Search for packages
| purl | pkg:deb/debian/openvpn@0?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-28zy-wt9q-5udk | The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service. |
CVE-2024-24974
|
| VCID-5wv8-4q5c-4fev | OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe). |
CVE-2021-3606
|
| VCID-6h6c-h3va-dbfk | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use |
CVE-2025-10680
|
| VCID-7k7e-z4tf-6uc4 | Multiple vulnerabilities have been discovered in OpenVPN, the worst of which could lead to information disclosure. |
CVE-2023-46850
|
| VCID-9ymq-r7r1-4uh9 | openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation. |
CVE-2018-9336
|
| VCID-ayrd-g1eb-h3dt | OpenVPN: OpenVPN: Local denial of service vulnerability in interactive service agent |
CVE-2025-13751
|
| VCID-hr11-3ew1-4fgk | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase |
CVE-2025-2704
|
| VCID-junc-6y8j-cbe2 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session |
CVE-2024-28882
|
| VCID-pspa-n4yc-j7hr | The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges. |
CVE-2024-27459
|
| VCID-qw3z-yr6x-2uhd | OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service. |
CVE-2024-27903
|
| VCID-qwa7-cv2s-53hp | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses |
CVE-2025-12106
|
| VCID-rprb-r52n-7ygu | OpenVPN: OpenVPN: Improper validation of source IP addresses leads to denial of service |
CVE-2025-13086
|
| VCID-ttj5-upnp-3qfd | Multiple vulnerabilities have been discovered in OpenVPN, the worst of which could lead to information disclosure. |
CVE-2023-46849
|
| VCID-w1eu-fbhk-pucv | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges |
CVE-2024-4877
|
| VCID-xwnt-nju3-yybg | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service |
CVE-2025-15497
|