Debian GNU/Linux 8 (Jessie), 9 (Stretch), 10 (Buster) Extended LTS:
ELA-1241-1 amd64-microcode security update
ELA-1243-1 ghostscript security update
ELA-1242-1 intel-microcode security update
ELA-1241-1 amd64-microcode security update
Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 3963-1] ansible security update
[DLA 3965-1] ghostscript security update
[DSA 5818-1] linux security update
[DLA 3964-1] intel-microcode security update
[SECURITY] [DLA 3963-1] ansible security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3963-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Bastien Roucariès
November 23, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ansible
Version : 2.10.7+merged+base+2.10.17+dfsg-0+deb11u2
CVE ID : CVE-2024-8775 CVE-2024-9902
Debian Bug : 1082851
Ansible is a command-line IT automation software application.
It can configure systems, deploy software, and orchestrate
advanced workflows to support application deployment, system updates, ...
Ansible was affected by two vulnerabilities:
CVE-2024-8775
A flaw was found in Ansible, where sensitive information stored in
Ansible Vault files can be exposed in plaintext during the execution
of a playbook. This occurs when using tasks such as include_vars to
load vaulted variables without setting the no_log: true parameter,
resulting in sensitive data being printed in the playbook output or
logs. This can lead to the unintentional disclosure of secrets like
passwords or API keys, compromising security and potentially
allowing unauthorized access or actions.
CVE-2024-9902
The ansible-core `user` module can allow an unprivileged user to
silently create or replace the contents of any file on any system path
and take ownership of it when a privileged user executes
the `user` module against the unprivileged user's home directory.
If the unprivileged user has traversal permissions on the directory
containing the exploited target file, they retain full control
over the contents of the file as its owner.
For Debian 11 bullseye, these problems have been fixed in version
2.10.7+merged+base+2.10.17+dfsg-0+deb11u2.
We recommend that you upgrade your ansible packages.
For the detailed security status of ansible please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ansible
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1241-1 amd64-microcode security update
Package : amd64-microcode
Version : 3.20240820.1~deb8u1 (jessie), 3.20240820.1~deb9u1 (stretch), 3.20240820.1~deb10u1 (buster)
Related CVEs :
CVE-2023-20569
CVE-2023-20584
CVE-2023-31315
CVE-2023-31356
AMD has released microcode updates to address multiple vulnerabilties.
This release requires either new-enough system firmware, or a
recent-enough Linux kernel to properly work on AMD Genoa and Bergamo
processors.
The firmware requirement is AGESA 1.0.0.8 or newer.
The Linux kernel requirement is a group of patches that are already
present in the Linux stable/LTS/ELTS trees since versions: v4.19.289,
v5.4.250, v5.10.187, v5.15.120, v6.1.37, v6.3.11 and v6.4.1. These
patches are also present in Linux v6.5-rc1.
CVE-2023-20569
A side channel vulnerability on some of the AMD CPUs may allow an
attacker to influence the return address prediction. This may result
in speculative execution at an attacker-controlled?address,
potentially leading to information disclosure.
CVE-2023-20569 had been previously reported as fixed in an earlier
update, this update expands the fixes to 4th Gen AMD EPYC
processors, Genoa (Family=0x19 Model=0x11) and Bergamo (Family=0x19
Model=0xa0). See Debian bug #1043381 for details.
CVE-2023-20584
IOMMU improperly handles certain special address ranges with invalid
device table entries (DTEs), which may allow an attacker with
privileges and a compromised Hypervisor to induce DTE faults to
bypass RMP checks in SEV-SNP, potentially leading to a loss of guest
integrity.
CVE-2023-31315
Improper validation in a model specific register (MSR) could allow a
malicious program with ring0 access to modify SMM configuration
while SMI lock is enabled, potentially leading to arbitrary code
execution.
CVE-2023-31356
Incomplete system memory cleanup in SEV firmware could allow a
privileged attacker to corrupt guest private memory, potentially
resulting in a loss of data integrity.
T
[SECURITY] [DLA 3965-1] ghostscript security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3965-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
November 24, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ghostscript
Version : 9.53.3~dfsg-7+deb11u9
CVE ID : CVE-2024-46951 CVE-2024-46953 CVE-2024-46955 CVE-2024-46956
Multiple vulnerabilities have been fixed in the PostScript/PDF
interpreter Ghostscript.
CVE-2024-46951
PS interpreter unchecked pointer
CVE-2024-46953
output filename format string integer overflow
CVE-2024-46955
PS interpreter out-of-bounds
CVE-2024-46956
PS interpreter out-of-bounds
For Debian 11 bullseye, these problems have been fixed in version
9.53.3~dfsg-7+deb11u9.
We recommend that you upgrade your ghostscript packages.
For the detailed security status of ghostscript please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ghostscript
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DSA 5818-1] linux security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5818-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 24, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : linux
CVE ID : CVE-2022-45888 CVE-2023-52812 CVE-2024-26952 CVE-2024-26954
CVE-2024-35964 CVE-2024-36244 CVE-2024-36478 CVE-2024-36914
CVE-2024-36915 CVE-2024-36923 CVE-2024-38540 CVE-2024-38553
CVE-2024-41080 CVE-2024-42322 CVE-2024-43868 CVE-2024-43904
CVE-2024-43911 CVE-2024-44949 CVE-2024-49950 CVE-2024-49960
CVE-2024-49974 CVE-2024-49986 CVE-2024-49991 CVE-2024-50012
CVE-2024-50036 CVE-2024-50067 CVE-2024-50072 CVE-2024-50126
CVE-2024-50215 CVE-2024-50218 CVE-2024-50228 CVE-2024-50229
CVE-2024-50230 CVE-2024-50232 CVE-2024-50233 CVE-2024-50234
CVE-2024-50235 CVE-2024-50236 CVE-2024-50237 CVE-2024-50242
CVE-2024-50243 CVE-2024-50244 CVE-2024-50245 CVE-2024-50247
CVE-2024-50249 CVE-2024-50250 CVE-2024-50251 CVE-2024-50252
CVE-2024-50255 CVE-2024-50256 CVE-2024-50257 CVE-2024-50259
CVE-2024-50261 CVE-2024-50262 CVE-2024-50264 CVE-2024-50265
CVE-2024-50267 CVE-2024-50268 CVE-2024-50269 CVE-2024-50271
CVE-2024-50272 CVE-2024-50273 CVE-2024-50276 CVE-2024-50278
CVE-2024-50279 CVE-2024-50280 CVE-2024-50282 CVE-2024-50283
CVE-2024-50284 CVE-2024-50286 CVE-2024-50287 CVE-2024-50290
CVE-2024-50292 CVE-2024-50295 CVE-2024-50296 CVE-2024-50299
CVE-2024-50301 CVE-2024-50302 CVE-2024-53042 CVE-2024-53043
CVE-2024-53052 CVE-2024-53054 CVE-2024-53055 CVE-2024-53057
CVE-2024-53058 CVE-2024-53059 CVE-2024-53060 CVE-2024-53061
CVE-2024-53063 CVE-2024-53066 CVE-2024-53070 CVE-2024-53072
CVE-2024-53081 CVE-2024-53082 CVE-2024-53088 CVE-2024-53093
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
For the stable distribution (bookworm), these problems have been fixed in
version 6.1.119-1.
We recommend that you upgrade your linux packages.
For the detailed security status of linux please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/linux
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 3964-1] intel-microcode security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3964-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Tobias Frost
November 24, 2024 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : intel-microcode
Version : 3.20240910.1~deb11u1
CVE ID : CVE-2024-23984 CVE-2024-24968
Debian Bug : 1081363
A microcode update has been released for Intel processors, addressing
multiple vulnerabilties which potentially could cause information
disclosue or local DoS.
CVE-2024-23984
Observable discrepancy in RAPL interface for some Intel(R)
Processors may allow a privileged user to potentially enable
information disclosure via local access.
CVE-2024-24968
Improper finite state machines (FSMs) in hardware logic in some
Intel(R) Processors may allow an privileged user to potentially
enable a denial of service via local access.
For Debian 11 bullseye, these problems have been fixed in version
3.20240910.1~deb11u1.
We recommend that you upgrade your intel-microcode packages.
For the detailed security status of intel-microcode please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/intel-microcode
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1243-1 ghostscript security update
Package : ghostscript
Version : 9.26a~dfsg-0+deb8u13 (jessie), 9.26a~dfsg-0+deb9u13 (stretch), 9.27~dfsg-2+deb10u10 (buster)
Related CVEs :
CVE-2024-46951
CVE-2024-46953
CVE-2024-46955
CVE-2024-46956
Multiple vulnerabilities have been fixed in the PostScript/PDF
interpreter Ghostscript.
CVE-2024-46951
PS interpreter unchecked pointer
CVE-2024-46953
output filename format string integer overflow
CVE-2024-46955
PS interpreter out-of-bounds
CVE-2024-46956
PS interpreter out-of-bounds
ELA-1242-1 intel-microcode security update
Package : intel-microcode
Version : 3.20240910.1~deb8u1 (jessie), 3.20240910.1~deb9u1 (stretch), 3.20240910.1~deb10u1 (buster)
Related CVEs :
CVE-2024-23984
CVE-2024-24968
A microcode update has been released for Intel processors, addressing
multiple vulnerabilties which potentially could cause information
disclosue or local DoS.
CVE-2024-23984
Observable discrepancy in RAPL interface for some Intel(R)
Processors may allow a privileged user to potentially enable
information disclosure via local access.
CVE-2024-24968
Improper finite state machines (FSMs) in hardware logic in some
Intel(R) Processors may allow an privileged user to potentially
enable a denial of service via local access.
ELA-1241-1 amd64-microcode security update
Package : amd64-microcode
Version : 3.20240820.1~deb8u1 (jessie), 3.20240820.1~deb9u1 (stretch), 3.20240820.1~deb10u1 (buster)
Related CVEs :
CVE-2023-20569
CVE-2023-20584
CVE-2023-31315
CVE-2023-31356
AMD has released microcode updates to address multiple vulnerabilties.
This release requires either new-enough system firmware, or a
recent-enough Linux kernel to properly work on AMD Genoa and Bergamo
processors.
The firmware requirement is AGESA 1.0.0.8 or newer.
The Linux kernel requirement is a group of patches that are already
present in the Linux stable/LTS/ELTS trees since versions: v4.19.289,
v5.4.250, v5.10.187, v5.15.120, v6.1.37, v6.3.11 and v6.4.1. These
patches are also present in Linux v6.5-rc1.
CVE-2023-20569
A side channel vulnerability on some of the AMD CPUs may allow an
attacker to influence the return address prediction. This may result
in speculative execution at an attacker-controlled?address,
potentially leading to information disclosure.
CVE-2023-20569 had been previously reported as fixed in an earlier
update, this update expands the fixes to 4th Gen AMD EPYC
processors, Genoa (Family=0x19 Model=0x11) and Bergamo (Family=0x19
Model=0xa0). See Debian bug #1043381 for details.
CVE-2023-20584
IOMMU improperly handles certain special address ranges with invalid
device table entries (DTEs), which may allow an attacker with
privileges and a compromised Hypervisor to induce DTE faults to
bypass RMP checks in SEV-SNP, potentially leading to a loss of guest
integrity.
CVE-2023-31315
Improper validation in a model specific register (MSR) could allow a
malicious program with ring0 access to modify SMM configuration
while SMI lock is enabled, potentially leading to arbitrary code
execution.
CVE-2023-31356
Incomplete system memory cleanup in SEV firmware could allow a
privileged attacker to corrupt guest private memory, potentially
resulting in a loss of data integrity.
