CVE-2007-6282
CVE-2007-6282 is a high-severity vulnerability in Redhat Enterprise Linux with a CVSS 2.0 base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-16.
Key facts
- Severity: High (CVSS 2.0 base score 7.1)
- EPSS exploit prediction: 2% (82nd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-16
- Affected product: Redhat Enterprise Linux
- Published:
- Last modified:
Description
The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV.
Frequently asked questions
- What is CVE-2007-6282?
- The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV.
- How severe is CVE-2007-6282?
- CVE-2007-6282 has a CVSS 2.0 base score of 7.1, rated high severity.
- Is CVE-2007-6282 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2007-6282?
- CVE-2007-6282 primarily affects Redhat Enterprise Linux. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2007-6282?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2007-6282 published?
- CVE-2007-6282 was published on 2008-05-08 and last updated on 2026-06-16.
References
- http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html
- http://marc.info/?l=linux-netdev&m=120372380411259&w=2
- http://secunia.com/advisories/30112
- http://secunia.com/advisories/30294
- http://secunia.com/advisories/30818
- http://secunia.com/advisories/30890
- http://secunia.com/advisories/30962
- http://secunia.com/advisories/31107
- http://secunia.com/advisories/31551
- http://secunia.com/advisories/31628
- http://www.debian.org/security/2008/dsa-1630
- http://www.redhat.com/support/errata/RHSA-2008-0237.html
- http://www.redhat.com/support/errata/RHSA-2008-0275.html
- http://www.redhat.com/support/errata/RHSA-2008-0585.html
- http://www.securityfocus.com/bid/29081
- http://www.ubuntu.com/usn/usn-625-1
- https://bugzilla.redhat.com/show_bug.cgi?id=404291
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42276
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10549
Affected products (4)
- cpe:2.3:o:redhat:enterprise_linux:as_4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:es_4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:ws_4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:4:*:*:*:*:*:*:*
More vulnerabilities in Redhat Enterprise Linux
- CVE-2015-0240 — Critical (CVSS 10.0): The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before…
- CVE-2015-0408 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect…
- CVE-2014-6601 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality,…
- CVE-2009-0846 — Critical (CVSS 10.0): The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT…
- CVE-2007-1007 — Critical (CVSS 10.0): Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service…
- CVE-2006-6235 — Critical (CVSS 10.0): A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows…
All CVEs affecting Redhat Enterprise Linux →
Other CWE-16 vulnerabilities
- CVE-2013-4316 — Critical (CVSS 10.0): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack…
- CVE-2013-1221 — Critical (CVSS 10.0): The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not…
- CVE-2011-4501 — Critical (CVSS 10.0): The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg,…
- CVE-2010-4586 — Critical (CVSS 10.0): The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and…
- CVE-2010-2977 — Critical (CVSS 10.0): Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not properly implement TLS and SSL, which has…
- CVE-2010-2276 — Critical (CVSS 10.0): The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2,…