Debian GNU/Linux 9 (Stretch) Extended LTS:
ELA-1118-1 dcmtk security update
Debian GNU/Linux 12 (Bookworm):
[DSA 5724-1] openssh security update
[DSA 5724-1] openssh security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5724-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 01, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : openssh
CVE ID : CVE-2024-6387
The Qualys Threat Research Unit (TRU) discovered that OpenSSH, an
implementation of the SSH protocol suite, is prone to a signal handler
race condition. If a client does not authenticate within LoginGraceTime
seconds (120 by default), then sshd's SIGALRM handler is called
asynchronously and calls various functions that are not
async-signal-safe. A remote unauthenticated attacker can take advantage
of this flaw to execute arbitrary code with root privileges. This flaw
affects sshd in its default configuration.
Details can be found in the Qualys advisory at
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
For the stable distribution (bookworm), this problem has been fixed in
version 1:9.2p1-2+deb12u3.
We recommend that you upgrade your openssh packages.
For the detailed security status of openssh please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/openssh
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
ELA-1118-1 dcmtk security update
Package : dcmtk
Version : 3.6.1~20160216-4+deb10u1 (stretch)
Related CVEs :
CVE-2019-1010228
CVE-2021-41687
CVE-2021-41688
CVE-2021-41689
CVE-2021-41690
CVE-2022-2121
CVE-2022-43272
CVE-2024-28130
CVE-2024-34508
CVE-2024-34509
Multiple vulnerabilities have been fixed in DCMTK, a collection of
libraries and applications implementing large parts the DICOM standard
for medical images.
CVE-2019-1010228
Buffer overflow in DcmRLEDecoder::decompress()
CVE-2021-41687
Incorrect freeing of memory
CVE-2021-41688
Incorrect freeing of memory
CVE-2021-41689
NULL pointer dereference
CVE-2021-41690
Incorrect freeing of memory
CVE-2022-2121
NULL pointer dereference
CVE-2022-43272
Memory leak in single process mode
CVE-2024-28130
Segmentation faults due to incorrect typecast
CVE-2024-34508
Segmentation fault via invalid DIMSE message
CVE-2024-34509
Segmentation fault via invalid DIMSE message
