Public bug reported: A new release of freeipmi is available for merging from Debian.
Ubuntu: 1.6.18-1ubuntu1 Debian Unstable: 1.6.20-1 ### New Debian Changes ### freeipmi (1.6.20-1) unstable; urgency=medium * New upstream version 1.6.20 * d/patches: refresh -- Fabio Fantoni <[email protected]> Sat, 10 Oct 2026 20:56:22 +0200 freeipmi (1.6.19-1) unstable; urgency=medium * New upstream version 1.6.19 - Fix stack-based buffer overflows and over-reads on untrusted BMC responses: CVE-2026-85504, CVE-2026-85505, CVE-2026-85506, CVE-2026-85507, CVE-2026-85508, CVE-2026-85509 (Closes: #1146649) * d/patches: remove one patch applied upstream and refresh the other * Drop kfreebsd support * Drop the now unused dh-exec * d/*.maintscript: drop the obsolete conffile and doc dir transitions * d/control: drop the obsolete Breaks/Replaces * d/TODO: drop the stale packaging notes * d/copyright: update the debian/* stanza -- Fabio Fantoni <[email protected]> Sat, 05 Sep 2026 20:18:24 +0200 ### Old Ubuntu Delta ### freeipmi (1.6.18-1ubuntu1) stonking; urgency=medium * SECURITY UPDATE: stack overflow in libfreeipmi Fujitsu SEL parsing - debian/patches/CVE-2026-85504.patch: reject short and oversized responses and bound each text chunk in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c. - CVE-2026-85504 * SECURITY UPDATE: stack over-read in ipmi-oem Fujitsu SEL long-text - debian/patches/CVE-2026-85505.patch: copy only the remaining data_length bytes in ipmi-oem/ipmi-oem-fujitsu.c. - CVE-2026-85505 * SECURITY UPDATE: stack overflow in ipmi-oem Dell idrac-info - debian/patches/CVE-2026-85506.patch: check idrac_info buffer size before copying in ipmi-oem/ipmi-oem-dell.c. - CVE-2026-85506 * SECURITY UPDATE: stack overflow in ipmi-oem Dell cmc-info - debian/patches/CVE-2026-85507.patch: check cmc_info buffer size before copying in ipmi-oem/ipmi-oem-dell.c. - CVE-2026-85507 * SECURITY UPDATE: stack overflow in ipmi-oem Dell cmc-ipv6-info - debian/patches/CVE-2026-85508.patch: check cmc_ipv6_info buffer size before copying in ipmi-oem/ipmi-oem-dell.c. - CVE-2026-85508 * SECURITY UPDATE: stack overflow in libfreeipmi FRU reading - debian/patches/CVE-2026-85509.patch: reject a count_returned larger than requested in libfreeipmi/fru/ipmi-fru.c. - CVE-2026-85509 -- Charles Cochran <[email protected]> Fri, 25 Sep 2026 15:46:10 -0400 ** Affects: freeipmi (Ubuntu) Importance: Wishlist Status: New ** Tags: needs-merge upgrade-software-version ** Changed in: freeipmi (Ubuntu) Importance: Undecided => Wishlist ** Changed in: freeipmi (Ubuntu) Milestone: None => ubuntu-26.11 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171125 Title: Merge freeipmi 1.6.20-1 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/freeipmi/+bug/2171125/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
