Description
Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mc | 1:4.6.0-4.6.1-pre1-1 | — |
| Debian 13 | mc | 1:4.6.0-4.6.1-pre1-1 | — |
| Debian 12 | mc | 1:4.6.0-4.6.1-pre1-1 | — |
| Debian 3.0 | mc | 4.5.55-1.2woody2 | DSA-424 |
Advisories 1
- DSA-424 mc - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2004:034 vendor-advisory
- 10772 third-party-advisory
- FLSA:1224 vendor-advisory
- midnight-commander-vfssresolvesymlink-bo(13247) vdb-entry
- 10716 third-party-advisory
- 20040405 [OpenPKG-SA-2004.009] OpenPKG Security Advisory (mc) mailing-list
- FEDORA-2004-058 vendor-advisory
- 10645 third-party-advisory
- MDKSA-2004:007 vendor-advisory
- 10823 third-party-advisory
- 20030919 uninitialized buffer in midnight commander mailing-list
- CLA-2004:833 vendor-advisory
- 8658 vdb-entry
- DSA-424 vendor-advisory
- RHSA-2004:035 vendor-advisory
- 10685 third-party-advisory
- 11219 third-party-advisory
- oval:org.mitre.oval:def:822 vdb-entry signature
- 9833 third-party-advisory
- 11296 third-party-advisory
- 11268 third-party-advisory
- 11262 third-party-advisory
- GLSA-200403-09 vendor-advisory