Description
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openvpn | 2.0.6-1 | — |
| Debian 13 | openvpn | 2.0.6-1 | — |
| Debian 12 | openvpn | 2.0.6-1 | — |
| Debian 3.1 | openvpn | 2.0-1sarge3 | DSA-1045-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openvpn | 2.5.3-1.2 | openSUSE-SU-2024:11128-1 |
Advisories 2
- DSA-1045-1 openvpn - design error Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11128-1 openvpn-2.5.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openvpn-ldpreload-code-execution(25667) vdb-entry
- MDKSA-2006:069 vendor-advisory
- ADV-2006-1261 vdb-entry
- 17392 vdb-entry
- http://openvpn.net/changelog.html
- http://www.osreviews.net/reviews/security/openvpn-print
- 19531 third-party-advisory
- DSA-1045 vendor-advisory
- 19598 third-party-advisory
- http://sourceforge.net/mailarchive/forum.php?thread_id=10093825&forum_id=8482
- 19837 third-party-advisory
- 24444 vdb-entry
- 19897 third-party-advisory
- SUSE-SR:2006:009 vendor-advisory