CVE-2012-2663
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn...
CVE-2012-2663 is a high vulnerability (CVSS 7.5) in Netfilter Iptables, published February 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.74%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iptablesDebian:12 | All versions, plus listed versions 1.8.10-11.8.10-21.8.10-31.8.10-41.8.11-1 Show 7 moreShow less1.8.11-21.8.11-31.8.11-41.8.12-11.8.12-21.8.13-11.8.9-2 | None known |
iptablesDebian:13 | All versions, plus listed versions 1.8.11-21.8.11-31.8.11-41.8.12-11.8.12-21.8.13-1 | None known |
iptablesDebian:14 | All versions, plus listed versions 1.8.11-21.8.11-31.8.11-41.8.12-11.8.12-21.8.13-1 | None known |
iptablesUbuntu:14.04:LTS | All versions, plus listed versions 1.4.18-1.1ubuntu11.4.20-21.4.20-2ubuntu11.4.21-1ubuntu1 | None known |
iptablesUbuntu:16.04:LTS | All versions, plus listed versions 1.4.21-2ubuntu21.6.0-2ubuntu3 | None known |
iptablesUbuntu:18.04:LTS | All versions, plus listed versions 1.6.1-2ubuntu11.6.1-2ubuntu21.6.1-2ubuntu2.1 | None known |
iptablesUbuntu:20.04:LTS | All versions, plus listed versions 1.8.3-2ubuntu51.8.4-3ubuntu11.8.4-3ubuntu21.8.4-3ubuntu2.1 | None known |
What each source reports
NVD Score used
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
- Record
CVE-2012-2663- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
- Record
CVE-2012-2663- Updated
- 2026-11-02
EUVDEUVD-2012-2646No score
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
- Record
EUVD-2012-2646- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g725-p8m6-82j4No score
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn...
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
- Record
GHSA-g725-p8m6-82j4- Updated
- 2026-11-02
OSVBELL-CVE-2012-2663
CVE-2012-2663 does not affect BellSoft software
- Record
BELL-CVE-2012-2663- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVNo score
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
- Record
CVE-2012-2663- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2663No score
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
- Record
DEBIAN-CVE-2012-2663- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-2663No score
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
- Record
UBUNTU-CVE-2012-2663- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
spinics.net/lists/netfilter-devel/msg21248.html
bugzilla.redhat.com/show_bug.cgi?id=826702
nvd.nist.gov/vuln/detail/CVE-2012-2663
github.com/advisories/GHSA-g725-p8m6-82j4
docs.bell-sw.com/security/cves/CVE-2012-2663
security-tracker.debian.org/tracker/CVE-2012-2663
ubuntu.com/security/CVE-2012-2663
openwall.com/lists/oss-security/2012/05/30/2
cve.org/CVERecord?id=CVE-2012-2663