Wicked
Monthly
Out-of-bounds heap read in the DHCPv4 packet capture code of wicked (all versions through 0.6.80) allows an unauthenticated attacker on the same Layer-2 network segment to send a crafted DHCP/UDP packet that causes wickedd-dhcp4 to read up to 68 bytes past the end of its 1500-byte receive buffer. Adjacent heap contents - including allocator metadata and pointer values - may be parsed as DHCP options and stored into lease fields, constituting limited information disclosure with a secondary low-integrity configuration impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; an upstream fix exists in GitHub PR #1079, though a tagged release version has not been independently confirmed.
Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthenticated adjacent-network attacker to crash the daemon by sending a malformed DHCPv4 packet with an IP total length field smaller than the IP header length. The missing bounds check in ni_capture_inspect_udp_header() triggers an out-of-bounds read, causing a process crash depending on memory layout - resulting in a denial of service to network configuration. No information disclosure has been demonstrated, and no public exploit or CISA KEV listing exists at time of analysis.
Command injection in openSUSE/SUSE wicked DHCP client before 0.6.79 allows attackers operating a rogue DHCP server on the victim's local network segment to execute arbitrary commands by embedding single-quoted shell metacharacters in DHCP option strings, which are written unsanitized to /run/wicked/leaseinfo.* files and later consumed by netconfig. The CVSS 8.8 (AV:A) rating reflects adjacent-network exposure without authentication. No public exploit identified at time of analysis.
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Out-of-bounds heap read in the DHCPv4 packet capture code of wicked (all versions through 0.6.80) allows an unauthenticated attacker on the same Layer-2 network segment to send a crafted DHCP/UDP packet that causes wickedd-dhcp4 to read up to 68 bytes past the end of its 1500-byte receive buffer. Adjacent heap contents - including allocator metadata and pointer values - may be parsed as DHCP options and stored into lease fields, constituting limited information disclosure with a secondary low-integrity configuration impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; an upstream fix exists in GitHub PR #1079, though a tagged release version has not been independently confirmed.
Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthenticated adjacent-network attacker to crash the daemon by sending a malformed DHCPv4 packet with an IP total length field smaller than the IP header length. The missing bounds check in ni_capture_inspect_udp_header() triggers an out-of-bounds read, causing a process crash depending on memory layout - resulting in a denial of service to network configuration. No information disclosure has been demonstrated, and no public exploit or CISA KEV listing exists at time of analysis.
Command injection in openSUSE/SUSE wicked DHCP client before 0.6.79 allows attackers operating a rogue DHCP server on the victim's local network segment to execute arbitrary commands by embedding single-quoted shell metacharacters in DHCP option strings, which are written unsanitized to /run/wicked/leaseinfo.* files and later consumed by netconfig. The CVSS 8.8 (AV:A) rating reflects adjacent-network exposure without authentication. No public exploit identified at time of analysis.
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a message type option. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.