[DSA 5584-1] bluez security update
[DSA 5583-1] gst-plugins-bad1.0 security update
[DSA 5582-1] thunderbird security update
[DSA 5585-1] chromium security update
ELA-910-1 amd64-microcode security update
[DSA 5584-1] bluez security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5584-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
December 21, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : bluez
CVE ID : CVE-2023-45866
Debian Bug : 1057914
It was reported that the BlueZ's HID profile implementation is not
inline with the HID specification which mandates the use of Security
Mode 4. The HID profile configuration option ClassicBondedOnly now
defaults to "true" to make sure that input connections only come from
bonded device connections.
For the oldstable distribution (bullseye), this problem has been fixed
in version 5.55-3.1+deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 5.66-1+deb12u1.
We recommend that you upgrade your bluez packages.
For the detailed security status of bluez please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/bluez
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5583-1] gst-plugins-bad1.0 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5583-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 21, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : gst-plugins-bad1.0
CVE ID : not yet available
A buffer overflow was discovered in the AV1 video plugin for the
GStreamer media framework, which may result in denial of service or
potentially the execution of arbitrary code if a malformed media file
is opened.
The oldstable distribution (bullseye) is not affected.
For the stable distribution (bookworm), this problem has been fixed in
version 1.22.0-4+deb12u4.
We recommend that you upgrade your gst-plugins-bad1.0 packages.
For the detailed security status of gst-plugins-bad1.0 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gst-plugins-bad1.0
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5582-1] thunderbird security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5582-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 21, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : thunderbird
CVE ID : CVE-2023-6856 CVE-2023-6857 CVE-2023-6858 CVE-2023-6859
CVE-2023-6860 CVE-2023-6861 CVE-2023-6862 CVE-2023-6864
CVE-2023-6873 CVE-2023-50761 CVE-2023-50762
Multiple security issues were discovered in Thunderbird, which could
result in denial of service, the execution of arbitrary code or spoofing
of signed PGP/MIME and SMIME emails.
For the oldstable distribution (bullseye), these problems have been fixed
in version 1:115.6.0-1~deb11u1.
For the stable distribution (bookworm), these problems have been fixed in
version 1:115.6.0-1~deb12u1.
We recommend that you upgrade your thunderbird packages.
For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5585-1] chromium security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5585-1 security@debian.org
https://www.debian.org/security/ Andres Salomon
December 21, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : chromium
CVE ID : CVE-2023-7024
An important security issue was discovered in Chromium, which could result
in the execution of arbitrary code.
Google is aware that an exploit for CVE-2023-7024 exists in the wild.
For the oldstable distribution (bullseye), this problem has been fixed
in version 120.0.6099.129-1~deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 120.0.6099.129-1~deb12u1.
We recommend that you upgrade your chromium packages.
For the detailed security status of chromium please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/chromium
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
ELA-910-1 amd64-microcode security update
Package : amd64-microcode
Version : 3.20230719.1~deb8u1 (jessie), 3.20230719.1~deb9u1 (stretch)
Related CVEs :
CVE-2019-9836
CVE-2023-20592
CVE-2023-20593
Tavis Ormandy discovered that under specific microarchitectural
circumstances, a vector register in “Zen 2” CPUs may not be written to 0
correctly. This flaw allows an attacker to leak register contents across
concurrent processes, hyper threads and virtualized guests.
For details please refer to
https://lock.cmpxchg8b.com/zenbleed.html
https://github.com/google/security-research/security/advisories/GHSA-v6wh-rxpg-cmm8
The initial microcode release by AMD only provides updates for second
generation EPYC CPUs: Various Ryzen CPUs are also affected, but no
updates are available yet. Fixes will be provided in a later update once
they are released.
Ruiyi Zhang, Lukas Gerlach, Daniel Weber, Lorenz Hetterich, Youheng Lü, Andreas Kogler
and Michael Schwarz discovered a software-based fault injection attack on SEV VMs,
leading to a potential loss of guest virtual machine memory integrity.
For details please refer to
https://cachewarpattack.com/
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3005.html
For more specific details and target dates please refer to the AMD
advisory at
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html
