p PatchFirst

CVE-2023-46850

CVE-2023-46850

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.

CVSS 9.8 · Critical · EPSS 2.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • openvpn 2 (community)

    Versions
    • ≥ 2.6.0, ≤ 2.6.6: Affected (minor release)

    No fix published

  • access server

    Versions
    • ≥ 2.11.0, ≤ 2.11.3: Affected (patch release)
    • ≥ 2.12.0, ≤ 2.12.2: Affected (patch release)

    No fix published

  • openvpn Debian:12

    Versions
    • 2.6.3-1
    • 2.6.3-1+deb12u1
    • 2.6.3-1+deb12u1~bpo11+1
    • 2.6.3-1+deb12u2~bpo11+1
    Affected ranges
    • ECOSYSTEM: < 2.6.3-1+deb12u2

    Update to 2.6.3-1+deb12u2

  • openvpn Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.6.7-1

    Update to 2.6.7-1

  • openvpn Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.6.7-1

    Update to 2.6.7-1

Original sources

Check your server →