Skip to content
OpenAdvisories
High USN-8326-1 2 CVEs

foomuuri vulnerabilities

Published May 27, 2026 · Updated May 27, 2026

Ecosystem: Ubuntu

Summary

Matthias Gerstner discovered that Foomuuri's D-Bus service did not properly
enforce authorization. An unprivileged local attacker could possibly use
this issue to manipulate the firewall configuration, contrary to
expectations. (CVE-2025-67603)

Matthias Gerstner discovered that Foomuuri's D-Bus service did not properly
validate interface names. A local attacker could possibly use this issue to
manipulate the firewall configuration in unintended ways. (CVE-2025-67858)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 25.10 foomuuri 0.27-2+deb13u1build0.25.10.1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS foomuuri 0.22-1ubuntu0.1~esm1

Vulnerabilities 2

  • High 7.0
    CVE-2025-67858

    A crafted "interface" input parameter can lead to integrity loss of the firewall configuration

    A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects Foomuuri: from ? befor…

    https://github.com/FoobarOy/ Foomuuri foomuuri foomuuri Debian Ubuntu
  • Medium 5.1
    CVE-2025-67603

    Lack of client authorization allows arbitrary users to influence the firewall configuration

    A Improper Authorization vulnerability in Foomuuri llows arbitrary users to influence the firewall configuration.This issue affects Foomuuri: from ? before 0.31.

    https://github.com/FoobarOy/ Foomuuri foomuuri foomuuri Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-67603
  • report
    https://ubuntu.com/security/CVE-2025-67858