Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.

The consumelabels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.

Hugo Dias of the Synchron Security Labs discovered a remote denial of service flaw in the avahi daemon. A crafted multicast DNS (mDNS) packet with source port 0 can trigger assertion in originatesfromlocallegacyunicastsocket() function in avahi-core/server.c -- assert(port > 0); -- causing the daemon to call abort() and exit unexpectedly.

Scope of this attack is usually limited to a single LAN.