id": "net-tools-2.10-slfo.1.1_2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-slfo.1.1_2.1.ppc64le",
                "product": {
                  "name": "net-tools-2.10-slfo.1.1_2.1.ppc64le",
                  "product_id": "net-tools-2.10-slfo.1.1_2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-slfo.1.1_2.1.s390x",
                "product": {
                  "name": "net-tools-2.10-slfo.1.1_2.1.s390x",
                  "product_id": "net-tools-2.10-slfo.1.1_2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-slfo.1.1_2.1.x86_64",
                "product": {
                  "name": "net-tools-2.10-slfo.1.1_2.1.x86_64",
                  "product_id": "net-tools-2.10-slfo.1.1_2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-slfo.1.1_2.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.aarch64"
        },
        "product_reference": "net-tools-2.10-slfo.1.1_2.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-slfo.1.1_2.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.ppc64le"
        },
        "product_reference": "net-tools-2.10-slfo.1.1_2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-slfo.1.1_2.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.s390x"
        },
        "product_reference": "net-tools-2.10-slfo.1.1_2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-slfo.1.1_2.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.x86_64"
        },
        "product_reference": "net-tools-2.10-slfo.1.1_2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.aarch64",
          "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.ppc64le",
          "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.s390x",
          "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:net-tools-2.10-slfo.1.1_2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-16T06:28:45Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\n- Fixed stack buffer overflow in parse_hex, proc_gen_fmt, ax25 and netrom (bsc#1248687)\n- Fixed stack overflow in ax25 and netrom (bsc#1248687)\n- CVE-2025-46836: Fixed stack buffer overflow caused by the absence of bound checks (bsc#1243581)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-478",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20825-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20825-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520825-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20825-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-October/042160.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248410",
        "url": "https://bugzilla.suse.com/1248410"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248687",
        "url": "https://bugzilla.suse.com/1248687"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 142461",
        "url": "https://bugzilla.suse.com/142461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 544339",
        "url": "https://bugzilla.suse.com/544339"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2025-09-26T09:29:17Z",
      "generator": {
        "date": "2025-09-26T09:29:17Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20825-1",
      "initial_release_date": "2025-09-26T09:29:17Z",
      "revision_history": [
        {
          "date": "2025-09-26T09:29:17Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-4.1.aarch64",
                "product": {
                  "name": "net-tools-2.10-4.1.aarch64",
                  "product_id": "net-tools-2.10-4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-4.1.s390x",
                "product": {
                  "name": "net-tools-2.10-4.1.s390x",
                  "product_id": "net-tools-2.10-4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-4.1.x86_64",
                "product": {
                  "name": "net-tools-2.10-4.1.x86_64",
                  "product_id": "net-tools-2.10-4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-4.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:net-tools-2.10-4.1.aarch64"
        },
        "product_reference": "net-tools-2.10-4.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-4.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:net-tools-2.10-4.1.s390x"
        },
        "product_reference": "net-tools-2.10-4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-4.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:net-tools-2.10-4.1.x86_64"
        },
        "product_reference": "net-tools-2.10-4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:net-tools-2.10-4.1.aarch64",
          "SUSE Linux Micro 6.0:net-tools-2.10-4.1.s390x",
          "SUSE Linux Micro 6.0:net-tools-2.10-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:net-tools-2.10-4.1.aarch64",
            "SUSE Linux Micro 6.0:net-tools-2.10-4.1.s390x",
            "SUSE Linux Micro 6.0:net-tools-2.10-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:net-tools-2.10-4.1.aarch64",
            "SUSE Linux Micro 6.0:net-tools-2.10-4.1.s390x",
            "SUSE Linux Micro 6.0:net-tools-2.10-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-26T09:29:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\n- Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58).\n- Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59).\n- Avoid unsafe memcpy in ifconfig (bsc#1248687).\n- Prevent overflow in ax25 and netrom (bsc#1248687)\n- Keep possibility to enter long interface names, even if they are\n  not accepted by the kernel, because it was always possible up to\n  CVE-2025-46836 fix. But issue a warning about an interface name\n  concatenation (bsc#1248410).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-454",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20940-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20940-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620940-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20940-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045212.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248410",
        "url": "https://bugzilla.suse.com/1248410"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248687",
        "url": "https://bugzilla.suse.com/1248687"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 142461",
        "url": "https://bugzilla.suse.com/142461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 430864",
        "url": "https://bugzilla.suse.com/430864"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 544339",
        "url": "https://bugzilla.suse.com/544339"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2026-03-26T15:12:29Z",
      "generator": {
        "date": "2026-03-26T15:12:29Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20940-1",
      "initial_release_date": "2026-03-26T15:12:29Z",
      "revision_history": [
        {
          "date": "2026-03-26T15:12:29Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.aarch64",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.aarch64",
                  "product_id": "net-tools-2.10-160000.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-lang-2.10-160000.3.1.noarch",
                "product": {
                  "name": "net-tools-lang-2.10-160000.3.1.noarch",
                  "product_id": "net-tools-lang-2.10-160000.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.ppc64le",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.ppc64le",
                  "product_id": "net-tools-2.10-160000.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.s390x",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.s390x",
                  "product_id": "net-tools-2.10-160000.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.x86_64",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.x86_64",
                  "product_id": "net-tools-2.10-160000.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.aarch64"
        },
        "product_reference": "net-tools-2.10-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.ppc64le"
        },
        "product_reference": "net-tools-2.10-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.s390x"
        },
        "product_reference": "net-tools-2.10-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.x86_64"
        },
        "product_reference": "net-tools-2.10-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-lang-2.10-160000.3.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:net-tools-lang-2.10-160000.3.1.noarch"
        },
        "product_reference": "net-tools-lang-2.10-160000.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.aarch64"
        },
        "product_reference": "net-tools-2.10-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.ppc64le"
        },
        "product_reference": "net-tools-2.10-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.s390x"
        },
        "product_reference": "net-tools-2.10-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.x86_64"
        },
        "product_reference": "net-tools-2.10-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-lang-2.10-160000.3.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-lang-2.10-160000.3.1.noarch"
        },
        "product_reference": "net-tools-lang-2.10-160000.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.s390x",
          "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:net-tools-lang-2.10-160000.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-lang-2.10-160000.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:net-tools-lang-2.10-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-lang-2.10-160000.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.s390x",
            "SUSE Linux Enterprise Server 16.0:net-tools-2.10-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:net-tools-lang-2.10-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-2.10-160000.3.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:net-tools-lang-2.10-160000.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-26T15:12:29Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for net-tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for net-tools fixes the following issues:\n\n- Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58).\n- Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59).\n- Avoid unsafe memcpy in ifconfig (bsc#1248687).\n- Prevent overflow in ax25 and netrom (bsc#1248687)\n- Keep possibility to enter long interface names, even if they are\n  not accepted by the kernel, because it was always possible up to\n  CVE-2025-46836 fix. But issue a warning about an interface name\n  concatenation (bsc#1248410).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-454",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20948-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20948-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620948-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20948-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045254.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243581",
        "url": "https://bugzilla.suse.com/1243581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248410",
        "url": "https://bugzilla.suse.com/1248410"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248687",
        "url": "https://bugzilla.suse.com/1248687"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 142461",
        "url": "https://bugzilla.suse.com/142461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 430864",
        "url": "https://bugzilla.suse.com/430864"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 544339",
        "url": "https://bugzilla.suse.com/544339"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46836 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46836/"
      }
    ],
    "title": "Security update for net-tools",
    "tracking": {
      "current_release_date": "2026-03-26T15:12:29Z",
      "generator": {
        "date": "2026-03-26T15:12:29Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20948-1",
      "initial_release_date": "2026-03-26T15:12:29Z",
      "revision_history": [
        {
          "date": "2026-03-26T15:12:29Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.aarch64",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.aarch64",
                  "product_id": "net-tools-2.10-160000.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.ppc64le",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.ppc64le",
                  "product_id": "net-tools-2.10-160000.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.s390x",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.s390x",
                  "product_id": "net-tools-2.10-160000.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "net-tools-2.10-160000.3.1.x86_64",
                "product": {
                  "name": "net-tools-2.10-160000.3.1.x86_64",
                  "product_id": "net-tools-2.10-160000.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.aarch64"
        },
        "product_reference": "net-tools-2.10-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.ppc64le"
        },
        "product_reference": "net-tools-2.10-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.s390x"
        },
        "product_reference": "net-tools-2.10-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "net-tools-2.10-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.x86_64"
        },
        "product_reference": "net-tools-2.10-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-46836",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46836"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.aarch64",
          "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.ppc64le",
          "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.s390x",
          "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46836",
          "url": "https://www.suse.com/security/cve/CVE-2025-46836"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243581 for CVE-2025-46836",
          "url": "https://bugzilla.suse.com/1243581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:net-tools-2.10-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-26T15:12:29Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46836"
    }
  ]
}