CVE catalog

CVE-2018-12562

cantata: CVE-2018-12562

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.66% · Oct 25, 2026

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancantatasid3.5.0.ds1-1fixed
Debiancantataforky3.5.0.ds1-1fixed
Debiancantatatrixie2.5.0.ds1-4fixed
Debiancantatabookworm2.5.0.ds1-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancantatasourcesid2.3.0.ds1-2unimportantNot reported[901798]
Debiancantatasourceforky2.3.0.ds1-2unimportantNot reported[901798]
Debiancantatasourcetrixie2.3.0.ds1-2unimportantNot reported[901798]
Debiancantatasourcebookworm2.3.0.ds1-2unimportantNot reported[901798]

[Debian bug #901798]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cantata]Fixed

    Source package: [cantata]

    Details (2)

    • 2.5.0.ds1-1+b1 · amd64 · bookworm

      Fixed · Fixed: 2.3.0.ds1-2

      dsa · cantata · debian · bookworm; dsa · cantata · debian · 12

    • 2.5.0.ds1-1+b1 · arm64 · bookworm

      Fixed · Fixed: 2.3.0.ds1-2

      dsa · cantata · debian · bookworm; dsa · cantata · debian · 12

[Debian 13 (Trixie)]

  • [cantata]Fixed
    Details (2)

    • 2.5.0.ds1-4 · amd64 · trixie

      Fixed · Fixed: 2.3.0.ds1-2

      dsa · cantata · debian · 13

    • 2.5.0.ds1-4 · arm64 · trixie

      Fixed · Fixed: 2.3.0.ds1-2

      dsa · cantata · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]