https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:43:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354551 EUVD-2026-354551 https://cve.radiocsirt.org/vuln/euvd-2026-354551 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45698 <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.</p> <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45698 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45698 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netatalk, Ubuntu:Pro:16.04:LTS: netatalk, Ubuntu:Pro:18.04:LTS: netatalk, Ubuntu:Pro:20.04:LTS: netatalk, Ubuntu:Pro:22.04:LTS: netatalk, Ubuntu:Pro:24.04:LTS: netatalk, Ubuntu:25.10: netatalk, Ubuntu:26.04:LTS: netatalk</p> <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netatalk, Ubuntu:Pro:16.04:LTS: netatalk, Ubuntu:Pro:18.04:LTS: netatalk, Ubuntu:Pro:20.04:LTS: netatalk, Ubuntu:Pro:22.04:LTS: netatalk, Ubuntu:Pro:24.04:LTS: netatalk, Ubuntu:25.10: netatalk, Ubuntu:26.04:LTS: netatalk</p> <p>Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk&#39;s afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. deletedir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library&#39;s renameat() cannot handle. The function attempts to prevent buffer overflows by tracking available space in a size_t remain variable. However, the arithmetic used to compute remain results in an unsigned integer underflow, causing the variable to become SIZE_MAX. Because of this, the subsequent boundary check always evaluates as safe, allowing an unbounded strcpy() operation to copy attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45698