There are 5 open security issues in trixie.
5 issues left for the package maintainer to handle:
- CVE-2026-104591:
(needs triaging)
libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.
- CVE-2026-104592:
(needs triaging)
libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.
- CVE-2026-104594:
(needs triaging)
libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104596:
(needs triaging)
libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
- CVE-2026-104597:
(needs triaging)
libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/libo/libosmocore.png){kind=link}