USN-5966-2
amanda regression
USN-5966-1 fixed vulnerabilities in amanda. Unfortunately it introduced a regression in GNUTAR-based backups. This update reverts all of the changes in amanda until a better fix is provided.
We apologize for the inconvenience.
Original advisory details:
Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information. (CVE-2022-37703)
Maher Azzouzi discovered a privilege escalation vulnerability in the rundump binary within amanda. rundump is a suid binary owned by root that did not perform adequate sanitization of environment variables or commandline options and could possibly be used by a malicious local attacker to escalate privileges. (CVE-2022-37704)
Maher Azzouzi discovered a privilege escalation vulnerability in the runtar binary within amanda. runtar is a suid binary owned by root that did not perform adequate sanitization of commandline options and could possibly be used by a malicious local attacker to escalate privileges. (CVE-2022-37705)
What each source reports
OSV No score
amanda regression
USN-5966-1 fixed vulnerabilities in amanda. Unfortunately it introduced a regression in GNUTAR-based backups. This update reverts all of the changes in amanda until a better fix is provided.
We apologize for the inconvenience.
Original advisory details:
Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information. (CVE-2022-37703)
Maher Azzouzi discovered a privilege escalation vulnerability in the rundump binary within amanda. rundump is a suid binary owned by root that did not perform adequate sanitization of environment variables or commandline options and could possibly be used by a malicious local attacker to escalate privileges. (CVE-2022-37704)
Maher Azzouzi discovered a privilege escalation vulnerability in the runtar binary within amanda. runtar is a suid binary owned by root that did not perform adequate sanitization of commandline options and could possibly be used by a malicious local attacker to escalate privileges. (CVE-2022-37705)
- Record
USN-5966-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
amandaUbuntu:Pro:14.04:LTS |
before 1:3.3.3-2ubuntu1.1+esm2, plus listed versions 1:3.3.3-21:3.3.3-2build11:3.3.3-2ubuntu11:3.3.3-2ubuntu1.11:3.3.3-2ubuntu1.1+actuallyesm21:3.3.3-2ubuntu1.1+esm1 |
1:3.3.3-2ubuntu1.1+esm2 |
amandaUbuntu:Pro:16.04:LTS |
before 1:3.3.6-4.1ubuntu0.1+esm2, plus listed versions 1:3.3.6-41:3.3.6-4.11:3.3.6-4.1ubuntu0.11:3.3.6-4.1ubuntu0.1+actuallyesm21:3.3.6-4.1ubuntu0.1+esm1 |
1:3.3.6-4.1ubuntu0.1+esm2 |
amandaUbuntu:18.04:LTS |
before 1:3.5.1-1ubuntu0.2, plus listed versions 1:3.3.9-5build11:3.5-21:3.5.1-11:3.5.1-1build11:3.5.1-1build21:3.5.1-1ubuntu0.1 |
1:3.5.1-1ubuntu0.2 |
amandaUbuntu:20.04:LTS |
before 1:3.5.1-2ubuntu0.2, plus listed versions 1:3.5.1-2build21:3.5.1-2build31:3.5.1-2ubuntu0.1 |
1:3.5.1-2ubuntu0.2 |
amandaUbuntu:22.04:LTS |
before 1:3.5.1-8ubuntu1.2, plus listed versions 1:3.5.1-5ubuntu11:3.5.1-81:3.5.1-8ubuntu11:3.5.1-8ubuntu1.1 |
1:3.5.1-8ubuntu1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-5966-2 is a vulnerability with no CVSS score yet in amanda, published March 23, 2023. No source lists public exploit code. Fixed in amanda 1:3.3.3-2ubuntu1.1+esm2.