Xu Biang discovered a buffer overflow bug in the eap-mschapv2 plugin of strongSwan, an IKE/IPsec suite. The eap-mschapv2 plugin doesn’t correctly check the length of an EAP-MSCHAPv2 Failure Request packet on the client, which can cause an integer underflow that leads to a crash, and a heap-based buffer
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For the oldstable distribution (bookworm), these problems have been fixed
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in incorrect string equality checks, XML XXE/XEE attacks or incorrect certificate validation. For the stable distribution (trixie), these problems have been fixed in version 25.0.1+8-1~deb13u1.
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in XML XXE/XEE attacks or incorrect certificate validation. For the oldstable distribution (bookworm), these problems have been fixed in version 17.0.17+10-1~deb12u1.
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in incorrect string equality checks, XML XXE/XEE attacks or incorrect certificate validation. For the stable distribution (trixie), these problems have been fixed in version 21.0.9+10-1~deb13u1.
A security issue was discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. For the oldstable distribution (bookworm), this problem has been fixed in version 141.0.7390.122-1~deb12u1.
Several vulnerabilities were discovered in BIND, a DNS server implementation, which may result in cache poisoning or denial of service. For the oldstable distribution (bookworm), these problems have been fixed in version 1:9.18.41-1~deb12u1. For the stable distribution (trixie), these problems have been fixed in
It was discovered that insecure path handling in the Python interface to the Internet Archive/archive.org could result in overwriting a user’s files. For the oldstable distribution (bookworm), this problem has been fixed in version 3.3.0-2~deb12u1.
Brandon Da Costa and Mahdi Asfhar discovered a cross-site scripting vulnerability in the web client of the Tryton application platform. For the oldstable distribution (bookworm), this problem has been fixed in version 6.0.28+ds1-2+deb12u1. For the stable distribution (trixie), this problem has been fixed in
Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system, which could result in CSV injection via ticket values with special characters, or cross-site scripting via calendar invitations added to a ticket. For the oldstable distribution (bookworm), these problems have been
It was discovered that Request Tracker, an extensible trouble-ticket tracking system is prone to a CSV injection via ticket values with special characters that are exported to a TSV from search results. For the oldstable distribution (bookworm), this problem has been fixed in version 4.4.6+dfsg-1.1+deb12u3.
This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for security vulnerabilities which could result in privilege escalation or denial of service. For the oldstable distribution (bookworm), these problems have been fixed in version 3.20250812.1~deb12u1.
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of arbitrary code if malformed Farbfeld, Wireless Bitmap, DICOM or Apple Icon images are opened.
It was discovered that the symlink validation in node-tar-fs, a Node.js module that provides filesystem-like access to tar files, could be bypassed.
Firefox 140.3.1 has been released, which fixes connection errors with some sites; if HTTP/3 connections failed, the fallback is now handled more gracefully.
Eugene Medvedev discovered that nncp, a package facilitating secure store-and-forward file and mail exchange, was susceptible to path traversal with the freq and file commands.
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. Debian follows the Thunderbird upstream releases. Support for the
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure.
The update for libxslt announced in DSA 5979-1 introduced a regression while back porting the upstream deterministic generate-id implementation, which makes the generated IDs may remain in a non-deterministic order.
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.
This update for Jetty, a Java servlet engine and web server, addresses a protocol-level vulnerability in HTTP/2 support also referred to as “MadeYouReset”.
This update for Jetty, a Java servlet engine and web server, addresses a protocol-level vulnerability in HTTP/2 support also referred to as “MadeYouReset”.
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. Google is aware that an exploit for CVE-2025-10585 exists in the wild.
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, information disclosure or bypass of the same-origin policy.
It was discovered that Node sha.js, an implementation of the SHA family hash functions in pure JavaScript, performed incomplete type checks. For the oldstable distribution (bookworm), this problem has been fixed
It was discovered that cJSON, an ultralightweight JSON parser, performed insufficient input sanitising, which could result in out-of-bounds memory access.
Michael Hudak discovered a flaw in libcpanel-json-xs-perl, a module for fast and correct serialising to JSON. An integer buffer overflow causing a segfault when parsing specially crafted JSON, may allow an attacker to mount a denial-of-service attack or cause other unspecified impact.
Michael Hudak discovered a flaw in libjson-xs-perl, a module for manipulating JSON-formatted data. An integer buffer overflow causing a segfault when parsing specially crafted JSON, may allow an attacker to mount a denial-of-service attack or cause other unspecified impact.
53 queries. 9.25 mb Memory usage. 0.289 seconds.