-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 08 Sep 2026 05:21:12 +0200 Source: sssd Architecture: source Version: 2.10.1-2+deb13u1 Distribution: trixie Urgency: medium Maintainer: Debian SSSD Team <pkg-sssd-devel@alioth-lists.debian.net> Changed-By: Mike Gabriel <sunweaver@debian.org> Closes: 1117935 1134269 1141323 1141769 1143600 1143947 Changes: sssd (2.10.1-2+deb13u1) trixie; urgency=medium . * debian/patches: + Add CVE-2026-12610.diff. (Closes: #1141323). CVE-2026-12610: PAM: fix use-after-free during p11_child processing. + Add CVE-2025-11561.diff. (Closes: #1117935). CVE-2025-11561: krb5: disable Kerberos localauth an2ln plugin for AD/IPA. + Add CVE-2026-6245.diff. (Closes: #1134269). CVE-2026-6245: pam: fix out-of-bounds read in pam_passkey_child_read_data. + Add CVE-2026-14474.diff and CVE-2026-14476.diff. (Closes: #1141769). CVE-2026-14474: sudo: warn when ldap_sudo_search_base falls back to root DN. CVE-2026-14476: gpo: reject path traversal in gPCFileSysPath. * debian/patches: + Add CVE-2026-68742.diff, CVE-2026-68743.diff, and CVE-2026-68744.diff (Closes: #1143600, #1143947). CVE-2026-68742: nss: validate addrlen in sss_nss_protocol_parse_addr(). CVE-2026-68743: pam: validate auth_token_length in extract_authtok_v1(). CVE-2026-68744: NSS: fix initgroups packet heap disclosure. Checksums-Sha1: b760a927bbb6771bdeb695a5735af4a453c67362 5233 sssd_2.10.1-2+deb13u1.dsc d2a0ceb607ac75201d0ee47e15c88734c423a02b 54216 sssd_2.10.1-2+deb13u1.debian.tar.xz eba269d84a06cc9a58465fe4426eb4186481127a 19522 sssd_2.10.1-2+deb13u1_source.buildinfo Checksums-Sha256: 63fbbac51ba51398461b7faee17aba74226fb3dcd51a1ebf850e44623f75484a 5233 sssd_2.10.1-2+deb13u1.dsc d04f688e949163a1371a3d9e26433a47c3ca8fd93f5301d51d8cbc0bb9c25e50 54216 sssd_2.10.1-2+deb13u1.debian.tar.xz 8449e238435960855d04923ff6851b79451db916c3f36ca75dd121ed5c3086ba 19522 sssd_2.10.1-2+deb13u1_source.buildinfo Files: 569f659e95eb750b836cdcbb6d43041c 5233 utils optional sssd_2.10.1-2+deb13u1.dsc 8a7e487257a06d0b04d5f2525d9beb25 54216 utils optional sssd_2.10.1-2+deb13u1.debian.tar.xz c7f02aac1ef9ca6b7503f9815c5a2f37 19522 utils optional sssd_2.10.1-2+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJJBAEBCgAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmqfjaoVHHN1bndlYXZl ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxb1UP/jOw01P+vmxqUlpjmBsfBozQ/Ae1 8UQVnQSpjhtisjyGryugSddZKMeKz5ZrF5fssq2wCSGzTZPOKKosrJ12g2jRIDv/ 8XLmDxRRjsnkkXBuoXh/QE9r+oAGcflZnHYo8m8PcbW9bHTISmdHu/TxftN4nYtS 11DWXFXrHqb4JEBJwwRMHNpAOMiTyH+0UXneTSWxELvFQ3aMWYlgpjrJcmGed5eH 3xNFQDyR40Dxxfb5DjI7BI8/BHUMSh9gXGEeiKcjBLUDe1BQ877iW3LrC9kgmOH0 siVj2lPbsq480abR/k2rJE55BppOMminI8VBq/ov6mG0qQQFIsWly+kWBvfEHr45 L/wY4161fBRILVXY9BBi+t4Fudo7/IYGp9ahin8h4Q5bolDMl0D5bRDc9J2Q4xc1 WtTYM5OgKlNKldeqUIAHFxIGsh/QPc7ClwqHA3lidZgmCoLYFEMH3pvqiWJmJMIM KfgVgVwp5Y/adgDFldKXRsHID7CfDXkUVJ2Hv6ZJ1Vq6UpHu6a27YQgVf0LLBuhb WXM0kPip6JViV0J+LLj8Rkrc+77PUEn5SNq8p0Q0xm1eMCYA6wzSYTYGF4VTRNwZ uW2dVTD8E2ItGfkXubNNc+ek4nx+bNJ3O7Wos/7H5fiZvOUt0jwluzkQZVeo389G m49QUJi1fUSsJzYS =bKUV -----END PGP SIGNATURE-----
