You are here
Debian Security
DSA-5887-1 exim4 - security update
It was discovered that a use-after-free vulnerability in Exim4, a mail
transport agent, may result in privilege escalation for a local
attacker.
Categories: Security
DSA-5886-1 ruby-rack - security update
Multiple security issues were found in Rack, an interface for developing
web applications in Ruby, which could result in log injection or
information disclosure.
Categories: Security
DSA-5885-1 webkit2gtk - security update
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
CVE-2024-44192
Tashita Software Security discovered that processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2024-54467
Narendra Bhati discovered that a malicious website may exfiltrate data cross-origin.
CVE-2025-24201
Apple discovered that maliciously crafted web content may be able to break out of Web Content sandbox.
Categories: Security
DSA-5884-1 libxslt - security update
Ivan Fratric discovered two use-after-free vulnerabilities in libxslt,
an XSLT processing runtime library, which may result in the execution of
arbitrary code if a specially crafted files are processed.
Categories: Security
DSA-5883-1 mercurial - security update
A cross-site scripting vulnerability was discovered in hgweb, the
integrated stand-alone web interface of the Mercurial version control
system.
Categories: Security
DSA-5882-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-5881-1 rails - security update
Multiple security issues were discovered in the Rails web framework
which could result cross-site scripting, information disclosure, denial
of service or bypass of content security policies.
Categories: Security
DSA-5880-1 freetype - security update
An out-of-bounds write vulnerability when attempting to parse font
subglyph structures related to TrueType GX and variable font files was
discovered in FreeType, which may result in the execution of arbitrary
code when processing specially crafted fonts.
Categories: Security
DSA-5879-1 opensaml - security update
Alexander Tan discovered that the OpenSAML C++ library was susceptible
to forging of signed SAML messages. For additional details please refer
to the upstream advisory at
https://shibboleth.net/community/advisories/secadv_20250313.txt
Categories: Security
DSA-5878-1 php8.2 - security update
Multiple security issues were found in PHP, a widely-used open source
general purpose scripting language which could result in denial of
service or HTTP request smuggling.
Categories: Security
DSA-5877-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-5876-1 thunderbird - security update
Multiple security issues were discovered in Thunderbird, which could
result in denial of service or the execution of arbitrary code.
Categories: Security
DSA-5875-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-5874-1 firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code.
Categories: Security
DSA-5873-1 libreoffice - security update
Amel Bouziane-Leblond discovered that insufficient validation of
"vnd.libreoffice.command" URI schemes could result in the execution of
arbitrary macro commands.
Categories: Security
DSA-5872-1 xorg-server - security update
Jan-Niklas Sohn discovered several vulnerabilities in the Xorg X server,
which may result in privilege escalation if the X server is running
privileged.
Categories: Security
DSA-5871-1 emacs - security update
Two security vulnerabilities were discovered in Emacs:
CVE-2024-53920
Elisp byte-compilation ('elisp-flymake-byte-compile') in the Flymake mode is now disabled for untrusted files.
CVE-2025-1244
An incomplete escaping of shell meta characters in the man reader component could potentially result in the execution of arbitrary shell commands. Discovered by Maxim Nikulin.
Categories: Security
DSA-5870-1 openh264 - security update
A heap-based buffer overflow flaw in the decoding functions of openh264,
a codec library which supports H.264 encoding and decoding, may allow a
remote attacker to cause a denial of service or the execution of
arbitrary code if a specially crafted video is processed.
Categories: Security
DSA-5869-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-5868-1 openssh - security update
The Qualys Threat Research Unit (TRU) discovered that the OpenSSH client
is vulnerable to a machine-in-the-middle attack if the VerifyHostKeyDNS
option is enabled (disabled by default).
Details can be found in the Qualys advisory at https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt
Categories: Security
Pages
Co-authored by Creative Contingencies's Peter Lieverdink.