CVE-2025-9615

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.

Security Fix(es):

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.(CVE-2025-9615)

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

Security Fix(es):

• networkmanagr: NetworkManager File Access (CVE-2025-9615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

Security Fix(es):

• networkmanagr: NetworkManager File Access (CVE-2025-9615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

Security Fix(es):

• networkmanagr: NetworkManager File Access (CVE-2025-9615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

Security Fix(es):

• networkmanagr: NetworkManager File Access (CVE-2025-9615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

These are all security issues fixed in the strongswan-6.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the NetworkManager-applet-l2tp-1.52.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the NetworkManager-applet-strongswan-1.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the NetworkManager-applet-openvpn-1.12.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for strongswan fixes the following issues:

Update to strongswan 6.0.4:

• CVE-2025-9615: NetworkManager File Access (bsc#1257359).
• CVE-2026-25075: Integer Underflow When Handling EAP-TTLS AVP (bsc#1259472).

Changes for strongswan:

• Fixed a vulnerability in the NetworkManager plugin that potentially allows using credentials of other local users. This vulnerability has been registered as CVE-2025-9615.
• The maximum supported length for section names in swanctl.conf has been increased to the upper limit of 256 characters that's enforced by VICI.
• Prevent a crash if a confused peer rekeys a Child SA twice before sending a delete.
• Fixed a memory leak if a peer's self-signed certificate is untrusted.

This update for NetworkManager fixes the following issues:

Security fixes:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

Other fixes:

• Accept localhost hostnames if static (bsc#1257366)

This update for NetworkManager fixes the following issues:

• CVE-2025-9615: non-admin users are allowed to use certificates from other users (bsc#1257359).

This update for NetworkManager fixes the following issues:

• CVE-2025-9615: non-admin users are allowed to use certificates from other users (bsc#1257359).

This update for NetworkManager fixes the following issue:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

This update for NetworkManager fixes the following issue:

Security fixes:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

Other fixes:

• Don't renew DHCP lease when software devices' MAC is empty (bsc#1225498).

This update for NetworkManager fixes the following issue:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

This update for NetworkManager fixes the following issues:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

This update for NetworkManager fixes the following issues:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

This update for strongswan fixes the following issues:

Update to strongswan 6.0.4:

• CVE-2025-9615: NetworkManager File Access (bsc#1257359).
• CVE-2026-25075: Integer Underflow When Handling EAP-TTLS AVP (bsc#1259472).

Changes for strongswan:

• Fixed a vulnerability in the NetworkManager plugin that potentially allows using credentials of other local users. This vulnerability has been registered as CVE-2025-9615.
• The maximum supported length for section names in swanctl.conf has been increased to the upper limit of 256 characters that's enforced by VICI.
• Prevent a crash if a confused peer rekeys a Child SA twice before sending a delete.
• Fixed a memory leak if a peer's self-signed certificate is untrusted.

This update for NetworkManager fixes the following issues:

Security fixes:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

Other fixes:

• Accept localhost hostnames if static (bsc#1257366)

This update for NetworkManager fixes the following issues:

Security fixes:

• CVE-2025-9615: Fixed non-admin user using others' certificates (bsc#1257359).

Other fixes:

• Accept localhost hostnames if static (bsc#1257366)

This update for NetworkManager fixes the following issues:

• CVE-2025-9615: avoid non-admin user using other users' certificate (bsc#1257359).
• CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).