[From nobody Wed May 20 07:21:13 2026 Received: (at submit) by bugs.debian.org; 19 May 2026 21:19:49 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-24.5 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,BODY_INCLUDES_SEVERITY,DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,HAS_PACKAGE,HTML_MESSAGE,PGPSIGNATURE, RCVD_IN_DNSWL_LOW,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 101; neutral, 19; spammy, 1. spammytokens:0.941-+--H*r:bugs.debian.org hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug, 0.000-+--H*Ad:N*Tracking Return-path: <daniel@mindani.net> Received: from mail-4317.protonmail.ch ([185.70.43.17]:23401) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <daniel@mindani.net>) id 1wPRqv-008fNj-2W for submit@bugs.debian.org; Tue, 19 May 2026 21:19:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mindani.net; s=protonmail3; t=1779225587; x=1779484787; bh=qbqlWsJANWoX5z61JdLPk9fka8gUTKqM4j96YtCgSnw=; h=Date:To:From:Subject:Message-ID:Feedback-ID:From:To:Cc:Date: Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=RQuLTwZbapVTNxDF8DSWH7OEnTbogWLNXF+M5GgrFc5zZorbu/C85+mOA7yIgpiwp bpcYUmr3KtyRssBYQxv4Q4ewB7Z3xz/YFuKPhMYGmiU5h+4zuUHpPDgtQNwwW4EZvm VL83lUzjySs+Keb5DT+h33EFsG1+ApxSh2F7/uVO/OzNb0DJ7WHvYp8QVNV1orWpWF eBsF1RTIbDfvxRq/vETCXs/JcVFndJb3XdL9xaDMNKXshsTprifgguNQJ4FIHgfKmR R/p6mExSp75L/1/AzEJv5NPQSseFbxYbZxo8EaKMdvJxufXn9YqZ5OfPt8ktQqdd+j LbUptpXFWKF/w== Date: Tue, 19 May 2026 21:19:42 +0000 To: Debian Bug Tracking System <submit@bugs.debian.org> From: Daniel Markstedt <daniel@mindani.net> Subject: CVE-2026-44049: Out-of-bounds write in convert_charset() null termination Message-ID: <VkNIA7LevktMKOQDYV4IxgqkX3mtJF90psHzy_SaJmvXXc4Zj9Aw-2nRvrlS7Ovq9vYDRP5gRUqADNnqNm6cb4VShyW-U2rdj7mkmW9Mt10=@mindani.net> Feedback-ID: 84350481:user:proton X-Pm-Message-ID: 84d3ac8db2ff6c180eb8a61d2c549cac0643f6fb MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha512; boundary="------ead1242536e1fe19c61dc66fe0bc441a3284ed7a53f24deb724c359fb7f06668"; charset=utf-8 Delivered-To: submit@bugs.debian.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------ead1242536e1fe19c61dc66fe0bc441a3284ed7a53f24deb724c359fb7f06668 Content-Type: multipart/mixed;boundary=---------------------08955d88cfc7b9264a628b642f1ff044 -----------------------08955d88cfc7b9264a628b642f1ff044 Content-Type: multipart/alternative;boundary=---------------------89fe79035b892a42ecc7eeebe6acbd63 -----------------------89fe79035b892a42ecc7eeebe6acbd63 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain;charset=utf-8 Package: netatalkVersion: 4.4.2~ds-1 Severity: critical Tags: security X-Debbugs-Cc: team@security.debian.org,pkg-netatalk-devel@lists.alioth.deb= ian.org will be resolved by upgrading to upstream v4.4.3 -----------------------89fe79035b892a42ecc7eeebe6acbd63 Content-Type: multipart/related;boundary=---------------------625cd446204add2a9e8c931f9db16cf7 -----------------------625cd446204add2a9e8c931f9db16cf7 Content-Type: text/html;charset=utf-8 Content-Transfer-Encoding: base64 PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6IEFyaWFsLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0 cHg7Ij48c3Bhbj5QYWNrYWdlOiBuZXRhdGFsazwvc3Bhbj48ZGl2PjxzcGFuPlZlcnNpb246IDQu NC4yfmRzLTE8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj5TZXZlcml0eTogY3JpdGljYWw8L3NwYW4+ PC9kaXY+PGRpdj48c3Bhbj5UYWdzOiBzZWN1cml0eTwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPlgt RGViYnVncy1DYzogPGEgdGFyZ2V0PSJfYmxhbmsiIHJlbD0ibm9yZWZlcnJlciBub2ZvbGxvdyBu b29wZW5lciIgaHJlZj0ibWFpbHRvOnRlYW1Ac2VjdXJpdHkuZGViaWFuLm9yZyI+dGVhbUBzZWN1 cml0eS5kZWJpYW4ub3JnPC9hPjxhIHRhcmdldD0iX2JsYW5rIiByZWw9Im5vcmVmZXJyZXIgbm9m b2xsb3cgbm9vcGVuZXIiIGhyZWY9Im1haWx0bzoscGtnLW5ldGF0YWxrLWRldmVsQGxpc3RzLmFs aW90aC5kZWJpYW4ub3JnIj4scGtnLW5ldGF0YWxrLWRldmVsQGxpc3RzLmFsaW90aC5kZWJpYW4u b3JnPC9hPjwvc3Bhbj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PjxzcGFuPndpbGwgYmUgcmVz b2x2ZWQgYnkgdXBncmFkaW5nIHRvIHVwc3RyZWFtIHY0LjQuMzwvc3Bhbj48L2Rpdj48c3Bhbj48 L3NwYW4+PGJyPjwvZGl2Pgo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2Vy aWY7IGZvbnQtc2l6ZTogMTRweDsiIGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jayBw cm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay1lbXB0eSI+CiAgICA8ZGl2IGNsYXNzPSJwcm90b25t YWlsX3NpZ25hdHVyZV9ibG9jay11c2VyIHByb3Rvbm1haWxfc2lnbmF0dXJlX2Jsb2NrLWVtcHR5 Ij4KICAgICAgICAKICAgICAgICAgICAgPC9kaXY+CiAgICAKICAgICAgICAgICAgPGRpdiBjbGFz cz0icHJvdG9ubWFpbF9zaWduYXR1cmVfYmxvY2stcHJvdG9uIHByb3Rvbm1haWxfc2lnbmF0dXJl X2Jsb2NrLWVtcHR5Ij4KICAgICAgICAKICAgICAgICAgICAgPC9kaXY+CjwvZGl2Pgo= -----------------------625cd446204add2a9e8c931f9db16cf7-- -----------------------89fe79035b892a42ecc7eeebe6acbd63-- -----------------------08955d88cfc7b9264a628b642f1ff044 Content-Type: application/pgp-keys; filename="publickey - daniel@mindani.net - 0x3C47642E.asc"; name="publickey - daniel@mindani.net - 0x3C47642E.asc" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="publickey - daniel@mindani.net - 0x3C47642E.asc"; name="publickey - daniel@mindani.net - 0x3C47642E.asc" LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgp4c0ZOQkdUeVVBZ0JFQURDRUY2 ZHBEa3VVaGlhd21mbXVxN0tMdmhrelozM1ZPSEMwbW9LaU1ON3lpUTYKaXR1QW5mblNLUWZTVkdY TjUvTTd5ZTQvNDIvc3dKeWRxQlNGOHMrV1k4bHpIZ0VmZk1hK2NnRitkVS9BCktjOGZVTjA2NWFT MlJIY1h4QXBBUFp3a0c5OFdmRnBFMjVhbFNLNm1EYk82T2dCRk8zME5USmpVQlNjOAp4b1duRmp4 dmQvSk15MDVXNVJmYk56eHgzaGxYaWI5NHNnK3JzWEdVaGt5bjdxR1k4Z0paT3YydXYzaTIKc2FM MHRpdU5OVGVxRmVydzRnN05CSzhtSzArNkNWcG01Snh4L005MGRsQmQvaGRteVRBWUhGcjlTREh0 CmtmUW1EMVZLSlIyQkx1OWhmc3JwWGlUUDdmekQ1N0JFUzZ2VjREbTZkczg0SXJBTWdPeG5SSUho aTFtWAo2OGJnWGhEUGNWM2JIeHVLWm4wM3pWMndlYnFzaWZuOXU2elRGQnc0SmxlY2lUSHBSYTd1 anh3cy9NbzMKN3liNEpqdDNZSmd5ZE1za0ErOEZHZ09scVhpVWEwdDhrWUdIQVRTTDhJWTNFVTFJ TnVxdlFYbWo0V0VLCit6MDVXaWp4N0hFWFdZV0VrRGlGQkQ1RlhvWWNMNHZDUlNyczR0SDl4dmV2 VERaMXdLV0RxUW1oeW94Ngo0V0p1cUdkVUpRSGNQVDA2Slk2am9FNHlFN1NjdDJJZjBoZXVtVk5v TDh5eVNRUFFwL0N5cU9NOHp0UG0KMGJ2eHN2RjhiM0xtemFGYjkzT0RvYjd6UzB2c25HdHlqbzgv Sm0vb1hmb3pDNG5IZ3ZqV09NRUd6VHBMCjlVRkRBSjJSRnVONUU5c2F6SGZGL3gxN2NScVptWjYv ekx1YWFRQVJBUUFCelNWRVlXNXBaV3dnVFdGeQphM04wWldSMElEeGtZVzVwWld4QWJXbHVaR0Z1 YVM1dVpYUSt3c0dPQkJNQkNnQTRBaHNEQlFzSkNBY0MKQmhVS0NRZ0xBZ1FXQWdNQkFoNEJBaGVB RmlFRVBFZGtMa2R1R3hlbGEzb1JJelZaS2gveHR0b0ZBbWF3CklMUUFDZ2tRSXpWWktoL3h0dG80 N3cvL1N6SEJzeDZBWlIyZzJVcFpxYXljRThGK0h4OW95YnR6ZTROWApLeHp3VFBVeER6WEFpcFFS czBsUlBpeHpCUFQ2d005TlN4Q2lIQTJyMFhvamRVc2lPWDcxclFURzhEbnAKdkpxcW1sSnpHN1l3 QmpKVWFaQjh4MkNacjV4T1MzQjU2MHluWTdxaWZzRDM5TUdtamZzZTV4VGloYU5pCk80YzF1TmhZ eHhVMURTS0pGWExhSzZWTXVtYytMQmw4bkErbHZZU2lSd1BrMmwvQ3g3bVdjZk1nR05PQQpDdEJr YnpnVndNZFAvcVBwQkV2cytpRWtyNUpmVkk2aytIM29OZmd1Y0t5K0U1UWFoOEhzNEZQYTg2U3AK QXRZdnNwSGF4NG8zWnJ2UVRyeTBSaG9XbkFlSTN5VUlpU1c3Rm1oZnFmeGVTL3hEdmdaQ2FjekpJ VFZLCmVhQXordm12d0R6elRweC9JOEZycUkyVHowdXhUVXlTRTJGZTdQdlFqUTB5UlNMaGMxRS93 OWk4dDl5RQpOdlRyRDRqRmt4dUd4U2NSa3E0dGxMclJWVkRQWEIvQmJYRmpIdDhuUGhYOUdkSDRn VU1mb3E2Y1Q1eGUKWjY2TVg1UlBqelpPMVFIOXVPd3lhQ05tNldON0ZUTGptWmo1cHBJeE13Q3lL RnRSeUlnRUk3V0VDeTh0Cm9WUlgxQkpUbHdqVkUyU3lYWmRiSFkwY2t2Szdwd2FjNXoxNjFhWnR6 K1RQY3VkTHNQcmxXSG54VjZsZApsM1NuOThrV09OOVZ0VXdxeGZ2WGloaERTYmMwaWpLa2NIOXJQ Y3V1TDZxRUdaWG9MZzNTemxpeEc2YWQKM0V6cmZwbWRvSXBWZDB1R2dQZlpNaUpBK1JOcUZUMFBY Vk84RGREQjVpQ2Z1WW5Pd1UwRVpQSlFDQUVRCkFNU3ppem1NZGwwS3kzS1QySm4rVVBEblcreUpi enBHay9SU2plbTFyRXNnSUFvVkM5bXZLUUNtOHlQVgpybUs1NVBsaGc0TkF5TGd5M01WeDVnazVF R1NuSStFNmhmYzJleGl4bWZHT2lJekZIT2pHNE12bVl6dzgKdHJaNk1DZDZWa1Bla0dWaXkrajhG SFVOY0oyQTI4SEROT1lJejZwYmE1NlJkTjVaNVpCQmpQa05rQzl1CjBXVTJCcGNlV1VpelNQSTFW TGRGWFFreU5YNElOb2xUQm9VMWo4bUVpYmlhZ2xTMmtsRUlKV3ljamxlZgpaWUNhbTc5cE5rUm4z TG51eWtDTEk1dUQ1UU1XQ3RQRnRpTFNLNnN4aVZiT2sydlJoazNvVGJrQTRxdlQKVmZoK1pQWkpm czB0N1pQQnFua1RpTW1kOG5NTFh1djcxdGkxaEE4VVhzcnVnUTUyNUdEaC82T2swc24wCnE5Qmcz V1A1VmFiSjRHVVNQSDgwVHdsQURYU21WeUFLci9KTlUrTm8vTUY3dDJJR2JJOGc0OHBoL0xSUApW UFZpc29oY2xNMWZWdHovc0kyYWErTHB5eUVkeXk5eEMrN0pFR1h2TEdJM2ZIQWRjSDd6eFhzU04w c0EKMVpManpQNExuY1M4Y3lGL3VrNUx0bzloRTViRklRcEdGcVRBM2lnb1pUMGVNcVJaREFHcDRV dTNYWGgzCmpZVHcxOFpobXVTN3N1MWdFOHlUSjBpaVFpVGZQU2FXaVg3RTMrMkpmNWZBdUg1YzlQ M1d6RFBlTDJCVQozeWtOVzRIYldQbmF6Tkd1T09Xd2o2YzBqSkZzWjcrblpIWGlZSTlqZGxGdWYz U2o0SEVTSlNtMkZ0YUIKWVJ5bFJuTmtQRTN2MkhhVENtREYyVEZKQUJFQkFBSEN3WFlFR0FFS0FD QUNHd3dXSVFROFIyUXVSMjRiCkY2VnJlaEVqTlZrcUgvRzIyZ1VDWnJBaFFBQUtDUkFqTlZrcUgv RzIybjAyRC85d0x1Y1BnK3AxMHlGZApVaVhnb0dndlliRXJLNnU3NTVhN0NOd3NjT2llYTFUOHNs YU5JbTdlOFZObVVWak1wWG51UVpsalJvdTEKOFVkMmxJL0J2N05LblNoZzhxalRhZkdycWRGeWdP QXhtSnFMY0srNzlFbjNSVnNoUktlOXd6VGFCQStsCnhtNUtOOHdLbVRaTWl2aGtZQ3VkV1FkNnRo Vjd5a29pZVUxTnJlM0dnc01Wem5sUFlwQm5lYlRwRXlHdgpWZGdWalVvd293QVNGWVI2M2o5RlRD VHVGUlhycmFsUTRZM2JTMDBSL3ZxTzdhZ0ZoYlVZSTQxb0tOV0oKL0hrOFE3VW5tYTRtc3ZjNTZK cnpCbXFqaEZMODBsWVU4anVJRXFhazA1Zzk0dk1jcmduNjR2SGdWNlRzClduMFl4QVZacVR1aExD Q3o2UTNOOUFQVkFYZE5rWDBwNVZQUEI5NmkraGtEVkVWRzZySEhrTC9Md21NZApxbFlKeDZhRm1V WVFVU21pa0tGbzNWaWtaMXViNUtuaVRLNDJnNDI5ckZHMEJLaWhuZXRBT3NTbXVRUkEKU21sRENt UE85bzhrZ1FReWlCcFc4RkRiSjNhWXRramE3VHJpMS9zMGl0bHdMTkhRSUxlRmdoMDRNZEkyCnE1 eDJueEhTdEdmRENraDIvWkF3U0xHZGlKK3VaMGdYMU1jRVYrc3QvTjU0alo4UU9UeW15RExyVWNJ awpxT1B0VkRacmJsVTJkSmN5VkhERktaNE8yQlJxMkhyNTN6ZEI4VEdjY3Mwc3pZYUpFS2hTcHZH UGMwVU0KSDQwYnFIU2NDWlk1UDdsVHp2a0piRk0yWWNLQU9hczRNOG9MS054VHluU2psc083S08z bGV5Ti8ySUQ0CnhhaWtxbEtqUGc9PQo9RHlndwotLS0tLUVORCBQR1AgUFVCTElDIEtFWSBCTE9D Sy0tLS0tCg== -----------------------08955d88cfc7b9264a628b642f1ff044-- --------ead1242536e1fe19c61dc66fe0bc441a3284ed7a53f24deb724c359fb7f06668 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsG5BAEBCgBtBYJqDNPfCRAjNVkqH/G22kUUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3Jn0ADO/GL+bISx1xsN36wGBcZ4THC9ZnnZkyQQ kIjKxY8WIQQ8R2QuR24bF6VrehEjNVkqH/G22gAAT/EP/31AMt0NDYLH2wPS gUKINgLWa9gRaM4NUHUesSkcAH4pPIQgGl/kMKZlLJhinpvyL8egrNM8YU11 G7CD42Kqm7J0HJKfI+vqWTtXhcUenm0Aj/2BBz8XC8nIcb8hbcFureaLwChC gGE+SgQ0m1Uz8ZDnGcLBFlS2CIOaKy2roBbOtuxQKQHr4989gMfyhn8oWLXZ b2PSJcyCpc0IMYn2PnaG1XOqwfvLrOexSettGlR+VM+jW7mMc50bednmQ+Vs ZbRPuS0yalQ+eOO9vaVfgCPXjg8hsFx3lR60cJmzABR2pOZ5d9LCLpXONdjU MzBv1OQ55NCXt4Hj6dyW7MkI5/fNhks4pn/uW2lg8IFrsRsqiqfDApnp/fBL sIaI9/95p4Y57WVj4iTV766VWbxwIxv7SHjCqrwbjRyjU3fMPk1LTCJjSzC4 bYPOTv4J8pQQvRLDBK+Zg/2gGMikn05/J/LWaVQGgr4xmmOexc9mO+5yWbAo rfM0DSo2T8U3FR+lQ28Nk1mUA6PV5WapugeRpQiivNQZBddygyc9ztyD6l8o mWSdHtBz+coXG5XPYXi0k3evGJ18LW3lBfgbwbZ47Mun9CfDFEg0l/FxGqEu E1u3KElU+Gd9KZ4AjptyfnAINni7xKw5eR9sFpM94YDE3OS2/gBrtmOC/A46 1s7wtc+R =5oeu -----END PGP SIGNATURE----- --------ead1242536e1fe19c61dc66fe0bc441a3284ed7a53f24deb724c359fb7f06668-- ]