Your message dated Sat, 05 Sep 2026 19:07:34 +0000
with message-id <[email protected]>
and subject line Bug#1146649: fixed in freeipmi 1.6.19-1
has caused the Debian Bug report #1146649,
regarding freeipmi: CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507
CVE-2026-85508 CVE-2026-85509
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146649: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146649
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: freeipmi
Version: 1.6.18-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for freeipmi.
CVE-2026-85504[0]:
| FreeIPMI before 1.6.19 has a stack-based buffer overflow in
| _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in
| libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed
| Fujitsu SEL long-text responses.
CVE-2026-85505[1]:
| ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-
| read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-
| oem-fujitsu.c when a BMC provides a short response, a different
| vulnerability than CVE-2026-50031 (which has different affected
| versions).
CVE-2026-85506[2]:
| ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow
| in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c
| (idrac-info subcommand to dell get-system-info).
CVE-2026-85507[3]:
| ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow
| in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c
| (cmc-info subcommand to dell get-system-info).
CVE-2026-85508[4]:
| ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow
| in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-
| dell.c (cmc-ipv6-info subcommand to dell get-system-info).
CVE-2026-85509[5]:
| FreeIPMI before 1.6.19 has a stack-based buffer overflow in
| _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more
| bytes than requested.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-85504
https://www.cve.org/CVERecord?id=CVE-2026-85504
[1] https://security-tracker.debian.org/tracker/CVE-2026-85505
https://www.cve.org/CVERecord?id=CVE-2026-85505
[2] https://security-tracker.debian.org/tracker/CVE-2026-85506
https://www.cve.org/CVERecord?id=CVE-2026-85506
[3] https://security-tracker.debian.org/tracker/CVE-2026-85507
https://www.cve.org/CVERecord?id=CVE-2026-85507
[4] https://security-tracker.debian.org/tracker/CVE-2026-85508
https://www.cve.org/CVERecord?id=CVE-2026-85508
[5] https://security-tracker.debian.org/tracker/CVE-2026-85509
https://www.cve.org/CVERecord?id=CVE-2026-85509
[6] https://www.openwall.com/lists/oss-security/2026/08/28/5
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: freeipmi
Source-Version: 1.6.19-1
Done: Fabio Fantoni <[email protected]>
We believe that the bug you reported is fixed in the latest version of
freeipmi, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Fabio Fantoni <[email protected]> (supplier of updated freeipmi package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 05 Sep 2026 20:18:24 +0200
Source: freeipmi
Built-For-Profiles: noudeb
Architecture: source
Version: 1.6.19-1
Distribution: unstable
Urgency: medium
Maintainer: Fabio Fantoni <[email protected]>
Changed-By: Fabio Fantoni <[email protected]>
Closes: 1146649
Changes:
freeipmi (1.6.19-1) unstable; urgency=medium
.
* New upstream version 1.6.19
- Fix stack-based buffer overflows and over-reads on untrusted BMC
responses: CVE-2026-85504, CVE-2026-85505, CVE-2026-85506,
CVE-2026-85507, CVE-2026-85508, CVE-2026-85509 (Closes: #1146649)
* d/patches: remove one patch applied upstream and refresh the other
* Drop kfreebsd support
* Drop the now unused dh-exec
* d/*.maintscript: drop the obsolete conffile and doc dir transitions
* d/control: drop the obsolete Breaks/Replaces
* d/TODO: drop the stale packaging notes
* d/copyright: update the debian/* stanza
Checksums-Sha1:
ecbe6130a7358273912deca16c84d5254b3eeb9f 3175 freeipmi_1.6.19-1.dsc
aaa5f683f2be2dc8637c8fdbefde45d46f98df2f 3470670 freeipmi_1.6.19.orig.tar.gz
0ba9999e57c3834191166b708bc4196cbcfc4a53 195 freeipmi_1.6.19.orig.tar.gz.asc
a051286fb3b9ea1f44fdc78e792a849134edc9b2 28116 freeipmi_1.6.19-1.debian.tar.xz
61483cbf7bece4fe212b53840023e9f71726fe24 7014
freeipmi_1.6.19-1_source.buildinfo
Checksums-Sha256:
a1e42f218d8a6e8ba245cc6d1ec73bf4d5f2c09684508943629d7f81fb5a021a 3175
freeipmi_1.6.19-1.dsc
f95c2b73797c4a0341a42a7b3c43efb60954c4130d082ad348fd40da554b4e85 3470670
freeipmi_1.6.19.orig.tar.gz
de34db90284de63c623a1b90965b6cc10f5c0393ffea095f7f4780866e36bf1d 195
freeipmi_1.6.19.orig.tar.gz.asc
74dc052c4d18ec615d137d9e70d5a1d643826eb835b8309d6b357ea4ba51c057 28116
freeipmi_1.6.19-1.debian.tar.xz
f018409173c96003f5bd90adbc6585d5121a2191ae35a9b814a065d57071af30 7014
freeipmi_1.6.19-1_source.buildinfo
Files:
9e5d100235f012655c02b4ca55ceea61 3175 admin optional freeipmi_1.6.19-1.dsc
b36a241c8a548033c887bd2b17f7c457 3470670 admin optional
freeipmi_1.6.19.orig.tar.gz
7f9bfc03063bb60542d7782e9d7ae08b 195 admin optional
freeipmi_1.6.19.orig.tar.gz.asc
3172b7601c3b5e1f034026f09c66b96a 28116 admin optional
freeipmi_1.6.19-1.debian.tar.xz
e5d3edebf5fb294460897e3d74d57c8a 7014 admin optional
freeipmi_1.6.19-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEELEHRfLe4S9D5+1GzaAZorpB/EB0FAmqcY1gACgkQaAZorpB/
EB3psg/7BmYL5flITemjTs7eDkak1er+mp53sAp3fEmfwWn1EPS+niCn0ewOzPST
A5vqzXQqt9fbYX9oWF32aDh3yZ7Weoy5n98H6baCWp5CiFq+tEScArAox4JDMQLw
m5tM4VaNZg6kaC56NCIfChd6glslsqN5hUuXHQJz2cnGdBXZhfbSwbdnAQBSKhkO
tn9W/cBHilpiNYjTz3AWVPH4vaK2pesJNtDw69QGbi4MTRYOTr1Gkf44GlE9i9wF
HUsfiZgPpBZv2KX4wcy158OVlvJxsc0ytTPWYvRWB5tVuxawPzVwFmY+sRqgL0lW
Vn26hmNPtYUoSy8OIdMF+R85sBAAUyoDBsv5cgHQStg4Q9RURW0c9Qi+49cLdArY
VNU29fsjXnKZ9FpO9TLEnpUPEfOjNP8rDcdIeOKY+DHJccY4QL17r8j2mPCDEDYM
eFI6O9TQ6ZAcuDyLeE3If16WY7MsmYuyviDewsHlwkU7G4IsMmWx7rkDUtiD6B7u
gcYoxTSSJVzy+WIajqGVf0ZzbFAoiSck0RP2pww2+IVstsQopf6LEO+AO7ktfSg5
JBcIkj6uOGNgkKE0HmkYPr9Iptw6N3wM0NcgHnadP5AWnOn/zRX19vlxKsGybavA
Bk9IDK9zNkiXTZ/1OGCQ7DnW+Bp1AXEXQa3AUYkEMvw7RbPLgyA=
=iSHv
-----END PGP SIGNATURE-----
pgpW5mRB5xxcu.pgp
Description: PGP signature
--- End Message ---
