Netatalk versions 1.5.0 through 4.4.2 use DES-ECB for authentication, which is vulnerable to a timing side channel attack. This vulnerability allows a remote attacker to recover authentication credentials by analyzing timing differences during the authentication process. The CVSS score is 5.9, indicating a medium severity level. The affected versions include specific Ubuntu package versions of Netatalk 2.2.2, 2.2.5, and 2.2.6. No information about available patches or vendor advisories is provided.
Netatalk versions 2.1.0 through 4.4.2 contain an LDAP injection vulnerability that allows a remote authenticated attacker to manipulate LDAP queries. This manipulation can lead to limited information disclosure or modification of LDAP entries. The vulnerability has a medium severity with a CVSS score of 4.2.
An off-by-two error in the lp_write() function of papd in Netatalk versions 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption by sending crafted print data. The vulnerability has a medium severity with a CVSS score of 4.2. It affects multiple specific Ubuntu package versions of Netatalk 2.2.x. No information about available patches is provided.
Netatalk versions 2.1.0 through 4.4.2 contain a heap over-read vulnerability in the extended attribute (EA) header parsing. This flaw allows a remote authenticated attacker to obtain limited information or cause a minor service disruption by sending crafted EA data. The vulnerability has a medium severity with a CVSS score of 4.2.
An integer underflow vulnerability exists in the volxlate function of Netatalk versions 3.0.0 through 4.4.2. This flaw allows a local privileged user to obtain limited information, modify limited data, or cause a minor service disruption by providing crafted volume translation input. The vulnerability has a medium severity rating with a CVSS score of 3.9.
An unbounded memory reallocation vulnerability exists in the charset conversion code of Netatalk versions 2.0.0 through 4.4.2. This flaw allows a remote authenticated attacker to cause a minor denial of service by sending crafted character conversion requests. The vulnerability has a medium severity rating with a CVSS score of 3.1.
Netatalk versions 2.2.1 through 4.4.2 contain a vulnerability where the software calls system() after a failed chdir() without properly handling the error. This flaw allows a local privileged user to execute unintended commands or cause minor service disruption under specific conditions. The vulnerability has a medium severity rating and a CVSS score of 3.0.
Netatalk versions 1.5.0 through 4.4.2 contain a vulnerability in their authentication modules where the return value of the seteuid() system call is not checked. This flaw may allow a remote authenticated attacker to retain elevated privileges if an error occurs during the seteuid() call. The vulnerability has a medium severity rating with a CVSS score of 5.0.
Netatalk versions 3.1.0 through 4.4.2 contain a vulnerability due to insufficient sanitization of volume paths. This flaw allows a local privileged user to inject operating system commands and execute arbitrary code by crafting a malicious volume path. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. It affects specific Netatalk package versions primarily distributed on Ubuntu systems. There is no explicit patch or remediation information provided in the input data.
A vulnerability in rust-sequoia-openpgp where missing key flags are incorrectly implied from the key type. This affects multiple specific versions of the rust-sequoia-openpgp library.
CVE-2026-46626 is a medium severity vulnerability affecting multiple specific versions of the Symfony framework. The exact nature and technical details of the vulnerability are not provided. There is no CVSS score or detailed description available, and no known exploits in the wild have been reported. The affected versions include various Ubuntu-packaged releases of Symfony versions 2.7.x through 7.4.x. No patch or remediation information is provided, and the vulnerability does not pertain to a cloud service.
A security update has been issued for Netatalk addressing CVE-2026-45354. The vulnerability affects multiple specific versions of Netatalk, primarily those in the 2.2.x series as listed. The severity of this vulnerability is assessed as medium. No detailed technical information or CVSS score is provided. There are no known exploits in the wild at this time.
A security update has been issued for Netatalk addressing CVE-2026-45355. The affected versions include multiple specific builds of Netatalk 2.2.2 through 2.2.6 on Ubuntu platforms. The vulnerability is assessed as medium severity. No CVSS score or detailed technical information is provided. There are no known exploits in the wild. The update is not related to a cloud service, and no patch links or vendor advisory details are included in the provided data.
A security update has been issued for Netatalk addressing CVE-2026-45356. The vulnerability affects multiple specific versions of Netatalk, primarily those packaged for various Ubuntu releases. No detailed technical information or CVSS score is provided. The severity is assessed as medium based on available data.
A vulnerability in rust-openssl versions from 0.10.0 up to but not including 0.10.79 causes incorrect sizing of output buffers when using AES key-wrap-with-padding ciphers. This leads to OpenSSL writing up to 7 bytes beyond the end of the buffer, resulting in heap corruption that can be influenced by an attacker. The issue is fixed in version 0.10.79.
A vulnerability in gittuf prior to version 0.14.0 allows an attacker with push access to the Reference State Log (RSL) to roll back the current policy to any previous policy trusted by the current root keys. This rollback occurs because gittuf validates new policies by checking signatures against the current root keys, but an attacker can reference an older trusted policy in the RSL, causing the system to revert to that state. This issue is fixed in version 0.14.0.
Netty versions prior to 4.2.13.Final and 4.1.133.Final have a vulnerability in their DNS codec where RFC 1035 domain name constraints are not enforced during encoding or decoding. This flaw allows malicious DNS responses or user-influenced hostnames to exploit the codec. The issue is fixed in versions 4.2.13.Final and 4.1.133.Final.
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain a vulnerability in the chunk size parser where an integer overflow occurs silently. This flaw enables request smuggling attacks. The issue has been fixed in versions 4.2.13.Final and 4.1.133.Final.
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain a vulnerability where malformed Transfer-Encoding headers are incorrectly parsed, enabling HTTP request smuggling attacks. This issue has been fixed in versions 4.2.13.Final and 4.1.133.Final. The vulnerability has a CVSS score of 7.5, indicating a medium severity level. No known exploits are reported in the wild. A patch is available from the vendor.
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain a vulnerability in the RedisEncoder component where user-controlled string content is written directly to the network output buffer without sanitizing CRLF characters. This allows an attacker controlling Redis message content to inject arbitrary Redis commands or forge responses. The issue is fixed in versions 4.2.13.Final and 4.1.133.Final.