OPENSUSE-SU-2026:21692-1

Vulnerability from csaf_opensuse - Published: 2026-08-30 14:33 - Updated: 2026-08-30 14:33
Summary
Security update for dhcpcd
Severity
Moderate
Notes
Title of the patch: Security update for dhcpcd
Description of the patch: This update for dhcpcd fixes the following issues: Update to 10.5.0. Security issues fixed: - CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980). - CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976). - CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a memory leak (bsc#1268974). - CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free (bsc#1268968). Changes for dhcpcd: - 10.5.0: * Add missing SPDX-License tags * Format code with clang-format v19 * privsep: Change IPC to use SOCK_STREAM * BPF: Split OS specific code out into own files and add libpcap support * hooks: Escape interface names and use printf * Delete DHCPv6 IA FD from the loop before closing it * eloop: Use kqueue or epoll to wait for a fd to become ready * Darwin: Add initial support for macOS * Import latest pidfile from NetBSD * BPF: Improve headers * compat: Add support for getprogname(3) * route: Rework rt structure so sockaddrs are pointers * dhcp-common: Escape ifname for lease file * privsep: smaller buffer size without INET6 * script: add ifxname as the escaped string * time.h always pulls in struct timespec * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define * privsep: Test defines for all ioctls * if: if_init inits the interface from the kernel * privsep: Add ps_root_gethostname * DHCP: Don't really expire the lease when testing * DHCP: Don't add a trailing : on vendor if no machine arch * privsep: guard setproctitle and only use compat on linux * options: Remove some const to fix compile warnings * privsep: Don't open PF_INET socket for each ioctl * sun: Enable building for privsep * script: Use correct buffer length variable * privsep: Remove PS_BUFLEN * privsep: Simplify readerror * timezone: disallow directory traversal * privsep: ps_root_readfile should return the real file size * linux: Ensure NLA data boundaries are valid * options: Fix userclass boundary * ND6: fix OOB reject mask for an undefined option. * DHCP6: Ensure IA_PD Prefix Lenth is valid * ND: Enforce require and reject policy * ARP: check we have enough to read the frame header * hooks: Quote assignment of compat vars correctly * udev: Ensure we have a subsystem, action and ifname * Fix CI build * DHCP: Santize messages from servers for output * ARP: Iterate over states safely as the cb could remove ours * privsep: Check data is terminated when a string * auth: clear keys with memset_explicit * auth: Ensure remaining dlen matches hash digest length * hooks: don't read past truncated ip6 address starting fe * ipv6: Only regen temp addrs with sufficent pltime * eloop: Improve timespecdiff * eloop: Fix compile warning where UTIME_MAX is a calculation * vsio: Allow zero length options * DHCP6: Fix configuring the suffix to delegated prefixes * IPv6: Fix numerous issues extending temporary address times * capsicum: Avoid some overflow issues in privsep sysctl * script: Fix buffer over and under flows in script_buftoenv * IPv4: uset old_ia when adding an address causes early removal * dhcp: add configurable backoff parameters for DHCPv4 * options: Introdce policy groups * Build all the targets on macos * control: remove unprivileged socket * DHCP: deconfigure even when state is NULL or NONE
Patchnames: openSUSE-Leap-16.0-1548
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-56113
5.3 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-56115
5.9 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-56116
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-56117
5.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for dhcpcd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don\u0027t really expire the lease when testing\n  * DHCP: Don\u0027t add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don\u0027t open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don\u0027t read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1548",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21692-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268968",
        "url": "https://bugzilla.suse.com/1268968"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268974",
        "url": "https://bugzilla.suse.com/1268974"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268976",
        "url": "https://bugzilla.suse.com/1268976"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268980",
        "url": "https://bugzilla.suse.com/1268980"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56113 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56113/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56115 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56115/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56116 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56116/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56117 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56117/"
      }
    ],
    "title": "Security update for dhcpcd",
    "tracking": {
      "current_release_date": "2026-08-30T14:33:19Z",
      "generator": {
        "date": "2026-08-30T14:33:19Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21692-1",
      "initial_release_date": "2026-08-30T14:33:19Z",
      "revision_history": [
        {
          "date": "2026-08-30T14:33:19Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-160000.1.1.aarch64",
                "product": {
                  "name": "dhcpcd-10.5.0-160000.1.1.aarch64",
                  "product_id": "dhcpcd-10.5.0-160000.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-160000.1.1.ppc64le",
                "product": {
                  "name": "dhcpcd-10.5.0-160000.1.1.ppc64le",
                  "product_id": "dhcpcd-10.5.0-160000.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-160000.1.1.s390x",
                "product": {
                  "name": "dhcpcd-10.5.0-160000.1.1.s390x",
                  "product_id": "dhcpcd-10.5.0-160000.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-160000.1.1.x86_64",
                "product": {
                  "name": "dhcpcd-10.5.0-160000.1.1.x86_64",
                  "product_id": "dhcpcd-10.5.0-160000.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64"
        },
        "product_reference": "dhcpcd-10.5.0-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le"
        },
        "product_reference": "dhcpcd-10.5.0-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x"
        },
        "product_reference": "dhcpcd-10.5.0-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
        },
        "product_reference": "dhcpcd-10.5.0-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56113",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56113"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56113",
          "url": "https://www.suse.com/security/cve/CVE-2026-56113"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268980 for CVE-2026-56113",
          "url": "https://bugzilla.suse.com/1268980"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56113"
    },
    {
      "cve": "CVE-2026-56115",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56115"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56115",
          "url": "https://www.suse.com/security/cve/CVE-2026-56115"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268976 for CVE-2026-56115",
          "url": "https://bugzilla.suse.com/1268976"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56115"
    },
    {
      "cve": "CVE-2026-56116",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56116"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56116",
          "url": "https://www.suse.com/security/cve/CVE-2026-56116"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268974 for CVE-2026-56116",
          "url": "https://bugzilla.suse.com/1268974"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56116"
    },
    {
      "cve": "CVE-2026-56117",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56117"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56117",
          "url": "https://www.suse.com/security/cve/CVE-2026-56117"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268968 for CVE-2026-56117",
          "url": "https://bugzilla.suse.com/1268968"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:dhcpcd-10.5.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-30T14:33:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56117"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.