CVE-2025-24965

highPriorität · verfolgen · 0EPSS 0.006 · 47. PerzentilDEEURU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.58% (47th) EPSS

CVSS 8.7 · high

Is it mine?

19 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · phoenix_contact_psirt

EPSS · bewertet 2026-10-27

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file. The problem is fixed in crun 1.20 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobencrun-0:1.14-2.1.aarch64 as component of SUSE Linux Micro 6.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencrun-0:1.14-2.1.s390x as component of SUSE Linux Micro 6.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobencrun-0:1.14-2.1.x86_64 as component of SUSE Linux Micro 6.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
BehobenFirmware < 2025.0.2 installed on AXC F 1152phoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
BehobenFirmware < 2025.0.2 installed on AXC F 2152phoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
BehobenFirmware < 2025.0.2 installed on AXC F 3152phoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
BehobenFirmware < 2025.0.2 installed on BPC 9102Sphoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
BehobenFirmware < 2025.0.2 installed on RFC 4072Sphoenix_contact_psirt
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.7

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6–8.7

v3.18.7highAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Nsecondary · Phoenix Contact PSIRT DE

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Nsecondary · SUSE Product Security

v4.08.5highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.08.5highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.06mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-22USCWE-22USCWE-22US

betroffene Produkte (19)

Betroffene Produkte und Versionsbereiche.

containers crun≤ < 1.20enisa_euvdEU
Novell Inc. OpenSUSE Leap≤ 15.6fstec_bduRU
Novell Inc. openSUSE Tumbleweedalle Versionenfstec_bduRU
Red Hat Inc. Red Hat OpenShift Container Platform≤ 4fstec_bduRU
АО «ИВК» АЛЬТ СП 10alle Versionenfstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 12fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения crun≤ 1.20fstec_bduRU
Firmware 2025.0.2 installed on AXC F 1152alle Versionenfixedphoenix_contact_psirtDE
Firmware 2025.0.2 installed on AXC F 2152alle Versionenfixedphoenix_contact_psirtDE
Firmware 2025.0.2 installed on AXC F 3152alle Versionenfixedphoenix_contact_psirtDE
Firmware 2025.0.2 installed on BPC 9102Salle Versionenfixedphoenix_contact_psirtDE
Firmware 2025.0.2 installed on RFC 4072Salle Versionenfixedphoenix_contact_psirtDE
Firmware < 2025.0.2 installed on AXC F 1152alle Versionenphoenix_contact_psirtDE
Firmware < 2025.0.2 installed on AXC F 2152alle Versionenphoenix_contact_psirtDE
Firmware < 2025.0.2 installed on AXC F 3152alle Versionenphoenix_contact_psirtDE
Firmware < 2025.0.2 installed on BPC 9102Salle Versionenphoenix_contact_psirtDE
Firmware < 2025.0.2 installed on RFC 4072Salle Versionenphoenix_contact_psirtDE

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SUSE-SU-2026:20452-1Security update for crun2026-02-17csaf · suse_csafDE
Security update for crun
VDE-2025-053Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware2025-07-08csaf · phoenix_contact_psirtDE
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2025.0.2

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu phoenix_contact_psirt suse_csaf NVD CVE.org MITRE

veröffentlicht 2025-02-19geändert 2026-06-17

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan