Beiträge von Micha

    Package : thunderbird

    CVE ID : CVE-2024-1546 CVE-2024-1547 CVE-2024-1548 CVE-2024-1549

    CVE-2024-1550 CVE-2024-1551 CVE-2024-1552 CVE-2024-1553


    Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.


    For the oldstable distribution (bullseye), these problems have been fixed in version 1:115.8.0-1~deb11u1.


    For the stable distribution (bookworm), these problems have been fixed in version 1:115.8.0-1~deb12u1.


    We recommend that you upgrade your thunderbird packages.


    For the detailed security status of thunderbird please refer to its security tracker page at:

    Information on source package thunderbird


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : chromium

    CVE ID : CVE-2024-1669 CVE-2024-1670 CVE-2024-1671 CVE-2024-1672

    CVE-2024-1673 CVE-2024-1674 CVE-2024-1675 CVE-2024-1676


    Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.


    For the stable distribution (bookworm), these problems have been fixed in version 122.0.6261.57-1~deb12u1.


    We recommend that you upgrade your chromium packages.


    For the detailed security status of chromium please refer to its security tracker page at:

    Information on source package chromium


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : imagemagick

    CVE ID : CVE-2021-3610 CVE-2022-1115 CVE-2023-1289 CVE-2023-1906

    CVE-2023-3428 CVE-2023-5341 CVE-2023-34151

    Debian Bug : 1013282 1036999


    This update fixes multiple vulnerabilities in Imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or potentially the execution of arbitrary code if malformed image files are processed.


    For the oldstable distribution (bullseye), these problems have been fixed in version 8:6.9.11.60+dfsg-1.3+deb11u3.


    For the stable distribution (bookworm), these problems have been fixed in version 8:6.9.11.60+dfsg-1.6+deb12u1.


    We recommend that you upgrade your imagemagick packages.


    For the detailed security status of imagemagick please refer to its security tracker page at:

    Information on source package imagemagick


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : firefox-esr

    CVE ID : CVE-2024-1546 CVE-2024-1547 CVE-2024-1548 CVE-2024-1549

    CVE-2024-1550 CVE-2024-1551 CVE-2024-1552 CVE-2024-1553


    Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing.


    For the oldstable distribution (bullseye), these problems have been fixed in version 115.8.0esr-1~deb11u1.


    For the stable distribution (bookworm), these problems have been fixed in version 115.8.0esr-1~deb12u1.


    We recommend that you upgrade your firefox-esr packages.


    For the detailed security status of firefox-esr please refer to its security tracker page at:

    Information on source package firefox-esr


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : pdns-recursor

    CVE ID : CVE-2023-50387 CVE-2023-50868


    It was discovered that malformed DNSSEC records within a DNS zone could result in denial of service against PDNS Recursor, a resolving name server.


    For the stable distribution (bookworm), these problems have been fixed in version 4.8.6-1.


    We recommend that you upgrade your pdns-recursor packages.


    For the detailed security status of pdns-recursor please refer to its security tracker page at:

    Information on source package pdns-recursor


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : engrampa

    CVE ID : CVE-2023-52138


    It was discovered that Engrampa, an archive manager for the MATE desktop environment was susceptible to path traversal when handling CPIO archives.


    For the oldstable distribution (bullseye), this problem has been fixed in version 1.24.1-1+deb11u1.


    For the stable distribution (bookworm), this problem has been fixed in version 1.26.0-1+deb12u2.


    We recommend that you upgrade your engrampa packages.


    For the detailed security status of engrampa please refer to its security tracker page at:

    Information on source package engrampa


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : edk2

    CVE ID : CVE-2023-48733


    Mate Kukri discovered the Debian build of EDK2, a UEFI firmware implementation, used an insecure default configuration which could result in Secure Boot bypass via the UEFI shell.


    This updates disables the UEFI shell if Secure Boot is used.


    For the oldstable distribution (bullseye), this problem has been fixed in version 2020.11-2+deb11u2.


    For the stable distribution (bookworm), this problem has been fixed in version 2022.11-6+deb12u1. This update also addresses several security issues in the ipv6 network stack (CVE-2022-36763, CVE-2022-36764, CVE-2022-36765, CVE-2023-45230, CVE-2023-45229, CVE-2023-45231, CVE-2023-45232, CVE-2023-45233, CVE-2023-45234, CVE-2023-45235)


    We recommend that you upgrade your edk2 packages.


    For the detailed security status of edk2 please refer to its security tracker page at:

    Information on source package edk2


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : postgresql-15

    CVE ID : CVE-2024-0985


    It was discovered that a late privilege drop in the "REFRESH MATERIALIZED VIEW CONCURRENTLY" command could allow an attacker to trick a user with higher privileges to run SQL commands with these permissions.


    For the stable distribution (bookworm), this problem has been fixed in version 15.6-0+deb12u1.


    We recommend that you upgrade your postgresql-15 packages.


    For the detailed security status of postgresql-15 please refer to its security tracker page at:

    Information on source package postgresql-15


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : postgresql-13

    CVE ID : CVE-2024-0985


    It was discovered that a late privilege drop in the "REFRESH MATERIALIZED VIEW CONCURRENTLY" command could allow an attacker to trick a user with higher privileges to run SQL commands with these permissions.


    For the oldstable distribution (bullseye), this problem has been fixed in version 13.14-0+deb11u1.


    We recommend that you upgrade your postgresql-13 packages.


    For the detailed security status of postgresql-13 please refer to its security tracker page at:

    Information on source package postgresql-13


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : bind9

    CVE ID : CVE-2023-4408 CVE-2023-5517 CVE-2023-5679 CVE-2023-6516

    CVE-2023-50387 CVE-2023-50868


    Several vulnerabilities were discovered in BIND, a DNS server implementation, which may result in denial of service.


    For the oldstable distribution (bullseye), these problems have been fixed in version 1:9.16.48-1.


    For the stable distribution (bookworm), these problems have been fixed in version 1:9.18.24-1.


    We recommend that you upgrade your bind9 packages.


    For the detailed security status of bind9 please refer to its security tracker page at:

    Information on source package bind9


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : unbound

    CVE ID : CVE-2023-50387 CVE-2023-50868

    Debian Bug : 1063845


    Two vulnerabilities were discovered in unbound, a validating, recursive, caching DNS resolver. Specially crafted DNSSEC answers could lead unbound down a very CPU intensive and time costly DNSSEC

    (CVE-2023-50387) or NSEC3 hash (CVE-2023-50868) validation path, resulting in denial of service.


    Details can be found at

    https://nlnetlabs.nl/downloads/unbound/CVE-2023-50387_CVE-2023-50868.txt


    For the oldstable distribution (bullseye), these problems have been fixed in version 1.13.1-1+deb11u2.


    For the stable distribution (bookworm), these problems have been fixed in version 1.17.1-2+deb12u2.


    We recommend that you upgrade your unbound packages.


    For the detailed security status of unbound please refer to its security tracker page at:

    Information on source package unbound


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : libgit2

    CVE ID : CVE-2024-24577 CVE-2024-24575


    Two vulnerabilities were discovered in libgit2, a low-level Git library, which may result in denial of service or potentially the execution of arbitrary code.


    For the oldstable distribution (bullseye), this problem has been fixed in version 1.1.0+dfsg.1-4+deb11u2.


    For the stable distribution (bookworm), this problem has been fixed in version 1.5.1+ds-1+deb12u1.


    We recommend that you upgrade your libgit2 packages.


    For the detailed security status of libgit2 please refer to its security tracker page at:

    Information on source package libgit2


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : webkit2gtk

    CVE ID : CVE-2024-23206 CVE-2024-23213 CVE-2024-23222


    The following vulnerabilities have been discovered in the WebKitGTK web engine:


    CVE-2024-23206


    An anonymous researcher discovered that a maliciously crafted

    webpage may be able to fingerprint the user.


    CVE-2024-23213


    Wangtaiyu discovered that processing web content may lead to

    arbitrary code execution.


    CVE-2024-23222


    Apple discovered that processing maliciously crafted web content

    may lead to arbitrary code execution. Apple is aware of a report

    that this issue may have been exploited.


    For the oldstable distribution (bullseye), these problems have been fixed in version 2.42.5-1~deb11u1.


    For the stable distribution (bookworm), these problems have been fixed in version 2.42.5-1~deb12u1.


    We recommend that you upgrade your webkit2gtk packages.


    For the detailed security status of webkit2gtk please refer to its security tracker page at:

    Information on source package webkit2gtk


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : chromium

    CVE ID : CVE-2024-1283 CVE-2024-1284


    Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.


    For the stable distribution (bookworm), these problems have been fixed in version 121.0.6167.160-1~deb12u1.


    We recommend that you upgrade your chromium packages.


    For the detailed security status of chromium please refer to its security tracker page at:

    Information on source package chromium


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : ruby-sanitize

    CVE ID : CVE-2023-36823


    It was discovered that ruby-sanitize, a whitelist-based HTML sanitizer, insufficiently sanitised <style> elements, which may result in cross-site scripting.


    For the oldstable distribution (bullseye), this problem has been fixed in version 5.2.1-2+deb11u1.


    For the stable distribution (bookworm), this problem has been fixed in version 6.0.0-1.1+deb12u1.


    We recommend that you upgrade your ruby-sanitize packages.


    For the detailed security status of ruby-sanitize please refer to its security tracker page at:

    Information on source package ruby-sanitize


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : runc

    CVE ID : CVE-2024-21626


    It was discovered that runc, a command line client for running applications packaged according to the Open Container Format (OCF), was suspectible to multiple container breakouts due to an internal file descriptor leak.


    For the oldstable distribution (bullseye), this problem has been fixed in version 1.0.0~rc93+ds1-5+deb11u3.


    For the stable distribution (bookworm), this problem has been fixed in version 1.1.5+ds1-1+deb12u1.


    We recommend that you upgrade your runc packages.


    For the detailed security status of runc please refer to its security tracker page at:

    Information on source package runc


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : zbar

    CVE ID : CVE-2023-40889 CVE-2023-40890

    Debian Bug : 1051724


    Two vulnerabilities were discovered in zbar, a library for scanning and decoding QR and bar codes, which may result in denial of service, information disclosure or potentially the execution of arbitrary code if a specially crafted code is processed.


    For the oldstable distribution (bullseye), these problems have been fixed in version 0.23.90-1+deb11u1.


    For the stable distribution (bookworm), these problems have been fixed in version 0.23.92-7+deb12u1.


    We recommend that you upgrade your zbar packages.


    For the detailed security status of zbar please refer to its security tracker page at:

    Information on source package zbar


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : openjdk-17

    CVE ID : CVE-2024-20918 CVE-2024-20919 CVE-2024-20921 CVE-2024-20926

    CVE-2024-20932 CVE-2024-20945 CVE-2024-20952


    Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in side channel attacks, leaking sensitive data to log files, denial of service or bypass of sandbox restrictions.


    For the oldstable distribution (bullseye), these problems have been fixed in version 17.0.10+7-1~deb11u1.


    For the stable distribution (bookworm), these problems have been fixed in version 17.0.10+7-1~deb12u1.


    We recommend that you upgrade your openjdk-17 packages.


    For the detailed security status of openjdk-17 please refer to its security tracker page at:

    Information on source package openjdk-17


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : chromium

    CVE ID : CVE-2024-1059 CVE-2024-1060 CVE-2024-1077


    Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.


    For the stable distribution (bookworm), these problems have been fixed in version 121.0.6167.139-1~deb12u1.


    We recommend that you upgrade your chromium packages.


    For the detailed security status of chromium please refer to its security tracker page at:

    Information on source package chromium


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Package : glibc

    CVE ID : CVE-2023-6246 CVE-2023-6779 CVE-2023-6780


    The Qualys Research Labs discovered several vulnerabilities in the GNU C Library's __vsyslog_internal() function (called by syslog() and vsyslog()). A heap-based buffer overflow (CVE-2023-6246), an off-by-one heap overflow (CVE-2023-6779) and an integer overflow (CVE-2023-6780) can be exploited for privilege escalation or denial of service.


    Details can be found in the Qualys advisory at https://www.qualys.com/2024/01/30/syslog


    Additionally a memory corruption was discovered in the glibc's qsort() function, due to missing bounds check and when called by a program with a non-transitive comparison function and a large number of attacker-controlled elements. As the use of qsort() with a non-transitive comparison function is undefined according to POSIX and ISO C standards, this is not considered a vulnerability in the glibc itself. However the qsort() implementation was hardened against misbehaving callers.


    Details can be found in the Qualys advisory at https://www.qualys.com/2024/01/30/qsort


    For the stable distribution (bookworm), these problems have been fixed in version 2.36-9+deb12u4.


    We recommend that you upgrade your glibc packages.


    For the detailed security status of glibc please refer to its security tracker page at:

    Information on source package glibc


    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/