Debian alert DLA-4689-1 (libnfs)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4689-1] libnfs security update
Date:
             
 
Sun, 19 Jul 2026 07:19:32 +0000
Message-ID:
             
 
<89bfe91f-d0d3-e782-e364-e522bd51beed@alteholz.de>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4689-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
July 19, 2026                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libnfs
Version        : 4.0.0-1+deb11u1 4.0.0-1+deb12u1
CVE ID         : CVE-2026-53689
Debian Bug     : 1139731


An issue has been found in libnfs, am NFS client library.
The issue is related to to a missing validation of a string size that 
might lead to an integer overflow.


For Debian 11 bullseye, this problem has been fixed in version
4.0.0-1+deb11u1.

For Debian 12 bookworm, this problem has been fixed in version
4.0.0-1+deb12u1.

We recommend that you upgrade your libnfs packages.

For the detailed security status of libnfs please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libnfs

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmpceoVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEecmxAAslpqkdNUtJRwW9xVcKk4GZC6LUD8OsM0A4LdrOrhbrO/Rh4YYnvlC8T1
TwcFRu/eVleeATxa/GjzMgypEOyXyZK4pJLE160LFzBoIlwmEK5/HFKhPHxeF6xc
ZZu7qULOE9G/j5AIF7Kjb51zTnBtrQivn7u3ymFGWFqZGJYBkQhi9b5kBFUuy5y/
vyS9lIaCRA1e3aECrKRf+W+Q3w5LYXG8oCEzENKEF16CbxLL4vcWJuZXcr2Vf7W5
eFxc1N08k8+/240fTkqrpTbAD57q61opw390Yaqms33NdJVrUhZ+yAa1cgXTMuFM
DviYGiQb1NMibhDn9jLRaM4ZHNe+5fHV6lLBZVxm1636Ehwp/dQJu1VkwJp1F7tf
/oIUSnpObE4pCsPnUviVjhiQE0U3sCp00yazxeZsDhCq5rEXKEQZosUAmYlQU7/T
wBJA/zHT1iinJeRF4vOKG/GP5IRwOh406Sv64ig8OFjbZ9THEaMd5rhmjoJyb0Mx
MsuysTS1EuNULYSSXpfwVdPQJ/PVtjmClTHFTrmk/gY7TQC/pUBDYslbq/K2AAhb
HDm1XkaeiVfB0KcrYOvmJ9uNd5GQWWaL3e3yxziVyvv1c0jFd93DV4mr5pmXQ1Bz
eL5vnkMWdvtpMJrva/HqGVuM+JMyeQepjVG+rrwTxi+mKzsVr2I=
=swVV
-----END PGP SIGNATURE-----