{"id":"CVE-2026-85508","aliases":["ALSA-2026:89753","ALSA-2026:89754","ALSA-2026:89905","AZL-99104","BELL-CVE-2026-85508","DEBIAN-CVE-2026-85508","EUVD-2026-70886","GHSA-g7hg-9x6v-q9jm","OESA-2026-3900","OESA-2026-3901","OESA-2026-4065","RLSA-2026:89753","RLSA-2026:89754","RLSA-2026:89905","SUSE-SU-2026:23746-1","SUSE-SU-2026:4277-1","UBUNTU-CVE-2026-85508","USN-8843-1","openSUSE-SU-2026:11797-1","openSUSE-SU-2026:21883-1"],"status":"published","title":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in...","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00405,"percentile":0.34993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-09-04T04:20:19Z","modified":"2026-10-29T11:32:32Z","fixes":[{"ecosystem":"Azure Linux:3","package":"freeipmi","fixed_in":["1.6.19-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"freeipmi","fixed_in":["1.6.19-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"freeipmi","fixed_in":["1.6.19-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"freeipmi","fixed_in":["1.6.19-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freeipmi","fixed_in":["1.6.19-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"freeipmi","fixed_in":["1.1.5-3ubuntu3.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"freeipmi","fixed_in":["1.4.11-1.1ubuntu4.1~0.16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freeipmi","fixed_in":["1.4.11-1.1ubuntu4.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freeipmi","fixed_in":["1.6.4-3ubuntu1.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"freeipmi","fixed_in":["1.6.9-2ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freeipmi","fixed_in":["1.6.13-3ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"freeipmi","fixed_in":["1.6.16-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeipmi-bmc-watchdog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeipmi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeipmi-ipmidetectd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeipmi-ipmiseld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeipmi-bmc-watchdog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeipmi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeipmi-ipmidetectd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeipmi-ipmiseld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freeipmi-bmc-watchdog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freeipmi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freeipmi-ipmidetectd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"freeipmi-ipmiseld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:3","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-r0"},{"fixed":"1.6.19-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.15-r0"},{"fixed":"1.6.19-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-r0"},{"fixed":"1.6.19-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.10-1","1.6.10-2","1.6.11-1","1.6.11-2","1.6.13-1","1.6.13-2","1.6.13-2~bpo12+1","1.6.13-3","1.6.15-1","1.6.15-2","1.6.16-1","1.6.17-1","1.6.18-1","1.6.19-1"]},{"source":"osv","ecosystem":"Debian:13","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.15-1","1.6.15-2","1.6.16-1","1.6.17-1","1.6.18-1","1.6.19-1"]},{"source":"osv","ecosystem":"Debian:14","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-1"}]}],"versions":["1.6.15-1","1.6.15-2","1.6.16-1","1.6.17-1","1.6.18-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-1.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-1.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-1.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.20-1.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.20-1.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.20-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.14-slfo.1.1_4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-150400.3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-3ubuntu3.3+esm2"}]}],"versions":["1.1.5-3ubuntu2","1.1.5-3ubuntu3","1.1.5-3ubuntu3.1","1.1.5-3ubuntu3.2","1.1.5-3ubuntu3.3","1.1.5-3ubuntu3.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.1ubuntu4.1~0.16.04.1~esm2"}]}],"versions":["1.1.5-3ubuntu7","1.4.11-1ubuntu1","1.4.11-1.1ubuntu2~0.16.04","1.4.11-1.1ubuntu3~0.16.04","1.4.11-1.1ubuntu4~0.16.04","1.4.11-1.1ubuntu4.1~0.16.04","1.4.11-1.1ubuntu4.1~0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.1ubuntu4.1+esm2"}]}],"versions":["1.4.11-1.1ubuntu4","1.4.11-1.1ubuntu4.1","1.4.11-1.1ubuntu4.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu1.1+esm2"}]}],"versions":["1.6.3-1.1ubuntu2","1.6.4-3ubuntu1","1.6.4-3ubuntu1.1","1.6.4-3ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2ubuntu0.22.04.4"}]}],"versions":["1.6.6-4","1.6.6-5","1.6.8-1","1.6.9-1","1.6.9-2","1.6.9-2ubuntu0.22.04.1","1.6.9-2ubuntu0.22.04.2","1.6.9-2ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-3ubuntu0.2"}]}],"versions":["1.6.11-1","1.6.11-2","1.6.13-2","1.6.13-3","1.6.13-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-1ubuntu0.2"}]}],"versions":["1.6.15-2","1.6.16-1","1.6.16-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-3ubuntu3.3+esm2"}]}],"versions":["1.1.5-3ubuntu2","1.1.5-3ubuntu3","1.1.5-3ubuntu3.1","1.1.5-3ubuntu3.2","1.1.5-3ubuntu3.3","1.1.5-3ubuntu3.3+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.1ubuntu4.1~0.16.04.1~esm2"}]}],"versions":["1.1.5-3ubuntu7","1.4.11-1ubuntu1","1.4.11-1.1ubuntu2~0.16.04","1.4.11-1.1ubuntu3~0.16.04","1.4.11-1.1ubuntu4~0.16.04","1.4.11-1.1ubuntu4.1~0.16.04","1.4.11-1.1ubuntu4.1~0.16.04.1~esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.1ubuntu4.1+esm2"}]}],"versions":["1.4.11-1.1ubuntu4","1.4.11-1.1ubuntu4.1","1.4.11-1.1ubuntu4.1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu1.1+esm2"}]}],"versions":["1.6.3-1.1ubuntu2","1.6.4-3ubuntu1","1.6.4-3ubuntu1.1","1.6.4-3ubuntu1.1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2ubuntu0.22.04.4"}]}],"versions":["1.6.6-4","1.6.6-5","1.6.8-1","1.6.9-1","1.6.9-2","1.6.9-2ubuntu0.22.04.1","1.6.9-2ubuntu0.22.04.2","1.6.9-2ubuntu0.22.04.3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-3ubuntu0.2"}]}],"versions":["1.6.11-1","1.6.11-2","1.6.13-2","1.6.13-3","1.6.13-3ubuntu0.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-1ubuntu0.2"}]}],"versions":["1.6.15-2","1.6.16-1","1.6.16-1ubuntu0.1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"freeipmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.15-160000.5.1"}]}],"bundled":6}],"products":[{"vendor":"freeipmi","product":"freeipmi"},{"vendor":"microsoft","product":"freeipmi"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/08/28/5","tags":["report"]},{"url":"https://www.gnu.org/software/freeipmi/","tags":["report"]},{"url":"https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85508","tags":["web","advisory"]},{"url":"https://www.gnu.org/software/freeipmi"},{"url":"https://github.com/advisories/GHSA-g7hg-9x6v-q9jm"},{"url":"https://access.redhat.com/errata/RHSA-2026:89753","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85504","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85505","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85506","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85507","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85508","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85509","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528390","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528396","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528398","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528399","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528400","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528401","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-89753.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89754","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-89754.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89905","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-89905.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-85508","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-85508","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85507","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85509","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3901","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4065","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89753","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528401","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89754","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89905","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623746-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278719","tags":["report"]},{"url":"https://bugzilla.suse.com/1278721","tags":["report"]},{"url":"https://bugzilla.suse.com/1278722","tags":["report"]},{"url":"https://bugzilla.suse.com/1278724","tags":["report"]},{"url":"https://bugzilla.suse.com/1278726","tags":["report"]},{"url":"https://bugzilla.suse.com/1278727","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85509","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264277-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267605","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50031","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-85508","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85508","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8843-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-85504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85509","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-85508","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","status":"published","published":"2026-09-04T04:20:19.932Z","modified":"2026-09-04T16:38:22.007Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-70886","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","status":"published","published":"2026-09-04T04:20:19Z","modified":"2026-09-04T16:38:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:12.302717Z"}],"ghsa":[{"id":"GHSA-g7hg-9x6v-q9jm","title":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in...","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","status":"published","published":"2026-09-04T06:31:24Z","modified":"2026-09-04T06:31:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:11:21.315485Z"}],"nvd":[{"id":"CVE-2026-85508","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","status":"published","published":"2026-09-04T05:17:16.57Z","modified":"2026-09-08T19:42:20.313Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:43.737972Z"}],"osv":[{"id":"BELL-CVE-2026-85508","status":"published","published":"2026-09-08T06:05:21.873589Z","modified":"2026-10-06T07:15:03.386329153Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"DEBIAN-CVE-2026-85508","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","status":"published","published":"2026-09-04T05:17:16.57Z","modified":"2026-10-01T03:03:51.370393182Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"OESA-2026-3900","title":"freeipmi security update","description":"The package provides \u0026amp;quot;Remote-Console\u0026amp;quot; and \u0026amp;quot;System Management software\u0026amp;quot; based on intelligent platform management interface specification.\r\n\r\nSecurity Fix(es):\n\nFreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.(CVE-2026-85504)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).(CVE-2026-85505)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).(CVE-2026-85506)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).(CVE-2026-85507)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).(CVE-2026-85508)\n\nFreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested, potentially leading to denial of service or arbitrary code execution.(CVE-2026-85509)","status":"published","published":"2026-09-20T13:23:03Z","modified":"2026-09-20T13:30:23.693208162Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3901","title":"freeipmi security update","description":"The package provides \u0026amp;quot;Remote-Console\u0026amp;quot; and \u0026amp;quot;System Management software\u0026amp;quot; based on intelligent platform management interface specification.\r\n\r\nSecurity Fix(es):\n\nFreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.(CVE-2026-85504)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).(CVE-2026-85505)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).(CVE-2026-85506)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).(CVE-2026-85507)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).(CVE-2026-85508)\n\nFreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested, potentially leading to denial of service or arbitrary code execution.(CVE-2026-85509)","status":"published","published":"2026-09-20T13:23:04Z","modified":"2026-09-20T13:30:24.606478958Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4065","title":"freeipmi security update","description":"The package provides \u0026amp;quot;Remote-Console\u0026amp;quot; and \u0026amp;quot;System Management software\u0026amp;quot; based on intelligent platform management interface specification.\r\n\r\nSecurity Fix(es):\n\nFreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.(CVE-2026-85504)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).(CVE-2026-85505)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).(CVE-2026-85506)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).(CVE-2026-85507)\n\nipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).(CVE-2026-85508)\n\nFreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested, potentially leading to denial of service or arbitrary code execution.(CVE-2026-85509)","status":"published","published":"2026-09-25T01:27:57Z","modified":"2026-09-25T01:45:08.35033568Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RLSA-2026:89753","title":"Moderate: freeipmi security, bug fix, and enhancement update","description":"The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.\n\nSecurity Fix(es):\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)\n\n* FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505)\n\n* freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)\n\nBug Fix(es) and Enhancement(s):\n\n* Update freeipmi to 1.6.20 to fix two potential buffer overflows [rhel-9.8.z] (JIRA:Rocky Linux-279523)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:04:29.081572Z","modified":"2026-10-27T12:30:04.734074975Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89754","title":"Moderate: freeipmi security, bug fix, and enhancement update","description":"The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.\n\nSecurity Fix(es):\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)\n\n* FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505)\n\n* freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)\n\nBug Fix(es) and Enhancement(s):\n\n* Update freeipmi to 1.6.20 to fix two potential buffer overflows [rhel-8.10.z] (JIRA:Rocky Linux-279519)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:00:59.646159Z","modified":"2026-10-27T12:30:02.5225162Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89905","title":"Moderate: freeipmi security, bug fix, and enhancement update","description":"The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.\n\nSecurity Fix(es):\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)\n\n* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)\n\n* FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505)\n\n* freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)\n\nBug Fix(es) and Enhancement(s):\n\n* Update freeipmi to 1.6.20 to fix two potential buffer overflows [rhel-10.2.z] (JIRA:Rocky Linux-279524)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:08:55.409043Z","modified":"2026-10-27T12:30:02.520589263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-85508","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","status":"published","published":"2026-09-04T05:17:00Z","modified":"2026-09-30T05:38:53.440100125Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:89753","title":"Moderate: freeipmi security, bug fix, and enhancement update","description":"The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  \n\nSecurity Fix(es):  \n\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)\n  * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505)\n  * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-9.8.z] (JIRA:AlmaLinux-279523)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.603860222Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89754","title":"Moderate: freeipmi security, bug fix, and enhancement update","description":"The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  \n\nSecurity Fix(es):  \n\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)\n  * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505)\n  * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-8.10.z] (JIRA:AlmaLinux-279519)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:02:25.36110381Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89905","title":"Moderate: freeipmi security, bug fix, and enhancement update","description":"The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  \n\nSecurity Fix(es):  \n\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)\n  * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)\n  * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505)\n  * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-10.2.z] (JIRA:AlmaLinux-279524)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:31:04.20313547Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-99104","title":"CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1","description":"ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).","status":"published","published":"2026-09-04T05:17:16Z","modified":"2026-09-10T14:16:49.633379576Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"openSUSE-SU-2026:11797-1","title":"freeipmi-1.6.19-1.1 on GA media","description":"These are all security issues fixed in the freeipmi-1.6.19-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-09-17T18:23:13.646039784Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21883-1","title":"Security update for freeipmi","description":"This update for freeipmi fixes the following issues:\n\n- CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses (bsc#1278719).\n- CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem (bsc#1278722).\n- CVE-2026-85506: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (bsc#1278721).\n- CVE-2026-85507: stack-based buffer overflow in _output_dell_system_info_cmc_info (bsc#1278724).\n- CVE-2026-85508: stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info (bsc#1278726).\n- CVE-2026-85509: stack-based buffer overflow when a BMC returns more bytes than requested (bsc#1278727).\n","status":"published","published":"2026-09-20T00:42:39Z","modified":"2026-09-25T18:23:10.62576767Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23746-1","title":"Security update for freeipmi","description":"This update for freeipmi fixes the following issues:\n\n- CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses (bsc#1278719).\n- CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem (bsc#1278722).\n- CVE-2026-85506: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (bsc#1278721).\n- CVE-2026-85507: stack-based buffer overflow in _output_dell_system_info_cmc_info (bsc#1278724).\n- CVE-2026-85508: stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info (bsc#1278726).\n- CVE-2026-85509: stack-based buffer overflow when a BMC returns more bytes than requested (bsc#1278727).\n","status":"published","published":"2026-09-17T07:27:57Z","modified":"2026-09-27T18:23:09.848267916Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4277-1","title":"Security update for freeipmi","description":"This update for freeipmi fixes the following issues:\n\n- CVE-2026-50031: Denial of service via buffer overflow in ipmi-oem client (bsc#1267605).\n- CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses (bsc#1278719).\n- CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem (bsc#1278722).\n- CVE-2026-85506: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (bsc#1278721).\n- CVE-2026-85507: stack-based buffer overflow in _output_dell_system_info_cmc_info (bsc#1278724).\n- CVE-2026-85508: stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info (bsc#1278726).\n- CVE-2026-85509: stack-based buffer overflow when a BMC returns more bytes than requested (bsc#1278727).\n","status":"published","published":"2026-09-22T08:31:21Z","modified":"2026-09-23T09:15:05.303342233Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8843-1","title":"freeipmi vulnerabilities","description":"It was discovered that FreeIPMI incorrectly handled certain malformed\nFujitsu SEL long-text responses, leading to a stack-based buffer\noverflow. An attacker in control of a malicious IPMI device could\npossibly use this issue to cause FreeIPMI to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2026-85504)\n\nIt was discovered that FreeIPMI incorrectly handled short responses when\nretrieving Fujitsu SEL entries, leading to a stack-based buffer\nover-read. An attacker in control of a malicious IPMI device could\npossibly use this issue to cause FreeIPMI to crash, resulting in a denial\nof service. (CVE-2026-85505)\n\nIt was discovered that FreeIPMI incorrectly handled certain Dell iDRAC\nand CMC IPv6 system information responses, leading to a stack-based\nbuffer overflow. An attacker in control of a malicious IPMI device could\npossibly use this issue to cause FreeIPMI to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2026-85506,\nCVE-2026-85508)\n\nIt was discovered that FreeIPMI incorrectly handled certain Dell CMC\nsystem information responses, leading to a stack-based buffer overflow.\nAn attacker in control of a malicious IPMI device could possibly use this\nissue to cause FreeIPMI to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04\nLTS, and Ubuntu 26.04 LTS. (CVE-2026-85507)\n\nIt was discovered that FreeIPMI incorrectly handled FRU data responses\nthat were larger than requested, leading to a stack-based buffer\noverflow. An attacker in control of a malicious IPMI device could\npossibly use this issue to cause FreeIPMI to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2026-85509)","status":"published","published":"2026-09-29T14:16:32Z","modified":"2026-09-30T05:41:55.4892475Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}