The following updates has been released for Debian GNU/Linux:

Debian GNU/Linux 8 LTS:
DLA 1959-1: xtrlock security update

Debian GNU/Linux 9 and 10:
DSA 4543-1: sudo security update

DLA 1959-1: xtrlock security update

Package : xtrlock
Version : 2.6+deb8u1
CVE ID : CVE-2016-10894
Debian Bug : #830726

It was discovered that multitouch devices were not being disabled
by the "xtrlock" screen locking utility.

xtrlock did not block multitouch events so an attacker could still
input and thus control various programs such as Chromium, etc. via
so-called "multitouch" events including pan scrolling, "pinch and
zoom" or even being able to provide regular mouse clicks by
depressing the touchpad once and then clicking with a secondary
finger.

For Debian 8 "Jessie", this issue has been fixed in xtrlock version
2.6+deb8u1. However, this fix does not the situation where an
attacker plugs in a multitouch device *after* the screen has been
locked. For more information on this, please see:

https://bugs.debian.org/830726#115

We recommend that you upgrade your xtrlock packages pending a
deeper fix.

DSA 4543-1: sudo security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4543-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
October 14, 2019 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : sudo
CVE ID : CVE-2019-14287
Debian Bug : 942322

Joe Vennix discovered that sudo, a program designed to provide limited
super user privileges to specific users, when configured to allow a user
to run commands as an arbitrary user via the ALL keyword in a Runas
specification, allows to run commands as root by specifying the user ID
- -1 or 4294967295. This could allow a user with sufficient sudo
privileges to run commands as root even if the Runas specification
explicitly disallows root access.

Details can be found in the upstream advisory at
https://www.sudo.ws/alerts/minus_1_uid.html .

For the oldstable distribution (stretch), this problem has been fixed
in version 1.8.19p1-2.1+deb9u1.

For the stable distribution (buster), this problem has been fixed in
version 1.8.27-1+deb10u1.

We recommend that you upgrade your sudo packages.

For the detailed security status of sudo please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/sudo

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/