Summary
Arjun Basnet discovered that Netatalk incorrectly sanitized user input in
its MySQL CNID backend. A remote authenticated attacker could possibly
use this issue to conduct SQL injection attacks. (CVE-2026-44047)
Arjun Basnet discovered that Netatalk incorrectly handled UCS-2 character
set conversion. A remote authenticated attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2026-44048)
Arjun Basnet discovered that Netatalk improperly handled null termination
during character set conversion. A remote authenticated attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-44049)
Arjun Basnet discovered that the Netatalk CNID daemon improperly handled
request-supplied name lengths. A local attacker could possibly use this
issue to cause a denial of service or execute arbitrary code with
escalated privileges. (CVE-2026-44050)
Arjun Basnet discovered that Netatalk improperly resolved symbolic links.
A remote authenticated attacker could possibly use this issue to read or
overwrite arbitrary files on the system. (CVE-2026-44051)
Arjun Basnet discovered that Netatalk incorrectly handled logging when
performing LDAP simple-bind operations. A local attacker could possibly
use this issue to obtain sensitive information. (CVE-2026-44052)
Arjun Basnet discovered that Netatalk contained an operator precedence
logic error when processing input. A remote authenticated attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-44055)
Arjun Basnet discovered that Netatalk incorrectly handled DSI write
requests. A remote unauthenticated attacker could possibly use this
issue to cause a denial of service. (CVE-2026-44060)
Arjun Basnet discovered that Netatalk incorrectly validated output
lengths when converting character sets. A remote authenticated attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-44062)
Arjun Basnet discovered that Netatalk incorrectly handled length
validation when parsing certain session identifiers. An attacker could
possibly use this issue to cause a denial of service. (CVE-2026-44064)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | netatalk | 4.2.3~ds-2.1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | netatalk | 2.2.2-1ubuntu2.2+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | netatalk | 2.2.5-1ubuntu0.2+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | netatalk | 2.2.6-1ubuntu0.18.04.2+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | netatalk | 3.1.12~ds-4ubuntu0.20.04.4+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | netatalk | 3.1.12~ds-9ubuntu0.22.04.4+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | netatalk | 3.1.18~ds-1ubuntu0.1~esm2 |
Vulnerabilities 10
-
Critical 9.9
Heap buffer overflow in CNID daemon comm_rcv()
A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.
-
High 8.8
SQL injection in MySQL CNID backend
An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service.
-
High 8.8
Stack buffer overflow via UCS-2 type confusion in convert_charset()
A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.
-
High 8.1
Arbitrary file read via attacker-controlled symlink creation
An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files via attacker-controlled symlink creation.
-
High 7.5
Out-of-bounds write in convert_charset() null termination
An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.
-
High 7.5
LDAP simple-bind password exposure in log output
Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.
-
High 7.5
Bitwise OR logic bug enables shell injection
A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.
-
High 7.5
Integer underflow in dsi_writeinit() leads to denial of service
An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.
-
High 7.5
Missing o_len bounds check in pull_charset_flags()
A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.
-
High 7.1
ASP session ID out-of-bounds access
An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.
References
-
report
https://ubuntu.com/security/CVE-2026-44047
-
report
https://ubuntu.com/security/CVE-2026-44048
-
report
https://ubuntu.com/security/CVE-2026-44049
-
report
https://ubuntu.com/security/CVE-2026-44050
-
report
https://ubuntu.com/security/CVE-2026-44051
-
report
https://ubuntu.com/security/CVE-2026-44052
-
report
https://ubuntu.com/security/CVE-2026-44055
-
report
https://ubuntu.com/security/CVE-2026-44060
-
report
https://ubuntu.com/security/CVE-2026-44062
-
report
https://ubuntu.com/security/CVE-2026-44064