DEBIAN-CVE-2026-7837
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-7837
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-7837.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-7837
- Upstream
- Published
- 2026-05-21T09:16:30.803Z
- Modified
- 2026-06-15T19:06:33.156671876Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions.
- References
Affected packages
Debian:11 / netatalk
Package
- Name
- netatalk
- Purl
- pkg:deb/debian/netatalk?arch=source&distro=bullseye
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
3.*
3.1.12~ds-8
3.1.12~ds-8+deb11u1
3.1.12~ds-8+deb11u2
3.1.12~ds-8.1
3.1.12~ds-8.2
3.1.12~ds-9
3.1.13~ds-1
3.1.13~ds-2
3.1.14~ds-1
3.1.15~ds-1
3.1.15~ds-2
3.1.15~ds-3
3.1.17~ds-1
3.1.17~ds-2
3.1.18~ds-1
3.1.18~ds-2
3.2.9~ds-1
3.2.9~ds-2
3.2.9~ds-3
3.2.10~ds-1
4.*
4.0.0~ds-1
4.0.0~ds-2
4.0.0~ds-3
4.0.0~ds-4
4.0.1~ds-1
4.0.2~ds-1
4.0.2~ds-2
4.0.3~ds-1
4.0.3~ds-2
4.0.4~ds-1
4.0.4~ds-2
4.0.5~ds-1
4.0.6~ds-1
4.0.7~ds-1
4.0.7~ds-2
4.0.8~ds-1
4.1.0~ds-1
4.1.1~ds-1
4.1.2~ds-1
4.1.2~ds-2
4.1.2~ds-3
4.1.2~ds-4
4.2.0~ds-1
4.2.0~ds-2
4.2.0~ds-2+exp
4.2.0~ds-3
4.2.1~ds-1
4.2.3~ds-1
4.2.3~ds-2
4.2.3~ds-2.1
4.4.1~ds-1
4.4.2~ds-1
4.4.3~ds-1
4.5.0~ds-1
4.5.0~ds-2
4.5.0~ds-3
Debian:13 / netatalk
Package
- Name
- netatalk
- Purl
- pkg:deb/debian/netatalk?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:14 / netatalk
Package
- Name
- netatalk
- Purl
- pkg:deb/debian/netatalk?arch=source&distro=forky