SUSE-SU-2026:22069-1

Security update for rpcbind

No scoreFix available

SUSE-SU-2026:22069-1 is a vulnerability with no CVSS score yet in rpcbind, published June 4, 2026. No source lists public exploit code. Fixed in rpcbind 1.2.9-slfo.1.1_1.1.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.2.9-slfo.1.1_1.1rpcbind

Description

This update for rpcbind fixes the following issues

Update to rpcbind 1.2.9:

Security issue:

Fix several memory leaks and buffer overflows (bsc#1267212).

Non security issue:

rpcbind fails to start (tumbleweed snapshot 20181120) (bsc#1117217).

Changes:

rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()
rpcbind: Stop unauthenticated oversized allocation in PMAPPROC_CALLIT decode
rpcbind: fix memory leak in read_warmstart()
rpcbind: fix memory leaks in network_init()
rpcbind: fix memory leak in init_transport()
Added -v (print version and compile flags)
rpcinfo: Removed a number of "old-style function definition" warnings
man/rpcbind: Update list of options
Comment out ListenStream=@/run/rpcbind.sock
[nfs/nfs-utils/rpcbind] rpcbind: avoid dereferencing NULL from realloc()
systemd/rpcbind.service.in: Add various hardenings options
man/rpcbind: Add Files section to manpage
Moved rpcbind.lock and default configs to /run instead of /var/run
rpcinfo: try connecting using abstract address
Listen on an AF_UNIX abstract address if supported
autotools/systemd: call rpcbind with -w only on enabled warm starts
rpcbind: fix double free in init_transport

Affected packages

Affected packages
Package	Affected	Fixed
`rpcbind` SUSE:Linux Micro 6.1	before 1.2.9-slfo.1.1_1.1	1.2.9-slfo.1.1_1.1

What each source reports

OSVNo score

Security update for rpcbind