Debian Security Advisory

Package : ffmpeg

Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.

For the stable distribution (bullseye), this problem has been fixed in version 7:4.3.4-0+deb11u1.

We recommend that you upgrade your ffmpeg packages.

For the detailed security status of ffmpeg please refer to its security tracker page at:

Information on source package ffmpeg

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : chromium

CVE ID : CVE-2022-1477 CVE-2022-1478 CVE-2022-1479 CVE-2022-1480

CVE-2022-1481 CVE-2022-1482 CVE-2022-1483 CVE-2022-1484

CVE-2022-1485 CVE-2022-1486 CVE-2022-1487 CVE-2022-1488

CVE-2022-1489 CVE-2022-1490 CVE-2022-1491 CVE-2022-1492

CVE-2022-1493 CVE-2022-1494 CVE-2022-1495 CVE-2022-1496

CVE-2022-1497 CVE-2022-1498 CVE-2022-1499 CVE-2022-1500

CVE-2022-1501

Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

For the stable distribution (bullseye), these problems have been fixed in version 101.0.4951.41-1~deb11u1.

We recommend that you upgrade your chromium packages.

For the detailed security status of chromium please refer to its security tracker page at:

Information on source package chromium

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : ffmpeg

Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.

For the oldstable distribution (buster), this problem has been fixed in version 7:4.1.9-0+deb10u1.

We recommend that you upgrade your ffmpeg packages.

For the detailed security status of ffmpeg please refer to its security tracker page at:

Information on source package ffmpeg

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : linux

CVE ID : CVE-2021-4197 CVE-2022-0168 CVE-2022-1016 CVE-2022-1048

CVE-2022-1158 CVE-2022-1195 CVE-2022-1198 CVE-2022-1199

CVE-2022-1204 CVE-2022-1205 CVE-2022-1353 CVE-2022-1516

CVE-2022-26490 CVE-2022-27666 CVE-2022-28356 CVE-2022-28388

CVE-2022-28389 CVE-2022-28390 CVE-2022-29582

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2021-4197

Eric Biederman reported that incorrect permission checks in the

cgroup process migration implementation can allow a local attacker

to escalate privileges.

CVE-2022-0168

A NULL pointer dereference flaw was found in the CIFS client

implementation which can allow a local attacker with CAP_SYS_ADMIN

privileges to crash the system. The security impact is negligible as

CAP_SYS_ADMIN inherently gives the ability to deny service.

CVE-2022-1016

David Bouman discovered a flaw in the netfilter subsystem where the

nft_do_chain function did not initialize register data that

nf_tables expressions can read from and write to. A local attacker

can take advantage of this to read sensitive information.

CVE-2022-1048

Hu Jiahui discovered a race condition in the sound subsystem that

can result in a use-after-free. A local user permitted to access a

PCM sound device can take advantage of this flaw to crash the

system or potentially for privilege escalation.

CVE-2022-1158

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered a bug in the

KVM implementation for x86 processors. A local user with access to

/dev/kvm could cause the MMU emulator to update page table entry

flags at the wrong address. They could exploit this to cause a

denial of service (memory corruption or crash) or possibly for

privilege escalation.

CVE-2022-1195

Lin Ma discovered race conditions in the 6pack and mkiss hamradio

drivers, which could lead to a use-after-free. A local user could

exploit these to cause a denial of service (memory corruption or

crash) or possibly for privilege escalation.

CVE-2022-1198

Duoming Zhou discovered a race condition in the 6pack hamradio

driver, which could lead to a use-after-free. A local user could

exploit this to cause a denial of service (memory corruption or

crash) or possibly for privilege escalation.

CVE-2022-1199, CVE-2022-1204, CVE-2022-1205

Duoming Zhou discovered race conditions in the AX.25 hamradio

protocol, which could lead to a use-after-free or null pointer

dereference. A local user could exploit this to cause a denial of

service (memory corruption or crash) or possibly for privilege

escalation.

CVE-2022-1353

The TCS Robot tool found an information leak in the PF_KEY

subsystem. A local user can receive a netlink message when an

IPsec daemon reegisters with the kernel, and this could include

sensitive information.

CVE-2022-1516

A NULL pointer dereference flaw in the implementation of the X.25

set of standardized network protocols, which can result in denial

of service.

This driver is not enabled in Debian's official kernel

configurations.

CVE-2022-26490

Buffer overflows in the STMicroelectronics ST21NFCA core driver can

result in denial of service or privilege escalation.

This driver is not enabled in Debian's official kernel

configurations.

CVE-2022-27666

"valis" reported a possible buffer overflow in the IPsec ESP

transformation code. A local user can take advantage of this flaw to

cause a denial of service or for privilege escalation.

CVE-2022-28356

Beraphin discovered that the ANSI/IEEE 802.2 LLC type 2 driver did

not properly perform reference counting on some error paths. A

local attacker can take advantage of this flaw to cause a denial

of service.

CVE-2022-28388

A double free vulnerability was discovered in the 8 devices USB2CAN

interface driver.

CVE-2022-28389

A double free vulnerability was discovered in the Microchip CAN BUS

Analyzer interface driver.

CVE-2022-28390

A double free vulnerability was discovered in the EMS CPC-USB/ARM7

CAN/USB interface driver.

CVE-2022-29582

Jayden Rivers and David Bouman discovered a user-after-free

vulnerability in the io_uring subystem due to a race condition in

io_uring timeouts. A local unprivileged user can take advantage of

this flaw for privilege escalation.

For the stable distribution (bullseye), these problems have been fixed in version 5.10.113-1.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security tracker page at:

Information on source package linux

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : openjdk-17

CVE ID : CVE-2022-21426 CVE-2022-21434 CVE-2022-21443 CVE-2022-21449

CVE-2022-21476 CVE-2022-21496

Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in information disclosure, incorrect validation of ECDSA signatures or denial of service.

For the stable distribution (bullseye), these problems have been fixed in version 17.0.3+7-1~deb11u1.

We recommend that you upgrade your openjdk-17 packages.

For the detailed security status of openjdk-17 please refer to its security tracker page at:

Information on source package openjdk-17

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : firefox-esr

CVE ID : CVE-2022-29909 CVE-2022-29911 CVE-2022-29912 CVE-2022-29914

CVE-2022-29916 CVE-2022-29917

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing.

For the oldstable distribution (buster), these problems have been fixed in version 91.9.0esr-1~deb10u1.

For the stable distribution (bullseye), these problems have been fixed in version 91.9.0esr-1~deb11u1.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to its security tracker page at:

Information on source package firefox-esr

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : dpdk

CVE ID : CVE-2021-3839 CVE-2022-0669

Two vulnerabilities were discovered in the vhost code of DPDK, a set of libraries for fast packet processing, which could result in denial of service or the execution of arbitrary code.

The oldstable distribution (buster) is not affected.

For the stable distribution (bullseye), these problems have been fixed in version 20.11.5-1~deb11u1.

We recommend that you upgrade your dpdk packages.

For the detailed security status of dpdk please refer to its security tracker page at:

Information on source package dpdk

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : openjdk-11

CVE ID : CVE-2022-21496 CVE-2022-21476 CVE-2022-21449

CVE-2022-21443 CVE-2022-21434 CVE-2022-21426

Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in information disclosure or denial of service.

For the oldstable distribution (buster), this problem has been fixed in version 11.0.15+10-1~deb10u1.

For the stable distribution (bullseye), this problem has been fixed in version 11.0.15+10-1~deb11u1.

We recommend that you upgrade your openjdk-11 packages.

For the detailed security status of openjdk-11 please refer to its security tracker page at:

Information on source package openjdk-11

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : ecdsautils

CVE ID : CVE-2022-24884

It was discovered that ecdsautils, a collection of ECDSA elliptic curve cryptography CLI tools verified some cryptographic signatures incorrectly:

A signature consisting only of zeroes was always considered valid, making it trivial to forge signatures.

For the oldstable distribution (buster), this problem has been fixed in version 0.3.2+git20151018-2+deb10u1.

For the stable distribution (bullseye), this problem has been fixed in version 0.3.2+git20151018-2+deb11u1.

We recommend that you upgrade your ecdsautils packages.

For the detailed security status of ecdsautils please refer to its security tracker page at:

Information on source package ecdsautils

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : qemu

CVE ID : CVE-2022-26353 CVE-2022-26354 CVE-2021-4206

CVE-2021-4207 CVE-2022-0358

Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service or the execution of arbitrary code.

For the stable distribution (bullseye), this problem has been fixed in version 1:5.2+dfsg-11+deb11u2.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to its security tracker page at:

Information on source package qemu

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : chromium

CVE ID : CVE-2022-1633 CVE-2022-1634 CVE-2022-1635 CVE-2022-1636

CVE-2022-1637 CVE-2022-1638 CVE-2022-1639 CVE-2022-1640

CVE-2022-1641

Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

For the stable distribution (bullseye), these problems have been fixed in version 101.0.4951.64-1~deb11u1.

We recommend that you upgrade your chromium packages.

For the detailed security status of chromium please refer to its security tracker page at:

Information on source package chromium

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : postgresql-11

CVE ID : CVE-2022-1552

Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the "security-restricted operation" sandbox.

For additional information please refer to the upstream announcement at https://www.postgresql.org/support/security/CVE-2022-1552/

For the oldstable distribution (buster), this problem has been fixed in version 11.16-0+deb10u1.

We recommend that you upgrade your postgresql-11 packages.

For the detailed security status of postgresql-11 please refer to its security tracker page at:

Information on source package postgresql-11

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : postgresql-13

CVE ID : CVE-2022-1552

Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the "security-restricted operation" sandbox.

For additional information please refer to the upstream announcement at https://www.postgresql.org/support/security/CVE-2022-1552/

For the stable distribution (bullseye), this problem has been fixed in version 13.7-0+deb11u1.

We recommend that you upgrade your postgresql-13 packages.

For the detailed security status of postgresql-13 please refer to its security tracker page at:

Information on source package postgresql-13

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : needrestart

CVE ID : CVE-2022-30688

Jakub Wilk discovered a local privilege escalation in needrestart, a utility to check which daemons need to be restarted after library upgrades. Regular expressions to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.

For the oldstable distribution (buster), this problem has been fixed in version 3.4-5+deb10u1.

For the stable distribution (bullseye), this problem has been fixed in version 3.5-4+deb11u1.

We recommend that you upgrade your needrestart packages.

For the detailed security status of needrestart please refer to its security tracker page at:

Information on source package needrestart

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : waitress

CVE ID : CVE-2022-24761

Debian Bug : 1008013

It was discovered that the Waitress WSGI server was susceptible to HTTP request smuggling in some scenarios when used behind a proxy.

For the oldstable distribution (buster), this problem has been fixed in version 1.2.0~b2-2+deb10u1.

For the stable distribution (bullseye), this problem has been fixed in version 1.4.4-1.1+deb11u1.

We recommend that you upgrade your waitress packages.

For the detailed security status of waitress please refer to its security tracker page at:

Information on source package waitress

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : openssl

CVE ID : CVE-2022-1292

Elison Niven discovered that the c_rehash script included in OpenSSL did not sanitise shell meta characters which could result in the execution of arbitrary commands.

For the oldstable distribution (buster), this problem has been fixed in version 1.1.1n-0+deb10u2.

For the stable distribution (bullseye), this problem has been fixed in version 1.1.1n-0+deb11u2.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to its security tracker page at:

Information on source package openssl

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : openldap

CVE ID : CVE-2022-29155

Jacek Konieczny discovered a SQL injection vulnerability in the back-sql backend to slapd in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol, allowing an attacker to alter the database during an LDAP search operations when a specially crafted search filter is processed.

For the oldstable distribution (buster), this problem has been fixed in version 2.4.47+dfsg-3+deb10u7.

For the stable distribution (bullseye), this problem has been fixed in version 2.4.57+dfsg-3+deb11u1.

We recommend that you upgrade your openldap packages.

For the detailed security status of openldap please refer to its security tracker page at:

Information on source package openldap

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : thunderbird

CVE ID : CVE-2022-1520 CVE-2022-29909 CVE-2022-29911 CVE-2022-29912

CVE-2022-29913 CVE-2022-29914 CVE-2022-29916 CVE-2022-29917

Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.

For the oldstable distribution (buster), these problems have been fixed in version 1:91.9.0-1~deb10u1.

For the stable distribution (bullseye), these problems have been fixed in version 1:91.9.0-1~deb11u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to its security tracker page at:

Information on source package thunderbird

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : libxml2

CVE ID : CVE-2022-29824

Debian Bug : 1010526

Felix Wilhelm reported that several buffer handling functions in libxml2, a library providing support to read, modify and write XML and HTML files, don't check for integer overflows, resulting in out-of-bounds memory writes if specially crafted, multi-gigabyte XML files are processed. An attacker can take advantage of this flaw for denial of service or execution of arbitrary code.

For the oldstable distribution (buster), this problem has been fixed in version 2.9.4+dfsg1-7+deb10u4.

For the stable distribution (bullseye), this problem has been fixed in version 2.9.10+dfsg-6.7+deb11u2.

We recommend that you upgrade your libxml2 packages.

For the detailed security status of libxml2 please refer to its security tracker page at:

Information on source package libxml2

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Package : firefox-esr

CVE ID : CVE-2022-1529 CVE-2022-1802

Manfred Paul discovered two security issues in the Mozilla Firefox web browser, which could result in the execution of arbitrary code.

For the oldstable distribution (buster), these problems have been fixed in version 91.9.1esr-1~deb10u1.

For the stable distribution (bullseye), these problems have been fixed in version 91.9.1esr-1~deb11u1.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to its security tracker page at:

Information on source package firefox-esr

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/