SB2025110458 - Meinberg LANTIME firmware update for third-party components
Published: November 4, 2025 Updated: February 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2025-9230)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when trying to decrypt CMS messages encrypted using password based encryption. A remote attacker can trigger an out-of-bounds write and execute arbitrary code on the target system.
Successful exploitation of the vulnerability requires that password based (PWRI) encryption support in CMS messages is enabled.
2) Covert Timing Channel (CVE-ID: CVE-2025-9231)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to timing side-channel in SM2 signature computations on 64 bit ARM platforms. A remote attacker can recover the private key and decrypt data.
3) Out-of-bounds read (CVE-ID: CVE-2025-9232)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in OpenSSL HTTP client API functions if the "no_proxy" environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
4) Resource exhaustion (CVE-ID: CVE-2025-59375)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.
5) Use of insufficiently random values (CVE-ID: CVE-2025-10148)
The vulnerability allows a remote attacker to perform cache poisoning.
The vulnerability exists due to the websocket code does not update the 32 bit mask pattern for each new outgoing frame as the specification says.Instead it used a fixed mask that persisted and was used throughout the entire connection. As a result, a malicious server can induce traffic between the two communicating parties that can be interpreted by an involved proxy and poison cached content.
6) Out-of-bounds read (CVE-ID: CVE-2025-9086)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition when reading cookie path. A malicious server can set a specially crafted cookie path using the secure keyword, trigger an out-of-bounds read error and crash the application.
7) NULL pointer dereference (CVE-ID: CVE-2025-8114)
The vulnerability allows a remote attack to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when calculating the session ID during the key exchange (KEX) process. A remote attacker can trick the victim into connecting to a malicious SSH server and crash the client app.
8) Use-after-free (CVE-ID: CVE-2025-49794)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error within the xmlSchematronGetNode() function when processing XPath expressions in Schematron schema elements schematron.c. A remote attacker can pass specially crafted XML input to the application and perform a denial of service (DoS) attack.
9) Not qualyfied (CVE-ID: CVE-2025-49795)
This issue does not qualify for vulnerability definition as it is present in the dev code that was never released outside of the dev tree.
The original description:
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the xmlSchematronFormatReport() function when processing incorrect XPath expressions in Schematron schema reports. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
10) Type Confusion (CVE-ID: CVE-2025-49796)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a type confusion error within the xmlSchematronFormatReport() function when processing sch:name elements in schematron.c. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and crash the application.
11) Stack-based buffer overflow (CVE-ID: CVE-2025-6170)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in xmllint Shell - shell.c. A remote attacker can pass specially crafted input to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) Integer overflow (CVE-ID: CVE-2025-6021)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the xmlBuildQName() function in tree.c . A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.