Source: freeipmi Version: 1.6.17-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for freeipmi. CVE-2026-50031[0]: | ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows | on response messages. The Intelligent Platform Management Interface | (IPMI) specification defines a set of interfaces for platform | management. It is implemented by a large number of hardware | manufacturers to support system management. It is most commonly used | for sensor reading (e.g., CPU temperatures through the ipmi-sensors | command within FreeIPMI) and remote power control (the ipmipower | command). The ipmi-oem client command implements a set of a IPMI OEM | commands for specific hardware vendors. If a user has supported | hardware, they may wish to use the ipmi-oem command to send a | request to a server to retrieve specific information. Two | subcommands "ipmi-oem dell get-active-directory-config" and "ipmi- | oem fujitsu get-sel-entry-long-text" were found to have exploitable | buffer overflows on response messages. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-50031 https://www.cve.org/CVERecord?id=CVE-2026-50031 [1] https://savannah.gnu.org/bugs/index.php?68363 [2] https://savannah.gnu.org/bugs/index.php?68364 [3] https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00000.html Please adjust the affected versions in the BTS as needed. Regards, Salvatore
