CVE-2025-32743

Name	CVE-2025-32743
Description	In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1103530

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
connman (PTS)	bullseye (security), bullseye	1.36-2.2+deb11u2	vulnerable
	bookworm	1.41-3	vulnerable
	sid, trixie	1.44-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
connman	source	(unstable)	(unfixed)			1103530

Notes

[trixie] - connman <no-dsa> (Minor issue)
[bookworm] - connman <no-dsa> (Minor issue)
[bullseye] - connman <postponed> (Minor issue)
https://lapis-sawfish-be3.notion.site/0-click-Vulnerability-in-Comman-1-43_v3-1cadc00d01d080b0b3b9c46a6da584cc
Fixed by: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d90b911f6760959bdf1393c39fe8d1118315490f