Here are the latest security advisories for the Debian Linux distribution:
- DSA-5791-1 python-reportlab - security update
Elyas Damej discovered that a sandbox mechanism in ReportLab, a Python library to create PDF documents, could be bypassed which may result in the execution of arbitrary code when converting malformed HTML to a PDF document. https://security-tracker.debian.org/tracker/DSA-5791-1 - DSA-5790-1 node-dompurify - security update
It was discovered that DOMPurify, a sanitizer for HTML, MathML and SVG was susceptible to nesting-based mXSS. https://security-tracker.debian.org/tracker/DSA-5790-1 - DSA-5789-1 thunderbird - security update
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-5789-1 - DSA-5788-1 firefox-esr - security update
Damien Schaeffer discovered a use-after-free in the Mozilla Firefox web browser, which could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-5788-1 - DSA-5787-1 chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-5787-1 - DSA-5729-2 apache2 - regression update
The fixes for CVE-2024-38474 and CVE-2024-39884 introduced two regressions in mod_rewrite and mod_proxy. https://security-tracker.debian.org/tracker/DSA-5729-2 - DSA-5786-1 libgsf - security update
Integer overflows flaws were discovered in the Compound Document Binary File format parser of libgsf, the GNOME Project G Structured File Library, which could result in the execution of arbitrary code if a specially crafted file is processed. https://security-tracker.debian.org/tracker/DSA-5786-1 - DSA-5785-1 mediawiki - security update
Dom Walden discovered that the AbuseFilter extension in MediaWiki, a website engine for collaborative work, performed incomplete authorisation checks. https://security-tracker.debian.org/tracker/DSA-5785-1 - DSA-5784-1 oath-toolkit - security update
Fabian Vogt reported that the PAM module in oath-toolkit, a collection of components to build one-time password authentication systems, does not safely perform file operations in users's home directories when using the usersfile feature (allowing to place the OTP state in the home directory of the to-be-authenticated user). A local user can take advantage of this flaw for root privilege escalation. https://security-tracker.debian.org/tracker/DSA-5784-1 - DSA-5783-1 firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. Debian follows the extended support releases (ESR) of Firefox. Starting with this update we're now following the 128.x releases. Between 115.x and 128.x, Firefox has seen a number of feature updates. For more information please refer to https://www.mozilla.org/en-US/firefox/128.0esr/releasenotes/ https://security-tracker.debian.org/tracker/DSA-5783-1 - DSA-5782-1 linux - security update
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-5782-1 - DSA-5781-1 chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-5781-1 - DSA-5780-1 php8.2 - security update
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in incorrect parsing of multipart/form-data, bypass of the cgi.force_direct directive or incorrect logging. https://security-tracker.debian.org/tracker/DSA-5780-1 - DSA-5779-1 cups - security update
Simone Margaritelli reported that cups, the Common UNIX Printing System, does not properly sanitize IPP attributes when creating PPD files, which may result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-5779-1 - DSA-5778-1 cups-filters - security update
Simone Margaritelli reported several vulnerabilities in cups-filters. Missing validation of IPP attributes returned from an IPP server and multiple bugs in the cups-browsed component can result in the execution of arbitrary commands without authentication when a print job is started. https://security-tracker.debian.org/tracker/DSA-5778-1 - DSA-5777-1 booth - security update
It was discovered that the Booth cluster ticket manager failed to correctly validate some authentication hashes. https://security-tracker.debian.org/tracker/DSA-5777-1 - DSA-5776-1 tryton-server - security update
Albert Cervera discovered two missing authorisation checks in the Tryton application platform. https://security-tracker.debian.org/tracker/DSA-5776-1 - DSA-5775-1 chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-5775-1 - DSA-5774-1 ruby-saml - security update
It was discovered that ruby-saml, a SAML library implementing the client side of a SAML authorization, does not properly verify the signature of the SAML Response, which could result in bypass of authentication in an application using the ruby-saml library. https://security-tracker.debian.org/tracker/DSA-5774-1 - DSA-5773-1 chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-5773-1 - More...