Debian alert DLA-4707-1 (gsasl)

From:
             
 
Carlos Henrique Lima Melara <charles@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4707-1] gsasl security update
Date:
             
 
Thu, 30 Jul 2026 23:43:01 -0300
Message-ID:
             
 
<amwLcqx4IYHSVHMO@fw13.lan>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4707-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/          Carlos Henrique Lima Melara
July 30, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : gsasl
Version        : 1.10.0-4+deb11u3 2.2.0-1+deb12u2
CVE ID         : CVE-2026-56968

It was discovered that missing input sanitising in the NTLM client of the
GNU SASL library could result in memory disclosure.

For Debian 11 bullseye, this problem has been fixed in version
1.10.0-4+deb11u3.

For Debian 12 bookworm, this problem has been fixed in version
2.2.0-1+deb12u2.

We recommend that you upgrade your gsasl packages.

For the detailed security status of gsasl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gsasl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEECgzx8d8+AINglLHJt4M9ggJ8mQsFAmpsC7IACgkQt4M9ggJ8
mQscdw/+MWsoohrQtWzNZbHQJ5M7mBhuXbXAaz1k28FP1CpAulNpyS2ojJG9eq01
Fj/T7cLmqQaZrtuJ5IBBW2+8nKxan/X5AC1kXT6gngNFUVLwqGlBPQ5d9UnnoawW
TkzXYPta9/PUtnz6o3LjvnXDGFFJqi0H6tOCInrqDKzKkDF07qzB4apNcHaUbc4P
QLETrZAufIjqh3TribtI97mQ60NdF2xAx1l1faaJA+SYLqR1or/bSFLj2seoxbJJ
vZl/NaoN+Mvz+xSNNx7gnp0+1xTm1SCJ0IhDQrlmTgcVDywaCH6iXmVOvwYPzU/w
Jy98pQD0NGHuAtrc9xgrMW2POgD1PkftcHUmyjIlOFywhgk0SWNknzUubEWNmaMR
Idmyd6tO8bN3+/mdvxLSExZfeyOprNXGE8urppnD1BZuTwsBaz/yQ61J+JAcKh60
mv4oTcYhME+c/zdpvZZhxtP9h/afoGZwo4MuYikigztVqZ/YwIljUJUJMy9vn6Lo
/2sCIWJidxvTROBovF4CRao1hTm6pLPiH0DnkRVowIRUdu3iAVeltTYVVZSBfIgC
CGUoOkjKca5qx7KKo/6ro9PLd4eEjjEd5yOVdb9FBwcxCFT57BpvPpbqrnIwAuoy
zmHmr/ieWEEeIzMAekQZlO71Y+PWR3V69c5kXmkMEzvTIts0CF4=
=veyJ
-----END PGP SIGNATURE-----