Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

SUSE: 2025:01888-1 moderate: nbdkit denial of service issues

suse
Calendar Grey June 11, 2025
Dist Suse Esm H88
A recently released nbdkit update addresses two critical denial-of-service vulnerabilities affecting SUSE systems; essential patch information provided.
* bsc#1243108 * bsc#1243110 Cross-References: * CVE-2025-47711

Summary

## This update for nbdkit fixes the following issues: Update to version 1.40.6. Security fixes: * CVE-2025-47712: integer overflow in blocksize filter when processing client block status requests larger than 2**32 will trigger an assertion failure and cause a denial-of-service. (bsc#1243108). * CVE-2025-47711: off-by-one error when processing block status results from plugins on behalf of an NBD client may trigger an assertion failure and cause a denial of service (bsc#1243110). Other fixes and changes: * golang: Support GCC 15. * openbsd: curl: Include pthread.h. * rust: Fix "overindented" list in comment. * rust: Declare explicit extern "C" API. * plugins/rust: Use CStr literals for static strings. * vddk: do_extents: Avoid reading partial chunk beyond the end of the disk.

Topics%20covered

Topics Covered

security advisory moderate denial of service security update SUSE nbdkit

References

* bsc#1243108

* bsc#1243110

Cross-

* CVE-2025-47711

* CVE-2025-47712

CVSS scores:

* CVE-2025-47711 ( SUSE ): 7.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2025-47711 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2025-47711 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

* CVE-2025-47712 ( SUSE ): 5.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2025-47712 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2025-47712 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected Products:

* Server Applications Module 15-SP7

* SUSE Linux Enterprise Real Time 15 SP7

* SUSE Linux Enterprise Server 15 SP7

* SUSE Linux Enterprise Server for SAP Applications 15 SP7

Announcement ID: SUSE-SU-2025:01888-1
Release Date: 2025-06-11T05:43:28Z
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate denial of service security update SUSE nbdkit

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here