You are here
Debian Security
DSA-5791-1 python-reportlab - security update
Elyas Damej discovered that a sandbox mechanism in ReportLab, a Python
library to create PDF documents, could be bypassed which may result in
the execution of arbitrary code when converting malformed HTML to a PDF
document.
Categories: Security
DSA-5790-1 node-dompurify - security update
It was discovered that DOMPurify, a sanitizer for HTML, MathML and SVG was
susceptible to nesting-based mXSS.
Categories: Security
DSA-5789-1 thunderbird - security update
Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code.
Categories: Security
DSA-5788-1 firefox-esr - security update
Damien Schaeffer discovered a use-after-free in the Mozilla Firefox web
browser, which could result in the execution of arbitrary code.
Categories: Security
DSA-5787-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-5729-2 apache2 - regression update
The fixes for CVE-2024-38474 and CVE-2024-39884 introduced two
regressions in mod_rewrite and mod_proxy.
Categories: Security
DSA-5786-1 libgsf - security update
Integer overflows flaws were discovered in the Compound Document Binary
File format parser of libgsf, the GNOME Project G Structured File
Library, which could result in the execution of arbitrary code if a
specially crafted file is processed.
Categories: Security
DSA-5785-1 mediawiki - security update
Dom Walden discovered that the AbuseFilter extension in MediaWiki, a
website engine for collaborative work, performed incomplete authorisation
checks.
Categories: Security
DSA-5784-1 oath-toolkit - security update
Fabian Vogt reported that the PAM module in oath-toolkit, a collection
of components to build one-time password authentication systems, does
not safely perform file operations in users's home directories when
using the usersfile feature (allowing to place the OTP state in the home
directory of the to-be-authenticated user). A local user can take
advantage of this flaw for root privilege escalation.
Categories: Security
DSA-5783-1 firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox
web browser, which could potentially result in the execution
of arbitrary code.
Debian follows the extended support releases (ESR) of Firefox. Starting with this update we're now following the 128.x releases.
Between 115.x and 128.x, Firefox has seen a number of feature updates. For more information please refer to https://www.mozilla.org/en-US/firefox/128.0esr/releasenotes/
Categories: Security
DSA-5782-1 linux - security update
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
Categories: Security
DSA-5781-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-5780-1 php8.2 - security update
Multiple security issues were found in PHP, a widely-used open source
general purpose scripting language which could result in incorrect
parsing of multipart/form-data, bypass of the cgi.force_direct directive
or incorrect logging.
Categories: Security
DSA-5779-1 cups - security update
Simone Margaritelli reported that cups, the Common UNIX Printing System,
does not properly sanitize IPP attributes when creating PPD files, which
may result in the execution of arbitrary code.
Categories: Security
DSA-5778-1 cups-filters - security update
Simone Margaritelli reported several vulnerabilities in cups-filters.
Missing validation of IPP attributes returned from an IPP server and
multiple bugs in the cups-browsed component can result in the execution
of arbitrary commands without authentication when a print job is
started.
Categories: Security
DSA-5777-1 booth - security update
It was discovered that the Booth cluster ticket manager failed to
correctly validate some authentication hashes.
Categories: Security
DSA-5776-1 tryton-server - security update
Albert Cervera discovered two missing authorisation checks in the Tryton
application platform.
Categories: Security
DSA-5775-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-5774-1 ruby-saml - security update
It was discovered that ruby-saml, a SAML library implementing the client
side of a SAML authorization, does not properly verify the signature of
the SAML Response, which could result in bypass of authentication in an
application using the ruby-saml library.
Categories: Security
DSA-5773-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
Pages
Co-authored by Creative Contingencies's Peter Lieverdink.