CVE-2025-68276

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. This enables you to plug your laptop or computer into a network and instantly be able to view other people who you can chat with, find printers to print to or find files being shared.

Security Fix(es):

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.(CVE-2025-68276)

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.(CVE-2025-68468)

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.(CVE-2025-68471)

Root has patched CVE-2025-68276 in the avahi package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-68276 in the avahi package for Root:Debian:13. Multiple fixed versions available.

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

• CVE-2025-68276: refuse to create wide-area record browsers when wide-area lookups are disabled; an unprivileged local user could crash avahi-daemon over D-Bus by passing AVAHI_LOOKUP_USE_WIDE_AREA to RecordBrowserNew, reaching an assertion in avahi_wide_area_scan_cache
• CVE-2026-34933: reject publish flags that set both AVAHI_PUBLISH_USE_WIDE_AREA and AVAHI_PUBLISH_USE_MULTICAST; the conflicting pair tripped an assertion in transport_flags_from_domain and crashed avahi-daemon from any unprivileged local D-Bus caller

• CVE-2025-68468: fix remote denial of service via crafted mDNS CNAME announcements (assertion failure in lookup_multicast_callback)
• CVE-2025-68471: fix remote denial of service via unsolicited CNAME announcements (assertion failure in lookup_start)
• CVE-2025-68276: fix local denial of service via D-Bus record browsers using AVAHI_LOOKUP_USE_WIDE_AREA when wide-area is disabled
• CVE-2026-34933: fix local denial of service via D-Bus publish flags setting both AVAHI_PUBLISH_USE_WIDE_AREA and AVAHI_PUBLISH_USE_MULTICAST

• CVE-2026-34933: refuse publish flags with both AVAHI_PUBLISH_USE_WIDE_AREA and AVAHI_PUBLISH_USE_MULTICAST set
• CVE-2025-59529: limit local simple-protocol clients to prevent memory and file descriptor exhaustion
• CVE-2025-68276: refuse to create wide-area record browsers when wide-area is off

Avahi has a reachable assertion in avahi_wide_area_scan_cache. (CVE-2025-68276) Avahi has a reachable assertion in lookup_multicast_callback. (CVE-2025-68468) Avahi has a reachable assertion in lookup_start. (CVE-2025-68471)

These are all security issues fixed in the avahi-0.8-41.1 package on the GA media of openSUSE Tumbleweed.

This update for avahi fixes the following issues:

• CVE-2025-68276: Fixed refuse to create wide-area record browsers when wide-area is off (bsc#1256498)
• CVE-2025-68471: Fixed DoS bug by changing assert to return (bsc#1256500)
• CVE-2025-68468: Fixed DoS bug by removing incorrect assertion (bsc#1256499)

This update for avahi fixes the following issues:

• CVE-2025-68276: avahi: reachable assertion in avahi_wide_area_scan_cache can lead to crash of avahi-daemon (bsc#1256498).
• CVE-2025-68468: avahi: reachable assertion in lookup_multicast_callback can lead to crash of avahi-daemon (bsc#1256499).
• CVE-2025-68471: avahi: reachable assertion in lookup_start can lead to crash of avahi-daemon (bsc#1256500).

This update for avahi fixes the following issues:

• CVE-2025-68276: Fixed refuse to create wide-area record browsers when wide-area is off (bsc#1256498)
• CVE-2025-68471: Fixed DoS bug by changing assert to return (bsc#1256500)
• CVE-2025-68468: Fixed DoS bug by removing incorrect assertion (bsc#1256499)

This update for avahi fixes the following issues:

• CVE-2025-68276: avahi: reachable assertion in avahi_wide_area_scan_cache can lead to crash of avahi-daemon (bsc#1256498).
• CVE-2025-68468: avahi: reachable assertion in lookup_multicast_callback can lead to crash of avahi-daemon (bsc#1256499).
• CVE-2025-68471: avahi: reachable assertion in lookup_start can lead to crash of avahi-daemon (bsc#1256500).

This update for avahi fixes the following issues:

• CVE-2025-68276: Fixed refuse to create wide-area record browsers when wide-area is off (bsc#1256498)
• CVE-2025-68471: Fixed DoS bug by changing assert to return (bsc#1256500)
• CVE-2025-68468: Fixed DoS bug by removing incorrect assertion (bsc#1256499)

This update for avahi fixes the following issues:

• CVE-2025-68276: Fixed refuse to create wide-area record browsers when wide-area is off (bsc#1256498)
• CVE-2025-68471: Fixed DoS bug by changing assert to return (bsc#1256500)
• CVE-2025-68468: Fixed DoS bug by removing incorrect assertion (bsc#1256499)

This update for avahi fixes the following issues:

• CVE-2025-68276: Fixed refuse to create wide-area record browsers when wide-area is off (bsc#1256498)
• CVE-2025-68471: Fixed DoS bug by changing assert to return (bsc#1256500)
• CVE-2025-68468: Fixed DoS bug by removing incorrect assertion (bsc#1256499)

This update for avahi fixes the following issues:

• CVE-2024-52615: Resolve fixed source ports for wide-area DNS queries cause DNS responses be injected. (bsc#1233421)
• CVE-2025-68468: Fixed DoS bug by removing incorrect assertion. (bsc#1256499)
• CVE-2025-68471: Fixed DoS bug by changing assert to return. (bsc#1256500)
• CVE-2025-68276: Refuse to create wide-area record browsers when wide-area is off. (bsc#1256498)

This update for avahi fixes the following issues:

• CVE-2025-68276: reachable assertion in avahi_wide_area_scan_cache can lead to an avahi-daemon crash (bsc#1256498).
• CVE-2025-68468: reachable assertion in lookup_multicast_callback can lead to an avahi-daemon crash (bsc#1256499).
• CVE-2025-68471: reachable assertion in lookup_start can lead to an avahi-daemon crash (bsc#1256500).

It was discovered that Avahi incorrectly terminated when processing browser records with wide-area disabled. An attacker could possibly use this issue to cause Avahi to crash, resulting in a denial of service. (CVE-2025-68276)

It was discovered that Avahi incorrectly terminated when processing unsolicited CNAME records pointing to resource records with short TTLs. An attacker could possibly use this issue to cause Avahi to crash, resulting in a denial of service. (CVE-2025-68468)

It was discovered that Avahi incorrectly terminated when processing unsolicited CNAME records in quick succession. An attacker could possibly use this issue to cause Avahi to crash, resulting in a denial of service. (CVE-2025-68471)