Skip to content

Import upstream patches to fix CVE-2025-57632

Matheus Polkorny requested to merge polkorny/libsmb2:debian/master into debian/master
  • Import upstream patches to fix CVE-2025-57632 (Closes: #1116446)
    • When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2_MAX_VECTORS=256)
  • d/control: Mark libsmb2-6 and libsmb2-dev as Multi-Arch: same
  • d/patches:
    • CVE-2025-57632-pt1.patch: New patch
    • CVE-2025-57632-pt2.patch: Backport and Refresh patch
    • CVE-2025-57632-pt3.patch: Backport and Refresh patch
    • CVE-2025-57632-pt4.patch: Backport and Refresh patch
  • d/watch: Update to version 5

Merge request reports

Loading