Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-93337

Type: advisorySource: OSV1 source record

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-93337

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-93337

network-manager-l2tp

Source reference: /affected/0/package/name

Affected versions
1.20.8-1

Source reference: /affected/0/versions

Fixed versions
1.20.8-1+deb12u1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

network-manager-l2tp

Source reference: /affected/1/package/name

Affected versions
1.20.20-2

Source reference: /affected/1/versions

Fixed versions
1.20.20-2+deb13u1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

network-manager-l2tp

Source reference: /affected/2/package/name

Affected versions
1.20.20-2

Source reference: /affected/2/versions

1.52.0-1

Source reference: /affected/2/versions

1.52.0-2

Source reference: /affected/2/versions

1.52.2-1

Source reference: /affected/2/versions

1.52.4-1

Source reference: /affected/2/versions

Fixed versions
1.52.6-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.20.8-1+deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "network-manager-l2tp",
      "purl": "pkg:deb/debian/network-manager-l2tp?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1.20.8-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93337.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.20.20-2+deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "network-manager-l2tp",
      "purl": "pkg:deb/debian/network-manager-l2tp?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1.20.20-2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93337.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.52.6-1"
          }
        ]
      }
    ],
    "package": {
      "name": "network-manager-l2tp",
      "purl": "pkg:deb/debian/network-manager-l2tp?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1.20.20-2",
      "1.52.0-1",
      "1.52.0-2",
      "1.52.2-1",
      "1.52.4-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93337.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#60861 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement