Control: tags -1 + patch Hi Josue,
Attached is a debdiff for a 1.2.7-1.1 NMU fixing CVE-2026-16277. I have not uploaded anything; please use as much or as little of it as you like. It adds two upstream commits from the steved/rpcbind tree on https://www.google.com/url?q=http://git.linux-nfs.org&source=gmail&ust=1793559823700000&sa=E, checked by full commit id: CVE-2026-16277.patch bb9bb728 rpcinfo: stack buffer overflow in rpcbaddrlist() ("rpcinfo -l"), in 1.2.9 rpcinfo-stack-buffer-overflow-in-rpcinfo-rpcbdump.patch cb7b787a rpcinfo: stack buffer overflow in rpcbdump() (same reporter, same kind of bug: a long server-supplied version list overflows a fixed buffer) Both apply to 1.2.7 without fuzz. The package builds and lintian source tags are identical to 1.2.7-1. I did not build a runtime reproducer. The stock rpcinfo uses __sprintf_chk (FORTIFY), so the overflow most likely ends in an abort rather than silent stack corruption, but I have not verified that. Upstream 1.2.9 also has 9a76cf2 ("Stop unauthenticated oversized allocation in PMAPPROC_CALLIT decode") on the daemon side, which may be worth picking up as well; it is not included here. Regards, automationcanadian
rpcbind_1.2.7-1.1.debdiff.gz
Description: application/gzip
