Summary: | <net-fs/cifs-utils-6.15: multiple vulnerabilities | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | John Helmert III <ajak> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | samba |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | B1 [glsa+] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 858137 | ||
Bug Blocks: |
Description
John Helmert III
2022-05-02 20:16:44 UTC
(In reply to John Helmert III from comment #0) > CVE-2022-27239 > (https://github.com/piastry/cifs-utils/pull/7/commits/ > 955fb147e97a6a74e1aaa65766de91e2c1479765): > https://bugzilla.samba.org/show_bug.cgi?id=15025 > https://bugzilla.suse.com/show_bug.cgi?id=1197216 > > In cifs-utils through 6.14, a stack-based buffer overflow when parsing the > mount.cifs ip= command-line argument could lead to local attackers gaining > root privileges. > > Please bump to 6.14. There's also CVE-2022-29869: https://nvd.nist.gov/vuln/detail/CVE-2022-29869 https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379 Please bump to 6.15 (latest). Indeed, thanks! Not sure how I missed that one. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5 commit c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5 Author: Sayan Chowdhury <schowdhury@microsoft.com> AuthorDate: 2022-06-17 10:07:58 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-06-24 05:26:08 +0000 net-fs/cifs-utils: version bump to 6.15 Bug: https://bugs.gentoo.org/842234 Acked-by: David Seifert <soap@gentoo.org> Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com> Closes: https://github.com/gentoo/gentoo/pull/25937 Signed-off-by: Sam James <sam@gentoo.org> net-fs/cifs-utils/Manifest | 1 + net-fs/cifs-utils/cifs-utils-6.15.ebuild | 138 +++++++++++++++++++++++++++++++ 2 files changed, 139 insertions(+) commit ede0964749963f076247c21fbf1284463f6a51c4 Author: Sam James <sam@gentoo.org> Date: Fri Sep 30 04:03:21 2022 +0100 net-fs/cifs-utils: drop 6.13-r1 The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=c99aedd76d916c7d282282c93b43664f35bccf07 commit c99aedd76d916c7d282282c93b43664f35bccf07 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2023-11-24 14:19:44 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2023-11-24 14:20:11 +0000 [ GLSA 202311-05 ] LinuxCIFS utils: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/842234 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202311-05.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) |