PatchTheCVEnetatalk vulnerabilities and fixes
Recent CVEs affecting netatalk, with upgrade or downgrade steps. 4 tracked.
netatalk has 4 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2024-06-16. Highest priority: CVE-2023-42464 (score 65/100).
- CVE-2024-38441 CRITICAL 9.8 UPGRADE Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf
- CVE-2024-38440 HIGH 7.5 UPGRADE Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation viola
- CVE-2024-38439 CRITICAL 9.8 UPGRADE Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf
- CVE-2023-42464 CRITICAL 9.8 UPGRADE MITIGATE A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.1
FAQ
How do I fix netatalk vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is netatalk being exploited right now?
None of the tracked netatalk CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which netatalk CVE should I patch first?
CVE-2023-42464 currently ranks highest (65/100): A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.1.