https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 10:31:00 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-45699 <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de-&gt;d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.</p> <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de-&gt;d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.</p> https://db.gcve.eu/vuln/fkie_cve-2026-45699 https://db.gcve.eu/vuln/ubuntu-cve-2026-45699 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netatalk, Ubuntu:Pro:16.04:LTS: netatalk, Ubuntu:Pro:18.04:LTS: netatalk, Ubuntu:Pro:20.04:LTS: netatalk, Ubuntu:Pro:22.04:LTS: netatalk, Ubuntu:Pro:24.04:LTS: netatalk, Ubuntu:25.10: netatalk, Ubuntu:26.04:LTS: netatalk</p> <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de-&gt;d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netatalk, Ubuntu:Pro:16.04:LTS: netatalk, Ubuntu:Pro:18.04:LTS: netatalk, Ubuntu:Pro:20.04:LTS: netatalk, Ubuntu:Pro:22.04:LTS: netatalk, Ubuntu:Pro:24.04:LTS: netatalk, Ubuntu:25.10: netatalk, Ubuntu:26.04:LTS: netatalk</p> <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de-&gt;d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-45699