-------------------------------------------------------------------------
Debian LTS Advisory DLA-4813-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Daniel Leidert
October 02, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : open-iscsi
Version : 2.1.8-1+deb12u1
CVE ID : CVE-2026-18724 CVE-2026-18725 CVE-2026-18726 CVE-2026-18727
CVE-2026-18728 CVE-2026-44943 CVE-2026-44944
Debian Bug : 1143059 1144935
Multiple vulnerabilities were found in open-iscsi, a high-performance,
transport independent, multi-platform implementation of RFC3720 iSCSI.
CVE-2026-18724
A stack buffer overflow exists in idbm_recinfo_config.
CVE-2026-18725
An out-of-bounds access exists in the IPv6 ICMPv6 echo handling.
CVE-2026-18726
Multiple vulnerabilities exist in the ICMPv6 Router Advertisement
option parsing.
CVE-2026-18727
An integer underflow exists in the iscsiuio DHCPv6 parsing.
CVE-2026-18728
An integer underflow exists in the iscsiuio IPv4 DHCP parsing.
CVE-2026-44943
Improve iscsid discovery handling of IQN names.
CVE-2026-44944
An unprivilidged local user can use the isscsiuio control socket.
For Debian 12 bookworm, these problems have been fixed in version
2.1.8-1+deb12u1.
We recommend that you upgrade your open-iscsi packages.
For the detailed security status of open-iscsi please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/open-iscsi
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part