CVE catalog

CVE-2025-67858

Foomuuri vulnerabilities

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Jan 1, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 25, 2026

A flaw was found in Foomuuri. A local user can exploit this vulnerability by manipulating the JSON configuration passed to `nft`. This improper neutralization of argument delimiters can lead to the integrity loss of the firewall configuration or other unspecified impacts. This vulnerability is rated Important for Red Hat's Community Projects because a local user can exploit an improper neutralization of argument delimiters in Foomuuri. This flaw allows manipulation of the JSON configuration passed to `nft`, leading to integrity loss of the firewall configuration. This could result in unauthorized network access or other unspecified impacts on affected systems running Foomuuri. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	foomuuri	noble	`0.22-1ubuntu0.1~esm1`	fixed
Ubuntu	foomuuri-firewalld	noble	`0.22-1ubuntu0.1~esm1`	fixed
Debian	foomuuri	13	`0.27-2`	vulnerable
Debian	foomuuri	13	`0.27-2+deb13u1`	fixed
Debian	foomuuri	14	`0.27-2`	vulnerable
Debian	foomuuri	14	`0.28-1`	vulnerable
Debian	foomuuri	14	`0.28-1~bpo13+1`	vulnerable
Debian	foomuuri	14	`0.29-1`	vulnerable
Debian	foomuuri	14	`0.29-1~bpo13+1`	vulnerable
Debian	foomuuri	14	`0.30-1`	vulnerable
Debian	foomuuri	14	`0.30-1~bpo13+1`	vulnerable
Debian	foomuuri	14	`0.31-1~bpo13+1`	vulnerable
Debian	foomuuri	14	`0.31-1`	fixed
Ubuntu	foomuuri	pro	`0.20-1`	vulnerable
Ubuntu	foomuuri	pro	`0.21-1`	vulnerable
Ubuntu	foomuuri	pro	`0.21-2`	vulnerable
Ubuntu	foomuuri	pro	`0.22-1`	vulnerable
Ubuntu	foomuuri	pro	`0.22-1ubuntu0.1~esm1`	fixed
Ubuntu	foomuuri	25.10	`0.27-2`	vulnerable
Ubuntu	foomuuri	25.10	`0.27-2+deb13u1build0.25.10.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Ubuntu	foomuuri	deb	noble	`0.22-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	foomuuri-firewalld	deb	noble	`0.22-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Debian	foomuuri	deb	13	`0.27-2+deb13u1`	Not reported	DEBIAN-CVE-2025-67858	Not reported
Debian	foomuuri	deb	14	`0.31-1`	Not reported	DEBIAN-CVE-2025-67858	Not reported
Ubuntu	foomuuri	deb	pro	`0.22-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2025-67858	Not reported
Ubuntu	foomuuri	deb	25.10	`0.27-2+deb13u1build0.25.10.1`	Not reported	UBUNTU-CVE-2025-67858	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[foomuuri]Fixed
Details (6)
- 0.27-2+deb13u1 · all · trixie
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.27-2+deb13u1 · all · trixie
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.33-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.33-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.27-2+deb13u1 · all · trixie-security
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.27-2+deb13u1 · all · trixie-security
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
[foomuuri-firewalld]Fixed
Source package: [foomuuri]
Details (6)
- 0.27-2+deb13u1 · all · trixie
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.27-2+deb13u1 · all · trixie
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.33-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.33-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.27-2+deb13u1 · all · trixie-security
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.27-2+deb13u1 · all · trixie-security
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
[prometheus-foomuuri-exporter]Fixed
Source package: [foomuuri]
Details (2)
- 0.33-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13
- 0.33-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.27-2+deb13u1
  usn · foomuuri · debian · 13

Observed: Oct 27, 2026, 10:13:49 AM UTC

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]