Heap buffer overflow in CNID daemon comm_rcv()

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/afpd/directory.c

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c

A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c

Stack buffer overflow via UCS-2 type confusion in convert_charset()

SQL injection in MySQL CNID backend

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager

Arbitrary file read via attacker-controlled symlink creation

Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file

EA path traversal via incomplete sanitization

Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir()

Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()

Missing o_len bounds check in pull_charset_flags()

Integer underflow in dsi_writeinit() leads to denial of service

Bitwise OR logic bug enables shell injection

LDAP simple-bind password exposure in log output

Out-of-bounds write in convert_charset() null termination

Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BN_bin2bn in…

Weak cryptography in DHCAST128 UAM

Authentication bypass via admin auth user

Heap out-of-bounds reads in Spotlight RPC unmarshalling

ASP session ID out-of-bounds access

Shell injection via volume path

Predictable afpd session token

Stack buffer overflow in desktop.c

DES-ECB auth with timing side channel

seteuid failure ignored in auth modules

Non-reentrant privilege toggle

EA header parsing heap over-read

Off-by-two in papd lp_write()

LDAP filter injection

Integer underflow in volxlate

TOCTOU with root privilege in ad_flush

Missing break in DSI OpenSession

Bitwise OR of errno values

FORTIFY_SOURCE disabled

Dead bounds check in Spotlight RPC unmarshaller

hextoint macro uppercase bug

Format string argument mismatch

Unbounded realloc in charset conversion

system() after failed chdir()