Debian GNU/Linux 10 (Buster):
[DLA 3812-1] libpgjava security update
Debian GNU/Linux 11 (Bullseye) and 12 (Bookworm):
[DSA 5684-1] webkit2gtk security update
[DSA 5686-1] dav1d security update
[DSA 5684-1] webkit2gtk security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5684-1 security@debian.org
https://www.debian.org/security/ Alberto Garcia
May 09, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : webkit2gtk
CVE ID : CVE-2023-42843 CVE-2023-42950 CVE-2023-42956 CVE-2024-23252
CVE-2024-23254 CVE-2024-23263 CVE-2024-23280 CVE-2024-23284
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
CVE-2023-42843
Kacper Kwapisz discovered that visiting a malicious website may
lead to address bar spoofing.
CVE-2023-42950
Nan Wang and Rushikesh Nandedkar discovered that processing
maliciously crafted web content may lead to arbitrary code
execution.
CVE-2023-42956
SungKwon Lee discovered that processing web content may lead to a
denial-of-service.
CVE-2024-23252
anbu1024 discovered that processing web content may lead to a
denial-of-service.
CVE-2024-23254
James Lee discovered that a malicious website may exfiltrate audio
data cross-origin.
CVE-2024-23263
Johan Carlsson discovered that processing maliciously crafted web
content may prevent Content Security Policy from being enforced.
CVE-2024-23280
An anonymous researcher discovered that a maliciously crafted
webpage may be able to fingerprint the user.
CVE-2024-23284
Georg Felber and Marco Squarcina discovered that processing
maliciously crafted web content may prevent Content Security
Policy from being enforced.
For the oldstable distribution (bullseye), these problems have been fixed
in version 2.44.1-1~deb11u1.
For the stable distribution (bookworm), these problems have been fixed in
version 2.44.1-1~deb12u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5686-1] dav1d security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5686-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 09, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : dav1d
CVE ID : CVE-2024-1580
Nick Galloway discovered an integer overflow in dav1d, a fast and small
AV1 video stream decoder which could result in memory corruption.
For the oldstable distribution (bullseye), this problem has been fixed
in version 0.7.1-3+deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 1.0.0-2+deb12u1.
We recommend that you upgrade your dav1d packages.
For the detailed security status of dav1d please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/dav1d
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DLA 3812-1] libpgjava security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3812-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
May 09, 2024 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : libpgjava
Version : 42.2.5-2+deb10u4
CVE ID : CVE-2024-1597
A possible SQL injection vulnerability was found in libpgjava, the
PostgreSQL JDBC Driver. It allows an attacker to inject SQL if using
PreferQueryMode=SIMPLE which is not the default mode. In the default mode
there is no vulnerability.
For Debian 10 buster, this problem has been fixed in version
42.2.5-2+deb10u4.
We recommend that you upgrade your libpgjava packages.
For the detailed security status of libpgjava please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libpgjava
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
