Source: dislocker Version: 0.7.3+git20250907-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for dislocker. CVE-2026-107634[0]: | Dislocker through 0.7.3 contains a heap out-of-bounds read | vulnerability in get_dataset() and get_next_datum() that never | validate dataset and datum sizes against the metadata allocation. | Attackers can craft a BitLocker volume image with inflated dataset | or datum sizes that, when opened or mounted, crashes dislocker or | discloses adjacent heap memory. CVE-2026-107635[1]: | Dislocker through 0.7.3 contains an integer underflow vulnerability | in get_vmk() and get_fvek() that allows attackers to trigger out-of- | bounds heap reads via crafted datum sizes. Attackers can supply a | malicious BitLocker volume image with a datum_size smaller than the | 36-byte AES-CCM header, causing hexdump() to over-read and crash | dislocker. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107634 https://www.cve.org/CVERecord?id=CVE-2026-107634 https://github.com/Aorimn/dislocker/commit/9158e9e41dd669b360cbc53cc18ccae729b67b48 [1] https://security-tracker.debian.org/tracker/CVE-2026-107635 https://www.cve.org/CVERecord?id=CVE-2026-107635 https://github.com/Aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
