- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3968-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
November 28, 2024                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : netatalk
Version        : 3.1.12~ds-8+deb11u2
CVE ID         : CVE-2022-22995 CVE-2024-38439 CVE-2024-38440
                  CVE-2024-38441


Several issues have been found in netatalk, an Apple Filing Protocol 
service. Three issues are related to off-by-one errorrs and resultant 
heap-based buffer overflow. One issue is related to primitives offered by 
SMB and AFP, which might allow an attacker to write arbitrary files and 
eventually execute arbitrary code.


For Debian 11 bullseye, these problems have been fixed in version
3.1.12~ds-8+deb11u2.

We recommend that you upgrade your netatalk packages.

For the detailed security status of netatalk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/netatalk

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS