CVE-2015-6496
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules...
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
Exploit likelihood
What each source reports
NVD Score used
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
- Record
CVE-2015-6496- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-17
- Updated
- 2026-11-02
CVE List No score
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
- Record
CVE-2015-6496- Updated
- 2026-11-02
EUVDEUVD-2015-6437 No score
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
- Record
EUVD-2015-6437- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3f5-57x9-2pvx No score
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules...
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.
- Record
GHSA-v3f5-57x9-2pvx- Updated
- 2026-11-02
OSVMGASA-2015-0363 No score
Updated conntrack-tools packages fix CVE-2015-6496
Updated conntrack-tools packages fix security vulnerability:
It was discovered that in certain configurations, if the relevant conntrack kernel module is not loaded, conntrackd will crash when handling DCCP, SCTP or ICMPv6 packets (CVE-2015-6496).
- Record
MGASA-2015-0363- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10430-1 No score
conntrack-tools-1.4.4-1.3 on GA media
These are all security issues fixed in the conntrack-tools-1.4.4-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10430-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1545-1 No score
Security update for conntrack-tools
Fix a possible crash if conntrackd sees DCCP, SCTP and ICMPv6 traffic and the corresponding kernel modules that track this traffic are not available. (bsc#942149, CVE-2015-6496)
- Record
SUSE-SU-2015:1545-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1683-1 No score
Security update for conntrack-tools
Fix a possible crash if conntrackd sees DCCP, SCTP and ICMPv6 traffic and the corresponding kernel modules that track this traffic are not available. (bsc#942149, CVE-2015-6496)
- Record
SUSE-SU-2015:1683-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
conntrackDebian:6.0 |
before 1:0.9.14-2+deb6u1, plus listed versions 1:0.9.14-2 |
1:0.9.14-2+deb6u1 |
conntrackDebian:7 |
before 1:1.2.1-1+deb7u1, plus listed versions 1:1.2.1-1 |
1:1.2.1-1+deb7u1 |
conntrackDebian:8 |
before 1:1.4.2-2+deb8u1, plus listed versions 1:1.4.2-2 |
1:1.4.2-2+deb8u1 |
conntrack-toolsMageia:4 |
before 1.4.2-2.1.mga4 | 1.4.2-2.1.mga4 |
conntrack-toolsMageia:5 |
before 1.4.2-6.1.mga5 | 1.4.2-6.1.mga5 |
conntrack-toolsSUSE:Linux Enterprise High Availability Extension 12 |
before 1.4.2-5.2 | 1.4.2-5.2 |
libnetfilter_cthelperSUSE:Linux Enterprise High Availability Extension 12 |
before 1.0.0-7.1 | 1.0.0-7.1 |
libnetfilter_cttimeoutSUSE:Linux Enterprise High Availability Extension 12 |
before 1.0.0-9.1 | 1.0.0-9.1 |
libnetfilter_cthelperSUSE:Linux Enterprise Software Development Kit 12 |
before 1.0.0-7.1 | 1.0.0-7.1 |
libnetfilter_cttimeoutSUSE:Linux Enterprise Software Development Kit 12 |
before 1.0.0-9.1 | 1.0.0-9.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
conntrack-toolsSUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5 |
before 1.4.2-5.2 | 1.4.2-5.2 |
libnetfilter_cthelperSUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5 |
before 1.0.0-7.1 | 1.0.0-7.1 |
libnetfilter_cttimeoutSUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5 |
before 1.0.0-9.1 | 1.0.0-9.1 |
conntrack-toolsSUSE:Linux Enterprise High Availability Extension 11 SP3 |
before 1.0.0-0.9.1 | 1.0.0-0.9.1 |
conntrack-toolsSUSE:Linux Enterprise High Availability Extension 11 SP4 |
before 1.0.0-0.9.1 | 1.0.0-0.9.1 |
conntrack-toolsopenSUSE:Tumbleweed |
before 1.4.4-1.3 | 1.4.4-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6496 is a medium vulnerability (CVSS 5.0) in Netfilter Conntrack-tools, published August 19, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.20%, the 88th percentile. Fixed in conntrack 1:0.9.14-2+deb6u1.
References
lists.fedoraproject.org/pipermail/package-announce/2016-January/174875.html
openwall.com/lists/oss-security/2015/08/18/1
git.netfilter.org/conntrack-tools/commit?id=c392c159605956c7bd4a264ab4490e2b2704c0cd
lists.opensuse.org/opensuse-updates/2015-10/msg00015.html
Show 11 moreShow less
bugzilla.netfilter.org/show_bug.cgi?id=910
debian.org/security/2015/dsa-3341
nvd.nist.gov/vuln/detail/CVE-2015-6496
github.com/advisories/GHSA-v3f5-57x9-2pvx
advisories.mageia.org/MGASA-2015-0363.html
bugs.mageia.org/show_bug.cgi?id=16588
suse.com/support/update/announcement/2015/suse-su-20151545-1
bugzilla.suse.com/942149