Hi,

The following vulnerability was published for freeipmi.

CVE-2026-50031[0]:
| ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows
| on response messages. The Intelligent Platform Management Interface
| (IPMI) specification defines a set of interfaces for platform
| management. It is implemented by a large number of hardware
| manufacturers to support system management. It is most commonly used
| for sensor reading (e.g., CPU temperatures through the ipmi-sensors
| command within FreeIPMI) and remote power control (the ipmipower
| command). The ipmi-oem client command implements a set of a IPMI OEM
| commands for specific hardware vendors. If a user has supported
| hardware, they may wish to use the ipmi-oem command to send a
| request to a server to retrieve specific information. Two
| subcommands "ipmi-oem dell get-active-directory-config" and "ipmi-
| oem fujitsu get-sel-entry-long-text" were found to have exploitable
| buffer overflows on response messages.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-50031
https://www.cve.org/CVERecord?id=CVE-2026-50031
[1] https://savannah.gnu.org/bugs/index.php?68363
[2] https://savannah.gnu.org/bugs/index.php?68364
[3] https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00000.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1138782 in freeipmi reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/freeipmi/-/commit/1d1fb6a155b31c30db0b89247c6c5c5262c53336
------------------------------------------------------------------------
update changelog

Closes: #1138727, #1138782, CVE-2026-50031
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1138782

We believe that the bug you reported is fixed in the latest version of
freeipmi, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1138782@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Fabio Fantoni <fantonifabio@tiscali.it> (supplier of updated freeipmi package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 07 Jun 2026 18:47:11 +0200
Source: freeipmi
Built-For-Profiles: noudeb
Architecture: source
Version: 1.6.18-1
Distribution: unstable
Urgency: medium
Maintainer: Fabio Fantoni <fantonifabio@tiscali.it>
Changed-By: Fabio Fantoni <fantonifabio@tiscali.it>
Closes: 1138727 1138782
Changes:
 freeipmi (1.6.18-1) unstable; urgency=medium
 .
   * New upstream version 1.6.18
     (Closes: #1138727, #1138782, CVE-2026-50031)
   * d/patches: refresh
   * update d/copyright
   * Update standards version to 4.7.4, no changes needed
   * d/*.install: fix swapped init.d scripts on non-linux ports
   * d/patches: add patch fixing groff warnings in manpages
   * d/control: mark runtime library packages as Multi-Arch: same
   * d/rules: protect credential conffiles libipmiconsole.conf and ipmiseld.conf
   * d/control: use strict freeipmi-common dependency for libfreeipmi17
   * d/control: mark runtime library packages as Multi-Arch: same
   * d/rules: protect credential conffiles libipmiconsole.conf and ipmiseld.conf
   * d/control: use strict freeipmi-common dependency for libfreeipmi17
Checksums-Sha1:
 c128519e76563df49ab01b207ba44a6ad084e01a 3353 freeipmi_1.6.18-1.dsc
 73846408b1aaa3bd04152f33c3844e32dff6df59 3468378 freeipmi_1.6.18.orig.tar.gz
 7344630c4436232241f4e5fe253eecfec14f694d 195 freeipmi_1.6.18.orig.tar.gz.asc
 e8354cb7ddf3a0c7c2935cf23c264d1325ae25bd 29808 freeipmi_1.6.18-1.debian.tar.xz
 6d6b079420b9e3725c30eb9e2373b1363bd473d2 6998 freeipmi_1.6.18-1_source.buildinfo
Checksums-Sha256:
 46fafb285543edd3639234a44c406fd23de4c84650e4d310a09c11a9c9bfd72f 3353 freeipmi_1.6.18-1.dsc
 8098b23820038ad0aa39abf0f9a012e24683d384d9f91e760acb2a68b465e0fe 3468378 freeipmi_1.6.18.orig.tar.gz
 87add5640dfabb8590df9ae783b0aef448629c275c98d1ce382ea23ec94e6105 195 freeipmi_1.6.18.orig.tar.gz.asc
 507cb7ba543635e42b3ed1bafd6f0ca048705ccee7a8642d41b1a784f05360d7 29808 freeipmi_1.6.18-1.debian.tar.xz
 5a67e84ee357d2e0cfe9b6a65c2f64d428434b68f955a055799c16a2fb05e91d 6998 freeipmi_1.6.18-1_source.buildinfo
Files:
 44b90160f14a28e8a6d216c1a69fba83 3353 admin optional freeipmi_1.6.18-1.dsc
 8731b0ec78a05937797e9e7e1115fcc6 3468378 admin optional freeipmi_1.6.18.orig.tar.gz
 3d35b84ad2f5830e00f7ed0fdbcfcaeb 195 admin optional freeipmi_1.6.18.orig.tar.gz.asc
 532866ce6ba3a110e7dfb391b957c0da 29808 admin optional freeipmi_1.6.18-1.debian.tar.xz
 9dd9aba2efc6b7e71120628cba404b24 6998 admin optional freeipmi_1.6.18-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEELEHRfLe4S9D5+1GzaAZorpB/EB0FAmoloOMACgkQaAZorpB/
EB0g2Q/+KFGJuQkP17NgWCzXx1QUcN+gt634S8FIBCrFgnIZ+9j+SU09Jl1PuRzf
HMyJahg9KKtEe2EZVX9Lxdtxei+qJaELuGYyKlRjrFxLPAF6nIc2k/3lJUd/89KV
+dQE5BC9yRJ1phU4bl6vsNRn316pgpknfvdEjXF02b1dPgdE9211oxm7b1D43VU7
1MGf6MbbRvv/4SNSCFdTAQdtFl06Tr8KkFQZfoUDkmXVN1RrF/4X+XMM6pgkNJ3l
wZ2lr7axx7aLQ3/5Jpu8dvE5wjsL/xWVKNj7AJ50e1RFKRVkJakfmP0V3r5ZpkBz
e68slOCntwXtxXHvaYN1G02qKjemWASxHzVsmEmYyGkXaY64DoYUmfpeNOg4W6a4
U9x1GphiyHIPgSBBZZutTeD7IK1SeyJMaVJPek2ebcK5PRwySl+a+KkxQnponS6T
n705tFJ3d0lOs91yywMFWAo88Igqi+yfGHSPBhQ0DJiAWGXl0Wswdjx9bisNZD6F
f38XwaeIstBU0G3yLASHKyVoAl9J/qTEydE+z109ZlrPbJTflzMth9KZ7TiwMcDE
3df4fa+M01f2OENuJ/D7P56ytLMbK6YefPidTSXEcYu3bCkHmn4WbGP9t61Nd9cG
y4K2VrfI2KGNbvHb7H3kT3jMDUGRPXb78i5/11dGk/90eclXYOk=
=sdCX
-----END PGP SIGNATURE-----