Public bug reported: A new release of cifs-utils is available for merging from Debian.
Ubuntu: 2:7.4-1ubuntu3 Debian Unstable: 2:7.9-1 ### New Debian Changes ### cifs-utils (2:7.9-1) unstable; urgency=medium * new upstream security release (closes: CVE-2026-104715): - mount.cifs: validate username derived from the passwd database - mount.cifs: reject option delimiters in username and domain -- Michael Tokarev <[email protected]> Fri, 16 Oct 2026 07:35:28 +0300 cifs-utils (2:7.8-1) unstable; urgency=medium * new upstream release (7.8) Closes: #1140422, CVE-2026-12505 * d/control: Remove Priority: optional and Rules-Requires-Root: no * d/control: Standards-Version: 4.7.4 (no changes) -- Michael Tokarev <[email protected]> Sat, 26 Sep 2026 16:22:18 +0300 ### Old Ubuntu Delta ### cifs-utils (2:7.4-1ubuntu3) stonking; urgency=medium * SECURITY UPDATE: insecure user information lookup - debian/patches/CVE-2026-12505.patch: cifs.upcall: remove getpwuid() dependency in cifs.upcall.c. - debian/patches/CVE-2026-12505-2.patch: cifs.upcall: fix compiler warning with -Wvla in cifs.upcall.c. - debian/patches/CVE-2026-12505-3.patch: cifs.upcall: fix regression with krb5 + creduid in cifs.upcall.c. - CVE-2026-12505 -- Marc Deslauriers <[email protected]> Fri, 10 Jul 2026 13:41:27 -0400 cifs-utils (2:7.4-1ubuntu2) stonking; urgency=medium * SECURITY REGRESSION: regression with kerberos mounts (LP: #2159053) - debian/patches/CVE-2026-12505.patch: disable until a fix is available from cifs-utils developers. -- Marc Deslauriers <[email protected]> Fri, 03 Jul 2026 14:27:34 -0400 cifs-utils (2:7.4-1ubuntu1) stonking; urgency=medium * SECURITY UPDATE: insecure user information lookup - debian/patches/CVE-2026-12505.patch: cifs.upcall: remove getpwuid() dependency in cifs.upcall.c. - CVE-2026-12505 -- Marc Deslauriers <[email protected]> Tue, 30 Jun 2026 16:20:21 -0400 cifs-utils (2:7.4-1build1) resolute; urgency=medium * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257) -- Sebastien Bacher <[email protected]> Mon, 02 Feb 2026 21:23:16 +0100 ** Affects: cifs-utils (Ubuntu) Importance: Wishlist Status: New ** Tags: dcr-merge ** Changed in: cifs-utils (Ubuntu) Importance: Undecided => Wishlist ** Changed in: cifs-utils (Ubuntu) Milestone: None => ubuntu-26.11 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171198 Title: Merge cifs-utils 2:7.9-1 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cifs-utils/+bug/2171198/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
