CVE catalog

CVE-2025-60020

NNCP vulnerability

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.27% · Oct 25, 2026

nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannncpsid8.12.1-4fixed
Debiannncpforky8.12.1-4fixed
Debiannncptrixie8.11.0-4+deb13u1fixed
Debiannncptrixie-security8.11.0-4+deb13u1fixed
Debiannncpbookworm8.8.2-3+deb12u1fixed
Debiannncpbookworm-security8.8.2-3+deb12u1fixed
Ubuntunncpnoble8.10.0-8ubuntu0.3+esm3fixed
Ubuntunncppro8.8.2-4build1vulnerable
Ubuntunncppro8.9.0-1vulnerable
Ubuntunncppro8.10.0-3vulnerable
Ubuntunncppro8.10.0-4vulnerable
Ubuntunncppro8.10.0-5vulnerable
Ubuntunncppro8.10.0-6vulnerable
Ubuntunncppro8.10.0-7vulnerable
Ubuntunncppro8.10.0-8vulnerable
Ubuntunncppro8.10.0-8ubuntu0.1vulnerable
Ubuntunncppro8.10.0-8ubuntu0.2vulnerable
Ubuntunncppro8.10.0-8ubuntu0.2+esm1vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3+esm1vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3+esm2vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3+esm3fixed
Ubuntunncp25.108.11.0-3vulnerable
Ubuntunncp25.108.11.0-4vulnerable
Ubuntunncp25.108.11.0-4+deb13u1build0.25.10.1fixed
Ubuntunncppro8.8.2-4build1vulnerable
Ubuntunncppro8.9.0-1vulnerable
Ubuntunncppro8.10.0-3vulnerable
Ubuntunncppro8.10.0-4vulnerable
Ubuntunncppro8.10.0-5vulnerable
Ubuntunncppro8.10.0-6vulnerable
Ubuntunncppro8.10.0-7vulnerable
Ubuntunncppro8.10.0-8vulnerable
Ubuntunncppro8.10.0-8ubuntu0.1vulnerable
Ubuntunncppro8.10.0-8ubuntu0.2vulnerable
Ubuntunncppro8.10.0-8ubuntu0.2+esm1vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3+esm1vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3+esm2vulnerable
Ubuntunncppro8.10.0-8ubuntu0.3+esm3fixed
Ubuntunncp25.108.11.0-3vulnerable
Ubuntunncp25.108.11.0-4vulnerable
Ubuntunncp25.108.11.0-4+deb13u1build0.25.10.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannncpsourcesid8.12.1-1not yet assignedNot reported[1115848]
Debiannncpsourceforky8.12.1-1not yet assignedNot reported[1115848]
Debiannncpsourcetrixie8.11.0-4+deb13u1not yet assignedNot reported[1115848]
Debiannncpsourcebookworm8.8.2-3+deb12u1not yet assignedNot reported[1115848]
Ubuntunncpdebnoble8.10.0-8ubuntu0.3+esm3Not reportedNot reportedNot reported
Ubuntunncpdebpro8.10.0-8ubuntu0.3+esm3Not reportedUSN-8359-1Not reported
Ubuntunncpdeb25.108.11.0-4+deb13u1build0.25.10.1Not reportedUSN-8359-1Not reported
Ubuntunncpdebpro8.10.0-8ubuntu0.3+esm3Not reportedUBUNTU-CVE-2025-60020Not reported
Ubuntunncpdeb25.108.11.0-4+deb13u1build0.25.10.1Not reportedUBUNTU-CVE-2025-60020Not reported

[Debian bug #1115848]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [nncp]Fixed
    Details (6)

    • 8.8.2-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 8.8.2-3+deb12u1

      usn · nncp · debian · bookworm; usn · nncp · debian · 12

    • 8.8.2-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 8.8.2-3+deb12u1

      usn · nncp · debian · bookworm; usn · nncp · debian · 12

    • 8.11.0-2~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 8.8.2-3+deb12u1

      usn · nncp · debian · bookworm; usn · nncp · debian · 12

    • 8.11.0-2~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 8.8.2-3+deb12u1

      usn · nncp · debian · bookworm; usn · nncp · debian · 12

    • 8.8.2-3+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 8.8.2-3+deb12u1

      usn · nncp · debian · bookworm; usn · nncp · debian · 12

    • 8.8.2-3+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 8.8.2-3+deb12u1

      usn · nncp · debian · bookworm; usn · nncp · debian · 12

[Debian 13 (Trixie)]

  • [nncp]Fixed
    Details (4)

    • 8.11.0-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 8.11.0-4+deb13u1

      usn · nncp · debian · 13

    • 8.11.0-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 8.11.0-4+deb13u1

      usn · nncp · debian · 13

    • 8.11.0-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 8.11.0-4+deb13u1

      usn · nncp · debian · 13

    • 8.11.0-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 8.11.0-4+deb13u1

      usn · nncp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]