critique
CVE-2025-54349
iperf3: iperf Heap Buffer Overflow
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Julia10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Julia, Photon OS. Plus basse selon Red Hat (moyenne), AlmaLinux (moyenne), Amazon (moyenne), Azure Linux (moyenne), CBL-Mariner (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (moyenne).
Description
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | iperf_jll | 3.21.0+0 |
| Photon OS 4.0 | iperf, iperf-doc | 3.19.1-1.ph4 |
| Photon OS 5.0 | iperf, iperf-doc | 3.17.1-4.ph5 |
| alma 8 | iperf3 | 3.5-12.el8_10 |
| alma 9 | iperf3 | 3.9-14.el9_7.1 |
| alpine 3.22 | iperf3 | 3.19.1-r0 |
| alpine 3.23 | iperf3 | 3.19.1-r0 |
| alpine 3.24 | iperf3 | 3.19.1-r0 |
| alpine edge | iperf3 | 3.19.1-r0 |
| amazon linux 2023 | iperf3, iperf3-debuginfo, iperf3-debugsource et 1 autres | 3.19.1-1.amzn2023 |
| Azure Linux 3.0 | iperf3 | 0:3.17.1-3.azl3 |
| CBL-Mariner 2.0 | iperf3 | 0:3.18-2.cm2 |
Afficher les 44 entrées de 38 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | iperf_jll | 3.21.0+0 |
| Photon OS 4.0 | iperf | 3.19.1-1.ph4 |
| Photon OS 4.0 | iperf-doc | 3.19.1-1.ph4 |
| Photon OS 5.0 | iperf | 3.17.1-4.ph5 |
| Photon OS 5.0 | iperf-doc | 3.17.1-4.ph5 |
| alma 8 | iperf3 | 3.5-12.el8_10 |
| alma 9 | iperf3 | 3.9-14.el9_7.1 |
| alpine 3.22 | iperf3 | 3.19.1-r0 |
| alpine 3.23 | iperf3 | 3.19.1-r0 |
| alpine 3.24 | iperf3 | 3.19.1-r0 |
| alpine edge | iperf3 | 3.19.1-r0 |
| amazon linux 2023 | iperf3 | 3.19.1-1.amzn2023 |
| amazon linux 2023 | iperf3-debuginfo | 3.19.1-1.amzn2023 |
| amazon linux 2023 | iperf3-debugsource | 3.19.1-1.amzn2023 |
| amazon linux 2023 | iperf3-devel | 3.19.1-1.amzn2023 |
| Azure Linux 3.0 | iperf3 | 0:3.17.1-3.azl3 |
| CBL-Mariner 2.0 | iperf3 | 0:3.18-2.cm2 |
| debian 11 | iperf3 | 3.9-1+deb11u3 |
| debian 12 | iperf3 | 3.12-1+deb12u2 |
| debian 13 | iperf3 | 3.18-2+deb13u1 |
| debian 14 | iperf3 | 3.19.1-1 |
| echo | iperf3 | 3.12-1+deb12u2 |
| Oracle Linux 8 | iperf3 | 3.5-12.el8_10 |
| Oracle Linux 9 | iperf3 | 3.9-14.el9_7.1 |
| rapidfort alpine 3.20 | iperf3 | 3.19.1-r0 |
| rapidfort alpine 3.21 | iperf3 | 3.19.1-r0 |
| rapidfort alpine 3.23 | iperf3 | 3.19.1-r0 |
| rapidfort alpine 3.24 | iperf3 | 3.19.1-r0 |
| rapidfort amazon linux 2023 | iperf3 | 3.19.1-1.amzn2023 |
| rapidfort amazon linux 2023 | iperf3-devel | 3.19.1-1.amzn2023 |
| rapidfort debian 12 | iperf3 | 0:3.12-1+deb12u2, 0:3.18-2+deb13u1, 0:3.19.1-1 |
| rapidfort debian 13 | iperf3 | 0:3.12-1+deb12u2, 0:3.18-2+deb13u1, 0:3.19.1-1 |
| rapidfort Oracle Linux 10 | iperf3 | 0:3.17.1-5.el10_1 |
| rapidfort Oracle Linux 9 | iperf3 | 0:3.9-14.el9_7.1 |
| rapidfort ubuntu 20.04 | iperf3 | 0:3.18-2ubuntu0.1, 0:3.9-1+deb11u1ubuntu0.1 |
| rapidfort ubuntu 22.04 | iperf3 | 0:3.18-2ubuntu0.1, 0:3.9-1+deb11u1ubuntu0.1 |
| rapidfort ubuntu 24.04 | iperf3 | 0:3.18-2ubuntu0.1, 0:3.9-1+deb11u1ubuntu0.1 |
| rocky 10 | iperf3 | 3.17.1-5.el10_1 |
| rocky 8 | iperf3 | 3.5-12.el8_10 |
| rocky 9 | iperf3 | 3.9-14.el9_7.1 |
| ubuntu 20.04-ESM | iperf3 | 3.7-3ubuntu0.1~esm2 |
| ubuntu 22.04 | iperf3 | 3.9-1+deb11u1ubuntu0.1 |
| ubuntu 24.04 | iperf3 | pas de correctif indiqué |
| ubuntu 25.10 | iperf3 | 3.18-2ubuntu0.1 |
Références
- https://access.redhat.com/errata/RHSA-2026:1595
- https://access.redhat.com/security/cve/CVE-2025-54349
- https://bugzilla.redhat.com/2386151
- https://bugzilla.redhat.com/show_bug.cgi?id=2386151
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54349
- https://errata.almalinux.org/9/ALSA-2026-1595.html
- https://errata.rockylinux.org/RLSA-2026:1595
Les 16 références
- https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
- https://github.com/esnet/iperf/releases/tag/3.19.1
- https://linux.oracle.com/cve/CVE-2025-54349.html
- https://linux.oracle.com/errata/ELSA-2026-1597.html
- https://lists.debian.org/debian-lts-announce/2025/08/msg00020.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-54349
- https://ubuntu.com/security/notices/USN-7970-1
- https://www.cve.org/CVERecord?id=CVE-2025-54349