Debian alert DLA-3009-1 (cifs-utils)

From:
             
 
Utkarsh Gupta <guptautkarsh2102@gmail.com>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3009-1] cifs-utils security update
Date:
             
 
Mon, 16 May 2022 19:14:11 +0530
Message-ID:
             
 
 <CAPP0f97YAuJLxa3zzBPzX_HTAC0K5seoJK+qRLtTMbJ3S-Vocg@mail.gmail.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -----------------------------------------------------------------------
Debian LTS Advisory DLA-3009-1              debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Utkarsh Gupta
May 16, 2022                                https://wiki.debian.org/LTS
- -----------------------------------------------------------------------

Package        : cifs-utils
Version        : 2:6.7-1+deb9u1
CVE ID         : CVE-2022-27239 CVE-2022-29869
Debian Bug     : 1010818

A couple of vulnerabilities were found in src:cifs-utils, a Common
Internet File System utilities, and are as follows:

CVE-2022-27239

    In cifs-utils, a stack-based buffer overflow when parsing the
    mount.cifs ip= command-line argument could lead to local attackers
    gaining root privileges.

CVE-2022-29869

    cifs-utils, with verbose logging, can cause an information leak
    when a file contains = (equal sign) characters but is not a valid
    credentials file.

For Debian 9 stretch, these problems have been fixed in version
2:6.7-1+deb9u1.

We recommend that you upgrade your cifs-utils packages.

For the detailed security status of cifs-utils please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cifs-utils

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmKCVN0ACgkQgj6WdgbD
S5a2MxAAp9n/LKNVZMYms5IwTZ2Grb00VxJG7lR1LuKpL15t9FcQT606+d6uE+Wd
nRibHy3ie81zDQJxVH1Kc+1SdCe/H2Rddqa/+bZ6z6TnpvLhZx0cwwzxE5PrAWzn
0HS8KYrXsj34L982OoNGDbSbdoB17edRWRxw/KpTcsij3gxZeXNIepe0m4i6OOUn
K+IB1lIWFJc4E7cYSlxHUKOPcCf5L1uD9mZ/2mi3xVaIEJD20HoJ/Ec7bS6uR2CY
doYzky3YS9slVZLZPmblt+KXmMn9kzU0TDwF7+Z3G4iaedwv62TUkfYKtCSWeMuB
89E1GYK1gyslFE88lI861qArtC9VByKyggnddUwK+ME1p1bIv73tl/UDT2a1pTKJ
3bgiPKpIGicyuqe3/SKTO6cXW1FzvAE18pKC8YGj3B7qaZZexcAt2++klwyG5jEZ
MrgwTP9uIzT3/P9nXsov5x9K0P0jfVgSF0Fdg07DFesvEnkpXKEiy3saXJKI6Zd8
QgKiEp2zsC0Iuf6gDWRIg5Fgrur+ao8jcLay9BW+6L7ajUlpGcrheOp0mr0mfsB+
kak58JxVfPtH4I7e2bxOn+xctbu1NCHTP6LqxzVvBUsiIA9o1oXLAroA4co5mrzB
BkLt4o8WKIF+RPbVaiIOsuW4/+k5d55Nr19C/os3aGnWns+Br1o=
=8v4w
-----END PGP SIGNATURE-----