Memory Corruption Vulnerability in autogen Package Affecting Debian Versions 11-14
Summary
CVE-2025-8746: A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affects autogen versions 1:5.18.16-4 – 1:5.19.96-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The autogen package is a tool designed to automatically generate program files. It simplifies the process of creating configuration files and other repetitive tasks in software development. However, it relies on external libraries, including GNU libopts, which has been identified as having a critical vulnerability that can lead to memory corruption. This vulnerability affects multiple Debian versions, making it crucial for users to be aware of its implications.
Vulnerability Detail
A vulnerability classified as problematic has been discovered in GNU libopts up to version 27.6, specifically in the function __strstr_sse2. This vulnerability allows for memory corruption, which can be exploited by an attacker with local access. The issue was initially reported to the tcpreplay project, but it was clarified that the bug resides in the external library libopts. This vulnerability affects products that are no longer supported by the maintainer, potentially exposing users to security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected systems to trusted users only, thereby reducing the risk of exploitation until the package can be updated.
Conclusion
The memory corruption vulnerability in the autogen package poses a significant risk to users of Debian versions 11 through 14. It is essential to update the package to the latest version to mitigate this risk. Users are encouraged to monitor their systems and utilize tools like Vulert to stay informed about potential vulnerabilities.
See every vulnerability recorded for autogen →
FAQ
The vulnerability is a memory corruption issue in the GNU libopts library, which can be exploited by attackers with local access.
Debian versions 11, 12, 13, and 14 are all affected by this vulnerability in the autogen package.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, restrict access to the affected systems to trusted users to mitigate the risk of exploitation.
Yes, users should update to the latest patched version of the autogen package available for their Debian distribution to fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for autogen.
