Debian GNU/Linux 8 (Jessie), 9 (Stretch), and 10 (Buster) Extended LTS:
ELA-1214-1 distro-info-data database update
Debian GNU/Linux 10 (Buster) Extended LTS:
ELA-1211-1 libheif security update
Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 3936-1] activemq security update
Debian GNU/Linux 12 (Bookworm):
[DSA 5797-1] twisted security update
[DSA 5796-1] libheif security update
ELA-1211-1 libheif security update
Package : libheif
Version : 1.3.2-2+deb10u2 (buster)
Related CVEs :
CVE-2024-41311
It was discovered that there was a potential out-of-bounds read vulnerability
in libheif, a decoder and encoder for
the HEIF and AVIF image formats.
Insufficient checks in ImageOverlay::parse() could have been exploited by an
overlay image with forged offsets which could in turn have led to undefined
behaviour.
[SECURITY] [DSA 5797-1] twisted security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5797-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 25, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : twisted
CVE ID : CVE-2023-46137 CVE-2024-41671 CVE-2024-41810
Multiple security issues were found in Twisted, an event-based framework
for internet applications, which could result in incorrect ordering of
HTTP requests or cross-site scripting.
For the stable distribution (bookworm), these problems have been fixed in
version 22.4.0-4+deb12u1.
We recommend that you upgrade your twisted packages.
For the detailed security status of twisted please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twisted
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 5796-1] libheif security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5796-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 25, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libheif
CVE ID : CVE-2023-29659 CVE-2023-49462 CVE-2024-41311
Multiple security issues were found in libheif, a library to parse HEIF
and AVIF files, which could result in denial of service or potentially
the execution of arbitrary code.
For the stable distribution (bookworm), these problems have been fixed in
version 1.15.1-1+deb12u1.
We recommend that you upgrade your libheif packages.
For the detailed security status of libheif please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libheif
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 3936-1] activemq security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3936-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Santiago Ruano Rincón
October 25, 2024 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : activemq
Version : 5.16.1-1+deb11u1
CVE ID : CVE-2022-41678 CVE-2023-46604
Debian Bug : 1054909
Two vulnerabilities were found in Apache ActiveMQ, a Java-based message broker.
CVE-2022-41678
Deserialization vulnerability on Jolokia that allows authenticated users to
perform arbitrary code execution.
CVE-2023-46604
The Java OpenWire protocol marshaller is vulnerable to arbitrary code
execution. This vulnerability may allow a remote attacker with network
access to run arbitrary shell commands by manipulating serialized class
types in either a Java-based OpenWire broker or client.
For Debian 11 bullseye, these problems have been fixed in version
5.16.1-1+deb11u1.
We recommend that you upgrade your activemq packages.
For the detailed security status of activemq please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/activemq
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1214-1 distro-info-data database update
Package : distro-info-data
Version : 0.36~bpo8+6 (jessie), 0.41+deb10u2~bpo9+6 (stretch), 0.41+deb10u10 (buster)
This is a routine update of the distro-info-data database for Debian
ELTS users.
It adds Ubuntu 25.04.
