https://bugzilla.suse.com/show_bug.cgi?id=1200189

https://lore.kernel.org/connman/20220801080043.4861-5-wagi@monom.org/

DSA-5231

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10134-1 advisory.

  - In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to     exploit a heap-based buffer overflow in received_data to execute code. (CVE-2022-32292)

  - In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a     use-after-free in WISPR handling, leading to crashes or code execution. (CVE-2022-32293)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5231 advisory.

  - An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation     lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.
    (CVE-2022-23096)

  - An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen     call, leading to an out-of-bounds read. (CVE-2022-23097)

  - An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has     an infinite loop if no data is received. (CVE-2022-23098)

  - In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to     exploit a heap-based buffer overflow in received_data to execute code. (CVE-2022-32292)

  - In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a     use-after-free in WISPR handling, leading to crashes or code execution. (CVE-2022-32293)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3105 advisory.

  - In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to     exploit a heap-based buffer overflow in received_data to execute code. (CVE-2022-32292)

  - In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a     use-after-free in WISPR handling, leading to crashes or code execution. (CVE-2022-32293)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10076-1 advisory.

  - In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to     exploit a heap-based buffer overflow in received_data to execute code. (CVE-2022-32292)

  - In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a     use-after-free in WISPR handling, leading to crashes or code execution. (CVE-2022-32293)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165611	openSUSE 15 Security Update : connman (openSUSE-SU-2022:10134-1)	Nessus	SuSE Local Security Checks	critical
165255	Debian DSA-5231-1 : connman - security update	Nessus	Debian Local Security Checks	critical
164963	Debian DLA-3105-1 : connman - LTS security update	Nessus	Debian Local Security Checks	critical
163757	openSUSE 15 Security Update : connman (openSUSE-SU-2022:10076-1)	Nessus	SuSE Local Security Checks	critical

CVE-2022-32292

critical

Tenable Plugins

critical

critical

critical

critical