Debian GNU/Linux 11 (Bullseye) and 12 (Bookworm):
[DSA 5704-1] pillow security update
Debian GNU/Linux 12 (Bookworm):
[DSA 5706-1] libarchive security update
[DSA 5705-1] tinyproxy security update
[DSA 5706-1] libarchive security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5706-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
June 05, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libarchive
CVE ID : CVE-2024-26256
Debian Bug : 1072107
An integer overflow vulnerability in the rar e8 filter was discovered in
libarchive, a multi-format archive and compression library, which may
result in the execution of arbitrary code if a specially crafted RAR
archive is processed.
For the stable distribution (bookworm), this problem has been fixed in
version 3.6.2-1+deb12u1.
We recommend that you upgrade your libarchive packages.
For the detailed security status of libarchive please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/libarchive
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5705-1] tinyproxy security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5705-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
June 05, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : tinyproxy
CVE ID : CVE-2023-49606
A use-after-free was discovered in tinyproxy, a lightweight, non-caching,
optionally anonymizing HTTP proxy, which could result in denial of
service.
For the stable distribution (bookworm), this problem has been fixed in
version 1.11.1-2.1+deb12u1.
We recommend that you upgrade your tinyproxy packages.
For the detailed security status of tinyproxy please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tinyproxy
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5704-1] pillow security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5704-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
June 05, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : pillow
CVE ID : CVE-2023-44271 CVE-2023-50447 CVE-2024-28219
Multiple security issues were discovered in Pillow, a Python imaging
library, which could result in denial of service or the execution of
arbitrary code if malformed images are processed.
For the oldstable distribution (bullseye), these problems have been fixed
in version 8.1.2+dfsg-0.3+deb11u2.
For the stable distribution (bookworm), these problems have been fixed in
version 9.4.0-1.1+deb12u1.
We recommend that you upgrade your pillow packages.
For the detailed security status of pillow please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pillow
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
