[DSA 5935-1] chromium security update
[DLA 4208-1] mariadb-10.5 security update
[SECURITY] [DSA 5935-1] chromium security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5935-1 security@debian.org
https://www.debian.org/security/ Andres Salomon
June 04, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : chromium
CVE ID : CVE-2025-5068 CVE-2025-5419
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure. Google is aware that an exploit for CVE-2025-5419 exists
in the wild.
For the stable distribution (bookworm), these problems have been fixed in
version 137.0.7151.68-1~deb12u1.
We recommend that you upgrade your chromium packages.
For the detailed security status of chromium please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/chromium
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 4208-1] mariadb-10.5 security update
From: Otto Kek??l??inen [otto@debian.org]
To: debian-lts-announce@lists.debian.org
Subject: [SECURITY] [DLA 4208-1] mariadb-10.5 security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4208-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Otto Kekalainen
June 04, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : mariadb-10.5
Version : 1:10.5.29-0+deb11u1
CVE ID : CVE-2025-30693 CVE-2025-30722
Debian Bug : 1099515 1105976
Vulnerabilities was discovered in MariaDB, a SQL database server
compatible with MySQL.
CVE-2025-30693
Easily exploitable vulnerability allows high privileged
attacker with network access via multiple protocols to
compromise MariaDB Server. Successful attacks of this
vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DoS)
of MariaDB Server as well as unauthorized update, insert or
delete access to some of MariaDB Server accessible data.
CVE-2025-30722
Difficult to exploit vulnerability allows low
privileged attacker with network access via multiple
protocols to compromise MariaDB Client. Successful attacks
of this vulnerability can result in unauthorized access
to critical data or complete access to all MariaDB Client
accessible data as well as unauthorized update, insert
or delete access to some of MariaDB Client accessible data
For Debian 11 bullseye, these problems have been fixed in version
1:10.5.29-0+deb11u1.
This update also includes a NEWS entry about CVE-2025-30693:
Fix of CVE-2025-30693, need to changes data format of innoDB format
particularly variable-length encoding. Fix replace
mach_write_compressed() with mach_u64_write_much_compressed(),
which produces an identical encoding for 32-bit unsigned values.
Any 64-bit unsigned integer that does not fit in 32 bits would be
encoded as the octet 0xff followed by two the variable-length
encoded 32-bit halves of the integer.
This scheme is not backward compatible with older format, and may
break external tools, particularly if tools read indexes on
virtual columns in InnoDB undo log records.
Additionally, the updates also includes bugfixes through the 10.5 maintenance
branch, as detailed at: https://mariadb.com/kb/en/mariadb-10-5-29-release-notes/
We recommend that you upgrade your mariadb-10.5 packages.
For the detailed security status of mariadb-10.5 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mariadb-10.5
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
