BSD Portssuricata -- Multiple vulnerabilities
· CVE-2025-29915, CVE-2025-29916, CVE-2025-29917, CVE-2025-29918 · VuXML entry
Suricate team reports: Multiple vulnerabilities CVE-2025-29915: Severity HIGH. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. CVE-2025-29916: Severity Moderate. Datasets declared in rules have an option …
Affected versions
- suricata < 7.0.9
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| OPNsense | opnsense/suricata | 8.0.6 | fixed | |
| OpenBSD | security/suricata | 7.0.7p0 | in range, by version | |
| NetBSD | wip/suricata | 8.0.2nb1 | not listed | |
| FreeBSD | security/suricata | 8.0.7_1 | fixed | (465 days after) |