IPFire ships its 200th core update with a new domain blocklist and kernel upgrade
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-15467 | Stack Buffer Overflow in OpenSSL 3.x CMS AEAD Parsing Enables DoS/RCE OpenSSL 3.0, 3.3, 3.4, 3.5 and 3.6 contain a stack-based out-of-bounds write (CWE-787/CWE-120) in their CMS parser: when decoding CMS AuthEnvelopedData or EnvelopedData parameters for AEAD ciphers such as AES-GCM, the ASN.1-encoded IV is copied into a fixed-size stack buffer without checking its length. An attacker triggers it by sending a crafted CMS/PKCS#7 message (e.g., an S/MIME enveloped message) with an oversized IV to any application that parses it; the overflow occurs before authentication or tag verification, so no valid key material is required, though the target must process attacker-supplied content (CVSS UI:R). Successful exploitation causes a crash (denial of service) and, depending on platform and toolchain mitigations, potentially remote code execution. Only applications and services parsing untrusted CMS content with the listed OpenSSL 3.x series are affected; OpenSSL 1.1.1, 1.0.2 and the FIPS modules in 3.0/3.3/3.4/3.5/3.6 are not affected, since the CMS implementation lies outside the FIPS module boundary. There is no confirmed in-the-wild exploitation or KEV listing yet, but a public proof-of-concept exists and EPSS assigns a 48.2% (99th-percentile) probability of exploitation within 30 days. Do: Upgrade all OpenSSL 3.0/3.3/3.4/3.5/3.6 deployments to the patched releases referenced in the OpenSSL security advisory, and rebuild or update products, distributions and appliances that bundle affected 3.x libraries. Until patched, mitigate by avoiding or restricting parsing of untrusted CMS/PKCS#7 (Auth)EnvelopedData with AEAD ciphers (e.g., disable or filter S/MIME enveloped-mail processing for external senders) and inventory which services accept CMS content. Note that FIPS-module-only deployments are unaffected because CMS parsing is outside the module boundary. | 8.8 group max | 48% | PoC |
| masstens of millions of installations run OpenSSL 3.x, though practical exposure is limited to applications parsing untrusted CMS/AEAD content | |
| CVE-2025-15281 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. NVD description · AI analysis pending | 7.5 | <1% |
| — | ||
| CVE-2026-0861 | Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments. NVD description · AI analysis pending | 8.4 | <1% | PoC |
| — | |
| CVE-2026-0915 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued netwo Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver. NVD description · AI analysis pending | 7.5 | <1% |
| — |
Full article529 words · extracted from helpnetsecurity.com · click to collapse
Network firewall distribution IPFire released Core Update 200, marking the 200th incremental update to the 2.29 branch. The release bundles a kernel upgrade, a beta domain blocklist service, security patches for OpenSSL and glibc, and a range of component updates.
The kernel has been rebased on Linux 6.18.7 LTS, bringing updated hardware security mitigations alongside network throughput and latency improvements. Linux developers deprecated ReiserFS support in this kernel line, and IPFire installations running on that filesystem cannot apply the update without first reinstalling on a supported filesystem.
IPFire DBL enters beta
The release introduces IPFire DBL, a domain blocklist the project is building to replace the retired Shalla list, which the web proxy previously relied on to filter malware, social networking, and adult content. DBL is available in two places: the URL filter for proxy-based blocking, and as a Suricata rules source. When used with Suricata, the blocklist enables deep packet inspection across DNS, TLS, HTTP, and QUIC connections.
The project describes DBL as an early beta and is soliciting community feedback. A DNS Firewall with native content filtering is listed on the roadmap as the next major milestone.
Suricata and IPS changes
A cache management fix addresses a bug introduced in the previous update, where Suricata’s pre-compiled signature cache grew without limit and consumed disk space. A backported patch now causes Suricata to clean up unused signatures automatically.
The Suricata reporter has been updated to surface hostname information and additional protocol metadata for alerts involving DNS, HTTP, TLS, and QUIC connections. That data will appear in alert emails and PDF reports, giving administrators more context when investigating policy violations.
OpenVPN configuration updates
Several OpenVPN client configuration behaviors have changed. MTU values will now be pushed from the server rather than baked into client configs, giving administrators flexibility to adjust the value after deployment. The OTP authentication token will also be pushed server-side when OTP is enabled. The CA certificate has been removed from client configuration files because it is already contained in the PKCS12 container; its presence was causing import failures in NetworkManager on the command line.
DNS proxy goes multi-threaded
Unbound, the DNS proxy component, will now launch one thread per CPU core. Previously it ran on a single thread. The change is expected to reduce response times under load.
Wireless access point fixes
Support for 802.11a/g has been restored after being dropped unintentionally in a prior release. A separate fix prevents hostapd from flooding logs with debug output when debugging is enabled. PSK values containing special characters are now accepted.
Security patches
OpenSSL has been updated to version 3.6.1, patching twelve CVEs: CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, and CVE-2026-22796. The glibc library received patches for CVE-2026-0861, CVE-2026-0915, and CVE-2025-15281.
Package updates
Notable component versions in this release include Apache 2.4.66, BIND 9.20.18, cURL 8.18.0, OpenVPN 2.6.17, strongSwan 6.0.4, Suricata 8.0.3, Unbound 1.24.2, ClamAV 1.5.1, Samba 4.23.4, and Tor 0.4.8.21.
Must read:
- 40 open-source tools redefining how security teams secure the stack
- Firmware scanning time, cost, and where teams run EMBA
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/03/02/pfire-2-29-core-update-200-released/