CVE catalog

CVE-2009-0758

avahi: CVE-2009-0758

Severity: Medium
Published: Mar 1, 2009, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.01% · Oct 27, 2026

The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	avahi	sid	`0.8-18`	fixed
Debian	avahi	forky	`0.8-18`	fixed
Debian	avahi	trixie	`0.8-16`	fixed
Debian	avahi	bookworm	`0.8-10+deb12u1`	fixed
Opensuse	avahi	tumbleweed	`0.6.32-2.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	avahi	source	sid	`0.6.24-3`	low	Not reported	[517683]
Debian	avahi	source	forky	`0.6.24-3`	low	Not reported	[517683]
Debian	avahi	source	trixie	`0.6.24-3`	low	Not reported	[517683]
Debian	avahi	source	bookworm	`0.6.24-3`	low	Not reported	[517683]
Opensuse	avahi	rpm	tumbleweed	`0.6.32-2.3`	Not reported	OPENSUSE-SU-2024:10363-1	Not reported

[Debian bug #517683]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[avahi-autoipd]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[avahi-compat-howl-devel]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[avahi-compat-mDNSResponder-devel]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[avahi-lang]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · noarch · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[avahi-utils]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libavahi-client3]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libavahi-client3-32bit]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libavahi-common3]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libavahi-common3-32bit]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libavahi-core7]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libavahi-devel]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libavahi-libevent1]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libdns_sd]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libdns_sd-32bit]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[libhowl0]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[python313-avahi]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed
[python314-avahi]Unknown
Source package: [avahi]
Details (1)
- 0.8-45.2 · x86_64 · tumbleweed
  Unknown · Fixed: 0.6.32-2.3
  Version impact unknown
  dsa · avahi · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[avahi-autoipd]Fixed
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.6.24-3
  dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.6.24-3
  dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
[avahi-daemon]Fixed
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.6.24-3
  dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- 0.8-10+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.6.24-3
  dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
[avahi-discover]Fixed
Source package: [avahi]
Details (2)
- 0.8-10+deb12u1 · all · bookworm
  Fixed · Fixed: 0.6.24-3
  dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- 0.8-10+deb12u1 · all · bookworm
  Fixed · Fixed: 0.6.24-3
  dsa · avahi · debian · bookworm; dsa · avahi · debian · 12

Next results

Observed: Oct 23, 2026, 5:04:30 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]