Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
FreeIPMI may crash or be hijacked by malformed data
published 29 days ago
Summary
Versions of FreeIPMI earlier than 1.6.19 can be tricked into overwriting memory when they process certain responses from server hardware, which could cause the program to stop working or allow an attacker to run code. This affects the remote‑console and system‑management tools that use the library. Update FreeIPMI to version 1.6.19 or later to resolve the issue.
What to do
- Update openeuler freeipmi to version 1.6.19-1.oe2403sp3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP3 | openeuler | freeipmi |
< 1.6.19-1.oe2403sp3 Fix: upgrade to 1.6.19-1.oe2403sp3
|
Original advisory text
freeipmi security update
The package provides &quot;Remote-Console&quot; and &quot;System Management software&quot; based on intelligent platform management interface specification.
Security Fix(es):
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.(CVE-2026-85504)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).(CVE-2026-85505)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).(CVE-2026-85506)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).(CVE-2026-85507)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).(CVE-2026-85508)
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested, potentially leading to denial of service or arbitrary code execution.(CVE-2026-85509)
Security Fix(es):
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.(CVE-2026-85504)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).(CVE-2026-85505)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).(CVE-2026-85506)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).(CVE-2026-85507)
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).(CVE-2026-85508)
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested, potentially leading to denial of service or arbitrary code execution.(CVE-2026-85509)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85504 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85505 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85506 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85507 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85508 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85509 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published20 Sep 2026
Updated20 Sep 2026
First seen20 Sep 2026
Sources
OESA-2026-3901 · OSV
Track software like this
Free during beta