Release date:
2026-10-23 21:29:45 UTC
Description:
* SECURITY UPDATE: mount option injection via credentials file values
- debian/patches/CVE-2026-104715.patch: in mount.cifs.c, reject
username= and domain= values from a credentials file, and the USER
environment variable or passwd login name, that contain an option
delimiter (comma, equals, CR or LF) before they are assembled into
the kernel mount option string.
- CVE-2026-104715
Updated packages:
-
cifs-utils_6.8-2+deb10u1+tuxcare.els1_amd64.deb
sha:a63ea6f695b9142a25ecc5889fed33c2de4398c4
-
cifs-utils_6.8-2+deb10u1+tuxcare.els1_arm64.deb
sha:2d09ee62fe4d4c49991c4512a9a809c46fd001dd
-
cifs-utils_6.8-2+deb10u1+tuxcare.els1_armel.deb
sha:d2411b3b083fa8919184d2e658c2794db9fd0fdf
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
